7 ms·

The attack against Danish, critical infrastructure [pdf]

92 points by ano-ther 3y ago

ano-ther 3y ago
> Report about the largest cyber attack against Danish, critical infrastructure we know of. The attack happened in May 2023. The publication is from November 2023.
johncoltrane 3y ago
That comma is maddening.
- HPsquared 3y ago
  I can't understand its function. Is this a Danish language thing that was carried over in translation?
  - mrkeen 3y ago
    Usually you do put a comma to separate two adjectives that modify a noun. Native speakers know not to include it here, and I don't know why.
    - azangru 3y ago
      See "coordinate adjectives" vs "non-coordinate adjectives".
    - civilitty 3y ago
      > Native speakers know not to include it here, and I don't know why. Native speakers would phrase it as "critical Danish infrastructure." Commas are only used to separate coordinate adjectives that are equal in importance. Here, "Danish" gives us an immutable property of the noun which is more important that "critical" which is a statement of quality. "Broken critical Danish infrastructure" is also grammatically valid since it's "(condition) (quality) (national association) (noun)"
      - plugin-baby 3y ago
        > Native speakers would phrase it as "critical Danish infrastructure." As a native speaker, I’m not convinced by this.
        brookst 3y ago
        As a native, speaker I am.
        dkjaudyeqooe 3y ago
        I agree with it, how would you phrase it?
        plugin-baby 3y ago
        Seems fine as Danish critical infrastructure. Similarly French blue cheese, Prussian light infantry, American civil war.
        xcdzvyn 3y ago
        There's an inherent order to adjectives in English[0], so the sentence is objectively formed as "critical Danish infrastructure". I do understand why someone would (knowing those rules) write "Danish critical infrastructure", possibly for emphasis, but it's not - and take this word very loosely - correct. [0] https://www.gingersoftware.com/content/grammar-rules/adjectives/order-of-adjectives https://www.gingersoftware.com/content/grammar-rules/adjecti...
        plugin-baby 3y ago
        I’m not sure quite how to read these rules - isn’t “critical” a “purpose or qualifier”? Which would mean the original formulation follows the rules.
        civilitty 3y ago
        No, a "purpose or qualifier" is (usually) the defining characteristic of a noun. For example, power infrastructure vs water infrastructure. If you said "power Danish infrastructure" or "water Danish infrastructure", power/water don't make sense as adjectives. Sometimes "critical" is a qualifier like "critical condition" but in this case, it's a quality.
  - yokoprime 3y ago
    Could it be danish and critical infrastructure as in two different entities?
    - mistrial9 3y ago
      Danish is used as an adjective
    - plugin-baby 3y ago
      It could be, presumably implying an attack against the danish people or language, and which critical infrastructure implied by context. In which case the comma would make more sense, but the situation would be quite weird!
      - ethbr1 3y ago
        Core servers supporting the Danish language were compromised! 'Slå til Søren' possibly corrupted. People named Søren suspected.
      - dkjaudyeqooe 3y ago
        Language yes, people no, that would be 'Danes' or perhaps 'the Danish'.
    - dkjaudyeqooe 3y ago
      It reads as an attack against a pastry and critical infrastructure. It's very upsetting, I love Danishes, so delicious.
  - mannykannot 3y ago
    I thought I knew the answer, but it is a tricky question, at least in English. Firstly, there is the order of adjectives: https://dictionary.cambridge.org/grammar/british-grammar/adjectives-order https://dictionary.cambridge.org/grammar/british-grammar/adj... Secondly, whether to separate them with a comma: https://getitwriteonline.com/commas-between-adjectives/ https://getitwriteonline.com/commas-between-adjectives/ These two principles together seem to suggest "The attack against Danish critical infrastructure" (you would not put an "and" between them, and place comes before type), but to me, "The attack against critical Danish infrastructure" feels slightly better. I'm not sure why, but it might have something to do with my feeling that when I hear about an attack on infrastructure, perhaps the question of how serious it is puts any other adjective in context. One could also say "The [May, 2023] attack on Denmark's critical infrastructure" or "The/An attack on critical infrastructure in Denmark."
