8 ms·

Australia locks down ports after ‘nationally significant’ cyberattack

147 points by perihelions 3y ago

jruohonen 3y ago
"The operator shut down four ports at Sydney, Melbourne, Brisbane, and Fremantle after detecting a cybersecurity incident late on Friday night. DP World is responsible for 40 per cent of Australia’s maritime freight." Yes, sounds serious enough.
GordonS 3y ago
I was thinking about networking ports from the title!
- parsimo2010 3y ago
  Yeah the article makes it pretty far before saying “maritime ports” and even then the article never seemed to acknowledge that there is ambiguity in “shutting down port operations” created when the triggering event is a cyber attack.
  - hnlmorg 3y ago
    I appreciate you may not be aware of the Independent but it’s a general audience publication. That author isn’t even a tech journalist so I doubt they are even aware of what a TCP/IP port is let alone that it’s related to the subject matter in any way. They’d probably have more familiarity with “port” used in other contexts like: - the opposite of starboard - USB port - the alcoholic beverage (like Wine) …amongst any array of other usages. And out of all of them, the one that makes the most grammatical sense to your average person is maritime ports. So I don’t think it’s unreasonable the way it was written.
  - joppy 3y ago
    If a country has the capability to "lock down ports", they're probably shipping ports - do you think Australia is just suddenly going to (or has the capability to) block all IP traffic on certain ports? A notable exception is China.
    - astrange 3y ago
      They could do it if they tried. Part of being an island is there's only a few connections to the outside.
      - AnimalMuppet 3y ago
        Satellite internet would like a word.
        fomine3 3y ago
        Perhaps < 1% traffic is routed by satellites, such congestion means it's almost blocked
        astrange 3y ago
        They don't operate without licenses.
  - halJordan 3y ago
    So when you read DP World is shutting down four major ports in the first few sentences: You thought that a private company was requiring every other private company & the various govts in Aus to firewall off the http port or something like that? I'm all for blaming schools and blaming journalists for mistakes stupid people make, but that seems like it's on you being a little too credulous.
    - parsimo2010 3y ago
      I figured it out from context clues, like everyone else. I just found it a little disappointing that in an article about Australia locking down ports after a cyber attack, there wasn’t even a clarifying statement that it wasn’t talking about a network firewall. Although this is not a tech focused publication, it seemed a bit of an oversight and I wasn’t the only one who thought so.
  - globular-toast 3y ago
    I mean, if you know what a network port is how could the title or content referring to network ports make sense?
  - tekla 3y ago
    This seems mostly like willful ignorance. How does the article title make any sense if you know about computer ports, or really any ports? Maybe the article was talking about literally locking down server room Ethernet ports amirite?
- chrismorgan 3y ago
  > an ongoing cyberattack targeting major ports Hmm… 443 (HTTPS), 80 (HTTP), 53 (DNS), 587 (SMTP submission), …
- alwaysrunning 3y ago
  lol that was my first thought too.
coffeecantcode 3y ago
For context: China had a ban on Australian imports in the wake of the Australian PM saying that Xi and China should be investigated because of Covid or something along those lines. China just this last week dropped the ban and expected Australian imports to come flooding back in but almost nobody bit that hook due to the amount of time and money export companies had spent arranging relationships with other countries instead of China in the wake of the ban.
- yellow_lead 3y ago
  That's pretty bad for China. As I recall they import most of their iron ore from Australia for steel production. Australia is a huge metals exporter.
  - coffeecantcode 3y ago
    Yeah it’s a bad look, especially since Australia pivoted to India to fill the large gap China left in their export market. Now India is importing from Australia at a rate that is alarming only to China. The only problem for Australia is the China was often times paying radically larger premiums for Australian goods then any other country would be willing to pay. So everyone is starting to feel the heat. https://www.wsj.com/world/asia/china-says-australias-exporters-can-come-back-some-say-no-thanks-5bcf5d27?st=4k1y248zy6iw4rh&reflink=article_copyURL_share https://www.wsj.com/world/asia/china-says-australias-exporte... Interesting read.
  - ImaCake 3y ago
    Although your point still stands, the iron ore goes out through different ports mostly in the Pilbarra or northern Queensland.
    - defrost 3y ago
      Moreover they're not particularly susceptable to remote cyber attack having been built in the 1970s. Dampier, Cape Lambert, Port Hedland, are all single jetty deep water ports with single high capacity conveyor belts that run out to human operated ship loaders. These aren't high volume container ports with fancy networked container picking & stacking robots servicing multiple ships at a time with complex consignment lists. The iron ore shore facalities are physically, electrically, network wise, isolated mostly manual operations with joystick loaders, captained pilot boats, and line of sight sea flag siognalling and radio channel communication. You can take them out with a bomb but not a cyber attack.