    - ethbr1 3y ago
      The attack against Danish critical infrastructure Feels maximally neutral. Critical infrastructure was attacked. That infrastructure was Danish. The attack against critical Danish infrastructure Conveys more of an emphasis that the infrastructure was critical to Denmark (with a very slight flavor that maybe it's not generally accepted critical infrastructure?). In practice, as a southeastern US English speaker (if that matters?), adjectives closer to the noun rank higher in emphasis. I'm sure there are exceptions (ugh, English), but increasing-emphasis ordering if it's a generic bag-of-adjectives.
      - brookst 3y ago
        FWIW as a northwest USian, “Danish critical infrastructure” reads like the attack was against critical infrastructure of Danish origin, wherever it might be now. “Critical Danish infrastructure” tells me it is critical infrastructure perhaps made anywhere but deployed in Denmark. It is surprisingly ambiguous though.
  - dboreham 3y ago
    Modem noise?
  - tokai 3y ago
    Yes its a Danish comma thing. Even in Danish its a bit too much though. But that is what you get for making some commas optional.[0] Use of commas is generally a mess in danish. The whole report is full of wrong commas, for written English. Quite embarrassing. [0] https://dsn-dk.translate.goog/ordboeger/retskrivningsordbogen/%c2%a7-40-60-tegnsaetning/%c2%a7-45-51-komma/%c2%a7-49-50-ledsaetninger/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp https://dsn-dk.translate.goog/ordboeger/retskrivningsordboge...
    - jacquesm 3y ago
      Use of commas is a mess in other EU countries as well, especially when it comes to numbers. Some countries - including my own - use the , for a . and vice versa in numbers. So 1.000(nl) => 1,000(uk/us etc). This causes a ton of trouble with students who will consume all kinds of information online where the '.' is used as a decimal point and then have to correctly answer questions on their exams where it uses a ',' and a '.' is simply ignored leading to what are in principle correct answers flagged as errors. This is super annoying because at the same time school mandated computers and calculators will use a confusing mixture of the two depending on whether you are using local software or online software or a physical device intended for another market.
      - mmastrac 3y ago
        I would love it if we could move to thin-line thousands separators and middle dot for decimals [1]. I know it won't happen, but that would be amazing. [1] https://academia.stackexchange.com/questions/117982/central-dot-as-decimal-point-in-top-journal https://academia.stackexchange.com/questions/117982/central-...
        jacquesm 3y ago
        I'd read that as multiplication instead... This is what you get from using inconsistent symbols for important functions, I would not be surprised at all if people died over '.' vs ',' in a piece of medical gear or avionics. I'd use a completely new symbol before repurposing an old one. And in a way the '*' that computer languages tend to use for multiplication serves as a nice way to avoid mixups (as opposed to 'x').
- Lio 3y ago
  I didn't notice until you mentioned it. Now I just hear it in a caricature William Shatner voice.
- globalise83 3y ago
  If in doubt kick it out. You only live, once.
  - deleted 3y ago
    [deleted]
- nine_k 3y ago
  But what if the comma is the attack? Imagine all the mental energy it has drained.
  - dkjaudyeqooe 3y ago
    On HN? People don't come here to be productive (if it happens, it's by accident) so that energy was headed to the drain anyway. To the contrary I envisage many ESL readers will learn about comma usage today.
    - 2-718-281-828 3y ago
      good point but not on point. it will drain energy but lack the dopamine rush, hence leave the news hacker with an even stronger desire for cheap stimulation to be sought out.
- thomasahle 3y ago
  In Danish we separate adjectives with comma. I don't actually know the English rules.
  - mmastrac 3y ago
    Ideally it would be "critical Danish infrastructure" with no comma, but the comma probably disambiguates the headline quite a bit making it clear that two adjectives apply to the noun "infrastructure". The frustration in native English speakers probably comes from the fast the comma-less version would probably be unambiguous and that comma causes our brains to skip a beat for what we subconsciously believe is an unnecessary purpose. If all English headlines were written to be clear rather than as easy as possible to read, the overall state of news would probably be better....
    - marky1991 3y ago
      I think it makes it more unclear, not less. I parse it as "attack against danish and critical infrastructure", matching the standard usage of commas in english. "Critical danish infrastructure" only has one possible interpretation in standard english imo.
      - InCityDreams 3y ago
        "Standard English" uses capital letters for proper nouns.
        marky1991 3y ago
        Yes, and?
- einpoklum 3y ago
  Come on, you know that kind of pastry had it coming!
Rufus_Tuesday 3y ago
I bet Miles Davis would be annoyed by that comma also...
motohagiography 3y ago
The key facts appear to be that there was an IKE vulnerability in Zyxel firewalls that allowed for a single packet compromise. The attacker used this simulataneously across all targeted companies. The report says the infra under attack didn't appear in Shodan, so the attackers would have used some other scanning to develop the attack surface, and they attribute it to a state actor. While I was involved in a lot of critical infrastructure work over the years, there is so much mutually assured destruction on 'cyber' now that I don't see the economics of it anymore. Personally, I have doubts NATO can afford to act directly in a kinetic military capacity anymore and it has to operate through proxy parties because its members' infra is so exposed that no elected government survives a cyber retaliation against its energy and other infra services that derails its civil society. That said, I've held that belief for over a decade and haven't had it tested.
- jjoonathan 3y ago
  Angell famously published a book with a similar thesis in 1909, right before WWI. He was right about industrialized war being highly destructive and unprofitable, but he was wrong to think that this would stop the belligerents. [1] https://en.wikipedia.org/wiki/The_Great_Illusion https://en.wikipedia.org/wiki/The_Great_Illusion
  - codedokode 3y ago
    Why is war unprofitable? The value of the land in a long run tends towards infinity, especially if it is populated with taxable people and factories.
    - jjoonathan 3y ago
      The money that you spent fighting could have been spent on other activities that also tend towards infinity. At higher rates. Without a huge initial setback. Of course, you only control your own choices not your competitors/opponents' choices, so game theory makes the outcome of "everyone chooses peace" nontrivial to achieve.
pnw 3y ago
Grammar aside, the TLDR is that most of the Danish energy infrastructure was protected by a particular Zyxel firewall, and they got hacked by a state actor a couple of weeks after a published vulnerability, and ten days after being warned explicitly to update their firewalls. Anyone else find it alarming that critical infrastructure is being protected by a fairly low end Taiwanese networking vendor and not a more well known firewall brand?
- aaron695 3y ago
  [dead]
- MaKey 3y ago
  > Anyone else find it alarming that critical infrastructure is being protected by a fairly low end Taiwanese networking vendor and not a more well known firewall brand? Like Cisco with their regular CVEs?
  - doublerabbit 3y ago
    > Like Cisco with their regular CVEs? It's why I use QBasic for my firewalls.
  - wepple 3y ago
    CVEs aren’t a significant datapoint… In this case, a single-packet pre-auth root code exec is about as bad as it gets. I don’t recall the last time a major vendor had a doozie like that. Bugs happen, but having them wildly exploitable isn’t inevitable.
  - lijok 3y ago
    Yes, like Cisco Having regular CVEs signals only one thing - the product is popular
- userbinator 3y ago
  I find it more alarming that critical infrastructure isn't completely isolated from the Internet.
jalk 3y ago
I laughed a little when reading the info box “24x7” (stating that SektorCERT can’t respond to attacks outside of business hours). I.e. “We told you fucking so”
ChoHag 3y ago
So you found out about the vulnerability in the firewalls on your critical infrastructure, waited for a week before telling anyone and then sat on it for two more? Nice dramatisation though. Very intense.