throwaway290 3y ago
The headline doesn't fully jive with the text. Ports were shut down by a private company called "DP World Australia". DP World is an UAE based shipping company that apparently operates some Australian ports and handles 40% of country's shipping traffic? Obviously it's a major fish so the government basically has no choice and tries to help them sort out the attack.
- deleted 3y ago
  [deleted]
justinclift 3y ago
Wonder if there's a relationship between the Optus outage a few days ago and this cyberattack?
- rpy 3y ago
  The government have said the Optus outage was not suspicious. Seems to have been a BGP config change gone wrong.
  - jiggawatts 3y ago
    Is that your best guest or have you seen any insider information? I haven’t yet seen even the hint of the specific technology involved, let alone a root cause analysis.
    - justinclift 3y ago
      The BGP thing was mentioned on HN as a likely possibility in the main submissions discussing the outage (https://news.ycombinator.com/item?id=38185841 https://news.ycombinator.com/item?id=38185841, https://news.ycombinator.com/item?id=38185009 https://news.ycombinator.com/item?id=38185009), and the Cloudflare Radar "BGP Announcements" graph seems to support it. There's a spike of 940,480 BGP events on Nov 7th at 17:00 UTC, which was 4am Sydney time: https://radar.cloudflare.com/as4804?dateRange=7d https://radar.cloudflare.com/as4804?dateRange=7d Note the "7d" (7 days) on the end of the url, so if you're trying that link more than a week after the Optus event you might need to bump that number up. --- Doesn't seem like captures / snapshots of Cloudflare Radar by The Wayback Machine (web.archive.org), nor archive.today work. Seems to only capture the html/css/js, but without any data. So the graphs are all empty / grey. :(
    - rpy 3y ago
      They've confirmed it: https://www.abc.net.au/news/2023-11-13/optus-identifies-cause-of-nationwide-outage-software-upgrade/103099902 https://www.abc.net.au/news/2023-11-13/optus-identifies-caus...
  - idonotknowwhy 3y ago
helpfulContrib 3y ago
[dead]
heresie-dabord 3y ago
TFA also mentions: "The cybersecurity incident follows a cyberattack at Melbourne’s cryptocurrency exchange Coinspot, which saw more than $2m taken away from accounts." However, theft from a cryptocurrency exchange may be considered to be a "credulity correction" in market economics.
pedalpete 3y ago
The ports of Sydney and Melbourne have been shutdown over the weekend as part of pro-Palestinian rallies. I wonder if this could be related. https://www.9news.com.au/national/pro-palestine-protesters-gather-at-port-botany-in-sydneys-east/a1030934-7a32-43ad-8f78-bb29e3f7fbcc https://www.9news.com.au/national/pro-palestine-protesters-g... HelpfulContrib stated the same, but was either downvoted to oblivion or removed his post.
- technion 3y ago
  I would generally suggest if you haven't patched a Netscaler by this point, which Shodan suggests they had not, you're a timebomb for a ransomware outbreak. There's a lot of political suggestions that have reasonable arguments but I'd be very surprised if there was much more targeting than "hey we found another unpatched Netscaler".
- throwaway290 3y ago
  For sure Hamas aligned forces seem more likely than China here. Remember Hamas is friends with Qatar and they both have reasons to dislike UAE lots.
plantain 3y ago
Highly likely it was unpatched Citrix Netscaler https://cyberplace.social/@GossiTheDog/111391466200487619 https://cyberplace.social/@GossiTheDog/111391466200487619
- ajsnigrutin 3y ago
  I didn't check the CVEs or anything... Are we talking about a sophisticated attack with a lot of effort? Or like a 14yo script kiddie running a portscan and then a script (downloaded from the internet) on all found open ports?
  - technion 3y ago
    It doesn't come much easier than the Citrixbleed exploit. https://github.com/GossiTheDog/scanning/blob/main/CitrixBleed.curl https://github.com/GossiTheDog/scanning/blob/main/CitrixBlee... But I do think society needs to get over the "14 year old script kiddie" slur. The "Enterprise Architects" and "CISCO" being paid a fortune only to be victims of basic issues don't get to look their nose on the people who used a basic exploit.
    - drekipus 3y ago
      That's a very good point, but I (like to..) think the slur is used against the administrators.. Ie: "you got beaten by a14yo skiddie, are you daft" ?
globalnode 3y ago
Earlier that week there was a humungous telco outage at Optus in Australia too. All (mobile?) services down for almost 24 hours and they still dont know what caused it. A few days later, this happens at the ports. May or may not be linked. It could be a state player that doesnt want Australia and China to trade... USA perhaps?
- plugger 3y ago
  The Optus outage was in the order of 8-9 hours and was a core network fault off the back of a bodged upgrade rolled out in the middle of the night. It's completely unrelated to China, the United States, or geopolitics in general. Optus has laid off a lot of engineers since Covid and those decisions are starting to have knock on effects.