92 points by ano-ther 3y ago

> Report about the largest cyber attack against Danish, critical infrastructure we know of. The attack happened in May 2023. The publication is from November 2023.

johncoltrane 3y ago

That comma is maddening.

HPsquared 3y ago
I can't understand its function. Is this a Danish language thing that was carried over in translation?
- mrkeen 3y ago
  Usually you do put a comma to separate two adjectives that modify a noun. Native speakers know not to include it here, and I don't know why.
  - azangru 3y ago
    See "coordinate adjectives" vs "non-coordinate adjectives".
  - civilitty 3y ago
    > Native speakers know not to include it here, and I don't know why. Native speakers would phrase it as "critical Danish infrastructure." Commas are only used to separate coordinate adjectives that are equal in importance. Here, "Danish" gives us an immutable property of the noun which is more important that "critical" which is a statement of quality. "Broken critical Danish infrastructure" is also grammatically valid since it's "(condition) (quality) (national association) (noun)"
    - plugin-baby 3y ago
      > Native speakers would phrase it as "critical Danish infrastructure." As a native speaker, I’m not convinced by this.
      - brookst 3y ago
        As a native, speaker I am.
      - dkjaudyeqooe 3y ago
        I agree with it, how would you phrase it?
        plugin-baby 3y ago
        Seems fine as Danish critical infrastructure. Similarly French blue cheese, Prussian light infantry, American civil war.
      - xcdzvyn 3y ago
        There's an inherent order to adjectives in English[0], so the sentence is objectively formed as "critical Danish infrastructure". I do understand why someone would (knowing those rules) write "Danish critical infrastructure", possibly for emphasis, but it's not - and take this word very loosely - correct. [0] https://www.gingersoftware.com/content/grammar-rules/adjectives/order-of-adjectives https://www.gingersoftware.com/content/grammar-rules/adjecti...
        plugin-baby 3y ago
        I’m not sure quite how to read these rules - isn’t “critical” a “purpose or qualifier”? Which would mean the original formulation follows the rules.
        civilitty 3y ago
        No, a "purpose or qualifier" is (usually) the defining characteristic of a noun. For example, power infrastructure vs water infrastructure. If you said "power Danish infrastructure" or "water Danish infrastructure", power/water don't make sense as adjectives. Sometimes "critical" is a qualifier like "critical condition" but in this case, it's a quality.
- yokoprime 3y ago
  Could it be danish and critical infrastructure as in two different entities?
  - mistrial9 3y ago
    Danish is used as an adjective
  - plugin-baby 3y ago
    It could be, presumably implying an attack against the danish people or language, and which critical infrastructure implied by context. In which case the comma would make more sense, but the situation would be quite weird!
    - ethbr1 3y ago
      Core servers supporting the Danish language were compromised! 'Slå til Søren' possibly corrupted. People named Søren suspected.
    - dkjaudyeqooe 3y ago
      Language yes, people no, that would be 'Danes' or perhaps 'the Danish'.
  - dkjaudyeqooe 3y ago
    It reads as an attack against a pastry and critical infrastructure. It's very upsetting, I love Danishes, so delicious.
- mannykannot 3y ago
  I thought I knew the answer, but it is a tricky question, at least in English. Firstly, there is the order of adjectives: https://dictionary.cambridge.org/grammar/british-grammar/adjectives-order https://dictionary.cambridge.org/grammar/british-grammar/adj... Secondly, whether to separate them with a comma: https://getitwriteonline.com/commas-between-adjectives/ https://getitwriteonline.com/commas-between-adjectives/ These two principles together seem to suggest "The attack against Danish critical infrastructure" (you would not put an "and" between them, and place comes before type), but to me, "The attack against critical Danish infrastructure" feels slightly better. I'm not sure why, but it might have something to do with my feeling that when I hear about an attack on infrastructure, perhaps the question of how serious it is puts any other adjective in context. One could also say "The [May, 2023] attack on Denmark's critical infrastructure" or "The/An attack on critical infrastructure in Denmark."
  - ethbr1 3y ago
    The attack against Danish critical infrastructure Feels maximally neutral. Critical infrastructure was attacked. That infrastructure was Danish. The attack against critical Danish infrastructure Conveys more of an emphasis that the infrastructure was critical to Denmark (with a very slight flavor that maybe it's not generally accepted critical infrastructure?). In practice, as a southeastern US English speaker (if that matters?), adjectives closer to the noun rank higher in emphasis. I'm sure there are exceptions (ugh, English), but increasing-emphasis ordering if it's a generic bag-of-adjectives.
    - brookst 3y ago
      FWIW as a northwest USian, “Danish critical infrastructure” reads like the attack was against critical infrastructure of Danish origin, wherever it might be now. “Critical Danish infrastructure” tells me it is critical infrastructure perhaps made anywhere but deployed in Denmark. It is surprisingly ambiguous though.
- dboreham 3y ago
  Modem noise?
- tokai 3y ago
  Yes its a Danish comma thing. Even in Danish its a bit too much though. But that is what you get for making some commas optional.[0] Use of commas is generally a mess in danish. The whole report is full of wrong commas, for written English. Quite embarrassing. [0] https://dsn-dk.translate.goog/ordboeger/retskrivningsordbogen/%c2%a7-40-60-tegnsaetning/%c2%a7-45-51-komma/%c2%a7-49-50-ledsaetninger/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp https://dsn-dk.translate.goog/ordboeger/retskrivningsordboge...
  - jacquesm 3y ago
    Use of commas is a mess in other EU countries as well, especially when it comes to numbers. Some countries - including my own - use the , for a . and vice versa in numbers. So 1.000(nl) => 1,000(uk/us etc). This causes a ton of trouble with students who will consume all kinds of information online where the '.' is used as a decimal point and then have to correctly answer questions on their exams where it uses a ',' and a '.' is simply ignored leading to what are in principle correct answers flagged as errors. This is super annoying because at the same time school mandated computers and calculators will use a confusing mixture of the two depending on whether you are using local software or online software or a physical device intended for another market.
    - mmastrac 3y ago
      I would love it if we could move to thin-line thousands separators and middle dot for decimals [1]. I know it won't happen, but that would be amazing. [1] https://academia.stackexchange.com/questions/117982/central-dot-as-decimal-point-in-top-journal https://academia.stackexchange.com/questions/117982/central-...
      - jacquesm 3y ago
        I'd read that as multiplication instead... This is what you get from using inconsistent symbols for important functions, I would not be surprised at all if people died over '.' vs ',' in a piece of medical gear or avionics. I'd use a completely new symbol before repurposing an old one. And in a way the '*' that computer languages tend to use for multiplication serves as a nice way to avoid mixups (as opposed to 'x').
Lio 3y ago
I didn't notice until you mentioned it. Now I just hear it in a caricature William Shatner voice.
globalise83 3y ago
If in doubt kick it out. You only live, once.
- deleted 3y ago
  [deleted]
nine_k 3y ago
But what if the comma is the attack? Imagine all the mental energy it has drained.
- dkjaudyeqooe 3y ago
  On HN? People don't come here to be productive (if it happens, it's by accident) so that energy was headed to the drain anyway. To the contrary I envisage many ESL readers will learn about comma usage today.
  - 2-718-281-828 3y ago
    good point but not on point. it will drain energy but lack the dopamine rush, hence leave the news hacker with an even stronger desire for cheap stimulation to be sought out.
thomasahle 3y ago
In Danish we separate adjectives with comma. I don't actually know the English rules.
- mmastrac 3y ago
  Ideally it would be "critical Danish infrastructure" with no comma, but the comma probably disambiguates the headline quite a bit making it clear that two adjectives apply to the noun "infrastructure". The frustration in native English speakers probably comes from the fast the comma-less version would probably be unambiguous and that comma causes our brains to skip a beat for what we subconsciously believe is an unnecessary purpose. If all English headlines were written to be clear rather than as easy as possible to read, the overall state of news would probably be better....
  - marky1991 3y ago
    I think it makes it more unclear, not less. I parse it as "attack against danish and critical infrastructure", matching the standard usage of commas in english. "Critical danish infrastructure" only has one possible interpretation in standard english imo.
    - InCityDreams 3y ago
      "Standard English" uses capital letters for proper nouns.
      - marky1991 3y ago
        Yes, and?
einpoklum 3y ago
Come on, you know that kind of pastry had it coming!