147 points by perihelions 3y ago

"The operator shut down four ports at Sydney, Melbourne, Brisbane, and Fremantle after detecting a cybersecurity incident late on Friday night. DP World is responsible for 40 per cent of Australia’s maritime freight." Yes, sounds serious enough.

GordonS 3y ago

I was thinking about networking ports from the title!

parsimo2010 3y ago
Yeah the article makes it pretty far before saying “maritime ports” and even then the article never seemed to acknowledge that there is ambiguity in “shutting down port operations” created when the triggering event is a cyber attack.
- hnlmorg 3y ago
  I appreciate you may not be aware of the Independent but it’s a general audience publication. That author isn’t even a tech journalist so I doubt they are even aware of what a TCP/IP port is let alone that it’s related to the subject matter in any way. They’d probably have more familiarity with “port” used in other contexts like: - the opposite of starboard - USB port - the alcoholic beverage (like Wine) …amongst any array of other usages. And out of all of them, the one that makes the most grammatical sense to your average person is maritime ports. So I don’t think it’s unreasonable the way it was written.
- joppy 3y ago
  If a country has the capability to "lock down ports", they're probably shipping ports - do you think Australia is just suddenly going to (or has the capability to) block all IP traffic on certain ports? A notable exception is China.
  - astrange 3y ago
    They could do it if they tried. Part of being an island is there's only a few connections to the outside.
    - AnimalMuppet 3y ago
      Satellite internet would like a word.
      - fomine3 3y ago
        Perhaps < 1% traffic is routed by satellites, such congestion means it's almost blocked
      - astrange 3y ago
        They don't operate without licenses.
- halJordan 3y ago
  So when you read DP World is shutting down four major ports in the first few sentences: You thought that a private company was requiring every other private company & the various govts in Aus to firewall off the http port or something like that? I'm all for blaming schools and blaming journalists for mistakes stupid people make, but that seems like it's on you being a little too credulous.
  - parsimo2010 3y ago
    I figured it out from context clues, like everyone else. I just found it a little disappointing that in an article about Australia locking down ports after a cyber attack, there wasn’t even a clarifying statement that it wasn’t talking about a network firewall. Although this is not a tech focused publication, it seemed a bit of an oversight and I wasn’t the only one who thought so.
- globular-toast 3y ago
  I mean, if you know what a network port is how could the title or content referring to network ports make sense?
- tekla 3y ago
  This seems mostly like willful ignorance. How does the article title make any sense if you know about computer ports, or really any ports? Maybe the article was talking about literally locking down server room Ethernet ports amirite?
chrismorgan 3y ago
> an ongoing cyberattack targeting major ports Hmm… 443 (HTTPS), 80 (HTTP), 53 (DNS), 587 (SMTP submission), …
alwaysrunning 3y ago
lol that was my first thought too.

coffeecantcode 3y ago

For context: China had a ban on Australian imports in the wake of the Australian PM saying that Xi and China should be investigated because of Covid or something along those lines. China just this last week dropped the ban and expected Australian imports to come flooding back in but almost nobody bit that hook due to the amount of time and money export companies had spent arranging relationships with other countries instead of China in the wake of the ban.

yellow_lead 3y ago
That's pretty bad for China. As I recall they import most of their iron ore from Australia for steel production. Australia is a huge metals exporter.
- coffeecantcode 3y ago
  Yeah it’s a bad look, especially since Australia pivoted to India to fill the large gap China left in their export market. Now India is importing from Australia at a rate that is alarming only to China. The only problem for Australia is the China was often times paying radically larger premiums for Australian goods then any other country would be willing to pay. So everyone is starting to feel the heat. https://www.wsj.com/world/asia/china-says-australias-exporters-can-come-back-some-say-no-thanks-5bcf5d27?st=4k1y248zy6iw4rh&reflink=article_copyURL_share https://www.wsj.com/world/asia/china-says-australias-exporte... Interesting read.
- ImaCake 3y ago
  Although your point still stands, the iron ore goes out through different ports mostly in the Pilbarra or northern Queensland.
  - defrost 3y ago
    Moreover they're not particularly susceptable to remote cyber attack having been built in the 1970s. Dampier, Cape Lambert, Port Hedland, are all single jetty deep water ports with single high capacity conveyor belts that run out to human operated ship loaders. These aren't high volume container ports with fancy networked container picking & stacking robots servicing multiple ships at a time with complex consignment lists. The iron ore shore facalities are physically, electrically, network wise, isolated mostly manual operations with joystick loaders, captained pilot boats, and line of sight sea flag siognalling and radio channel communication. You can take them out with a bomb but not a cyber attack.