Rufus_Tuesday 3y ago

I bet Miles Davis would be annoyed by that comma also...

motohagiography 3y ago

The key facts appear to be that there was an IKE vulnerability in Zyxel firewalls that allowed for a single packet compromise. The attacker used this simulataneously across all targeted companies. The report says the infra under attack didn't appear in Shodan, so the attackers would have used some other scanning to develop the attack surface, and they attribute it to a state actor. While I was involved in a lot of critical infrastructure work over the years, there is so much mutually assured destruction on 'cyber' now that I don't see the economics of it anymore. Personally, I have doubts NATO can afford to act directly in a kinetic military capacity anymore and it has to operate through proxy parties because its members' infra is so exposed that no elected government survives a cyber retaliation against its energy and other infra services that derails its civil society. That said, I've held that belief for over a decade and haven't had it tested.

jjoonathan 3y ago
Angell famously published a book with a similar thesis in 1909, right before WWI. He was right about industrialized war being highly destructive and unprofitable, but he was wrong to think that this would stop the belligerents. [1] https://en.wikipedia.org/wiki/The_Great_Illusion https://en.wikipedia.org/wiki/The_Great_Illusion
- codedokode 3y ago
  Why is war unprofitable? The value of the land in a long run tends towards infinity, especially if it is populated with taxable people and factories.
  - jjoonathan 3y ago
    The money that you spent fighting could have been spent on other activities that also tend towards infinity. At higher rates. Without a huge initial setback. Of course, you only control your own choices not your competitors/opponents' choices, so game theory makes the outcome of "everyone chooses peace" nontrivial to achieve.

pnw 3y ago

Grammar aside, the TLDR is that most of the Danish energy infrastructure was protected by a particular Zyxel firewall, and they got hacked by a state actor a couple of weeks after a published vulnerability, and ten days after being warned explicitly to update their firewalls. Anyone else find it alarming that critical infrastructure is being protected by a fairly low end Taiwanese networking vendor and not a more well known firewall brand?

aaron695 3y ago
[dead]
MaKey 3y ago
> Anyone else find it alarming that critical infrastructure is being protected by a fairly low end Taiwanese networking vendor and not a more well known firewall brand? Like Cisco with their regular CVEs?
- doublerabbit 3y ago
  > Like Cisco with their regular CVEs? It's why I use QBasic for my firewalls.
- wepple 3y ago
  CVEs aren’t a significant datapoint… In this case, a single-packet pre-auth root code exec is about as bad as it gets. I don’t recall the last time a major vendor had a doozie like that. Bugs happen, but having them wildly exploitable isn’t inevitable.
- lijok 3y ago
  Yes, like Cisco Having regular CVEs signals only one thing - the product is popular
userbinator 3y ago
I find it more alarming that critical infrastructure isn't completely isolated from the Internet.

jalk 3y ago

I laughed a little when reading the info box “24x7” (stating that SektorCERT can’t respond to attacks outside of business hours). I.e. “We told you fucking so”

ChoHag 3y ago

So you found out about the vulnerability in the firewalls on your critical infrastructure, waited for a week before telling anyone and then sat on it for two more? Nice dramatisation though. Very intense.