throwaway290 3y ago

The headline doesn't fully jive with the text. Ports were shut down by a private company called "DP World Australia". DP World is an UAE based shipping company that apparently operates some Australian ports and handles 40% of country's shipping traffic? Obviously it's a major fish so the government basically has no choice and tries to help them sort out the attack.

deleted 3y ago
[deleted]

justinclift 3y ago

Wonder if there's a relationship between the Optus outage a few days ago and this cyberattack?

rpy 3y ago
The government have said the Optus outage was not suspicious. Seems to have been a BGP config change gone wrong.
- jiggawatts 3y ago
  Is that your best guest or have you seen any insider information? I haven’t yet seen even the hint of the specific technology involved, let alone a root cause analysis.
  - justinclift 3y ago
    The BGP thing was mentioned on HN as a likely possibility in the main submissions discussing the outage (https://news.ycombinator.com/item?id=38185841 https://news.ycombinator.com/item?id=38185841, https://news.ycombinator.com/item?id=38185009 https://news.ycombinator.com/item?id=38185009), and the Cloudflare Radar "BGP Announcements" graph seems to support it. There's a spike of 940,480 BGP events on Nov 7th at 17:00 UTC, which was 4am Sydney time: https://radar.cloudflare.com/as4804?dateRange=7d https://radar.cloudflare.com/as4804?dateRange=7d Note the "7d" (7 days) on the end of the url, so if you're trying that link more than a week after the Optus event you might need to bump that number up. --- Doesn't seem like captures / snapshots of Cloudflare Radar by The Wayback Machine (web.archive.org), nor archive.today work. Seems to only capture the html/css/js, but without any data. So the graphs are all empty / grey. :(
  - rpy 3y ago
    They've confirmed it: https://www.abc.net.au/news/2023-11-13/optus-identifies-cause-of-nationwide-outage-software-upgrade/103099902 https://www.abc.net.au/news/2023-11-13/optus-identifies-caus...
- idonotknowwhy 3y ago

helpfulContrib 3y ago

[dead]

heresie-dabord 3y ago

TFA also mentions: "The cybersecurity incident follows a cyberattack at Melbourne’s cryptocurrency exchange Coinspot, which saw more than $2m taken away from accounts." However, theft from a cryptocurrency exchange may be considered to be a "credulity correction" in market economics.

pedalpete 3y ago

The ports of Sydney and Melbourne have been shutdown over the weekend as part of pro-Palestinian rallies. I wonder if this could be related. https://www.9news.com.au/national/pro-palestine-protesters-gather-at-port-botany-in-sydneys-east/a1030934-7a32-43ad-8f78-bb29e3f7fbcc https://www.9news.com.au/national/pro-palestine-protesters-g... HelpfulContrib stated the same, but was either downvoted to oblivion or removed his post.

technion 3y ago
I would generally suggest if you haven't patched a Netscaler by this point, which Shodan suggests they had not, you're a timebomb for a ransomware outbreak. There's a lot of political suggestions that have reasonable arguments but I'd be very surprised if there was much more targeting than "hey we found another unpatched Netscaler".
throwaway290 3y ago
For sure Hamas aligned forces seem more likely than China here. Remember Hamas is friends with Qatar and they both have reasons to dislike UAE lots.

plantain 3y ago

Highly likely it was unpatched Citrix Netscaler https://cyberplace.social/@GossiTheDog/111391466200487619 https://cyberplace.social/@GossiTheDog/111391466200487619

ajsnigrutin 3y ago
I didn't check the CVEs or anything... Are we talking about a sophisticated attack with a lot of effort? Or like a 14yo script kiddie running a portscan and then a script (downloaded from the internet) on all found open ports?
- technion 3y ago
  It doesn't come much easier than the Citrixbleed exploit. https://github.com/GossiTheDog/scanning/blob/main/CitrixBleed.curl https://github.com/GossiTheDog/scanning/blob/main/CitrixBlee... But I do think society needs to get over the "14 year old script kiddie" slur. The "Enterprise Architects" and "CISCO" being paid a fortune only to be victims of basic issues don't get to look their nose on the people who used a basic exploit.
  - drekipus 3y ago
    That's a very good point, but I (like to..) think the slur is used against the administrators.. Ie: "you got beaten by a14yo skiddie, are you daft" ?

globalnode 3y ago

Earlier that week there was a humungous telco outage at Optus in Australia too. All (mobile?) services down for almost 24 hours and they still dont know what caused it. A few days later, this happens at the ports. May or may not be linked. It could be a state player that doesnt want Australia and China to trade... USA perhaps?

plugger 3y ago
The Optus outage was in the order of 8-9 hours and was a core network fault off the back of a bodged upgrade rolled out in the middle of the night. It's completely unrelated to China, the United States, or geopolitics in general. Optus has laid off a lot of engineers since Covid and those decisions are starting to have knock on effects.