5 ms·
Slovakia finds Russian backdoor in traffic speed cameras
- irishcoffee 1mo agoNext up, chinese solar inverter firmware.
- victorbjorklund 1mo agoTo do what? Turn off the power in random individual houses?
- emdash 1mo agoSome of those are networked I think?
- tomas789 1mo agoMost of them are. Including the biggest ones.
- 2OEH8eoCRo0 1mo agoThe HN version of "I have nothing to hide."
- giancarlostoro 1mo agoThe nothing to hide thing isnt even an HN only thing unfortunately.
- newsclues 1mo agoTrack usage patterns to know when people are at home and then rob them.
- bdhdhduuyd 1mo agoTo set roofs on fire? In the end it's all about trust. Right now I don't see why China would like to burn down their market.
- cyanydeez 1mo agoguys, do we need to reinvent the same Hanlon razor but for capitalism: Dont attribute to malice that which can easily be explained by capitalism?
- probably_wrong 1mo agoIf we're reinventing sayings, I suggest Clarke's third law first: Any sufficiently advanced capitalism is indistinguishable from malice.
- wongarsu 1mo agoI'd be worried about the inverters in large commercial solar plants. On a sunny day you could easily cause a blackout by turning enough solar capacity off at once. Maybe shut down the entire grid when the sudden power imbalances trip the self- protection in half the grid. That's a pain to recover from. Spain went through that not too long ago But maybe rapidly switching residential solar on and off in a coordinated way can also do funny things to grid equipment
- randoot 1mo agoDDoS, anonymizer proxy, and turn off power in large commercial installations. They kinda deserve it for investing in solar. US holds all the power in social media, can't blame China if they want to utilize their lead in solar for something too. Hopefully mutually assured annoyance keeps everyone at bay.
- rollulus 1mo agoAny idea what happens to the grid when a significant chunk of solar power suddenly disconnects?
- hsuduebc2 1mo agoThere are always some “stable” power sources kept on standby that can be activated within minutes, for example gas turbines. In European electricity markets, generators can actually be paid simply for keeping this reserve capacity available, even if they are not producing much electricity most of the time. The problem is that a few minutes is still too slow when a large power source suddenly drops out. The grid needs an immediate response, which can come from fast reserves such as batteries, hydro, pumped storage and other generators that can react automatically. Pumped storage is basically gravitational energy storage: you pump water uphill when electricity is plentiful, then release it through turbines when power is needed. I quite fancy electrical grid.
- victorbjorklund 1mo agoNot much if a couple of thousand homes in US switches off. There are way more sensitive targets than ”they could randomly hike the electricity usage with 0,0000000000000000001%”
- nom 1mo agonah, the ones connected to the grid... you turn them all off during peak sun hours at the exact same time same issue with large loads like boilers, this stuff should never be connected to the internet, but it is if you can control enough load on the grid you can do real damage
- vkou 1mo agoTo piss away decades of hard-earned trust in its products for some short-term one-time political 'pwn' of the enemy. If that goal sounds stupid to you, that's because it is. I would expect some countries that are not China to act with such a capricious lack of foresight.
- irishcoffee 1mo agoThe US pulled a 1-time trigger on Japan… twice. Looks like it worked out. You should be careful tossing around words like stupid.
- vkou 1mo agoWorked out how? They've made no meaningful concessions, and are quietly dumping treasuries. US bond yields are skyrocketing, making it more and more expensive for the US to borrow... Under a president that's pissing away taxpayer money like a drunken sailor. This isn't some 3D chess move, it's exactly what it looks like.
- jwr 1mo agoI think synchronized operations could really disrupt the grid — think thousands of inverters switching backfeeding to the grid on/off, causing waves and disruption. Or thousands of inverters having their grid sync disabled, simultaneously operating to shift the frequency of the grid (very bad).
- Spooky23 1mo agoIf you had enough systems under control in an area, you could probably create a brown out or some other type of scenario by turning off 1000 houses on the right day.
- subscribed 1mo agoWhat do you think will happen if ALL the inverters in a city during a sunny day will suddenly switch off, then on, then off, then on, then off.... Also, you're sure its only home energy generation that's affected?
- szundi 1mo ago[dead]
- hansoolo 1mo agoDo they even need that since, when most of the converters are attached to the Chinese cloud?
- irishcoffee 1mo agoI made the logical leap that the firmware enables this. I don’t have the code in front of me, so that may have been an incorrect leap.
- bdhdhduuyd 1mo agoSo they bought the cameras and some people pointed out they look exactly the same as Russian cameras. The government denied this but after they figured out the serial numbers matched the Russian cameras they started this investigation. Good they investigated this before using them, but this sounds like a big fu...
- NuclearPM 1mo agoA big what?
- GauntletWizard 1mo agoA big fuck-up, but some people prefer (nobly even if I don't abide by the same rule) to keep some words out of their mouths.
- amelius 1mo agospelled like that the "u" could mean "you".
- GauntletWizard 1mo agoYou've got a point, a fuck-up and a fuck-you are somewhat different in this context, though I was assuming both had malice in my original interpretation.
- bdhdhduuyd 1mo agofuck up
- yieldcrv 1mo ago[flagged]
- spwa4 1mo agoThey also like to bomb people, so probably best to not let them locate individuals (or anything else) easily by using Russian traffic cams ...
- gumby 1mo ago[flagged]
- greenavocado 1mo agoYou must be new to state sponsored malware. Recent false flags are a thing: 2018 Olympic Destroyer, Marble Framework, Silver Fox, MuddyWater Chaos
- sofixa 1mo ago> Recent false flags are a thing: 2018 Olympic Destroyer, Marble Framework, Silver Fox, MuddyWater Chaos How are any of those false flag? They're state sponsored, by different state actors.
- pbrum 1mo agoSilver Fox is a very vaguely defined Chinese cybercrime group of malware and actors...or are you referring to something else?
- vrganj 1mo agoOne could say that Fico himself is a Russian backdoor...
- tonyhart7 1mo ago[flagged]
- reaperducer 1mo agoacting like western nation didn't spy to each other Is he? I don't see that in his comment at all. Can you point out that part to us? Perhaps your handlers never taught you that two things can be bad at the same time.
- tonyhart7 1mo ago[flagged]
- tomas789 1mo agoImagine somebody being able to track almost anyone using road side cameras. Good thing such things happen only in eastern Europe wink wink
- lifestyleguru 1mo agoFor the goal of recording a cat scratching their car or catching an imaginary thief neighbour (a magpie or fox stole that thing that one time, you dullard) people will plug into Chinese, Russian, and American video surveillance networks in no time and pay for it.
- somenameforme 1mo agoMost cameras are insecure by default. Check out: http://www.insecam.org/en/ http://www.insecam.org/en/ or https://www.shodan.io/ https://www.shodan.io/ The first isn't even using default access creds, which I suspect is what was 'discovered' in this case, but cameras that immediately hook up to the internet with 0 restrictions to access.
- LogTrim 1mo agoThe detail that gets me is the Ministry saying the cameras were safe because they'd be on a closed network, while the backdoor can apparently be triggered via SMS from hardcoded phone numbers. That's a pretty good demonstration of why "it's not exposed to the internet" isn't a security boundary if the device itself has an out-of-band communications path. Add Secure Boot being disabled and unauthenticated live streams and this seems less like one unfortunate backdoor and more like nobody established what the trust boundary was supposed to be in the first place.
- deleted 1mo ago[deleted]
- PinkSheep 1mo ago"Not exposed to the internet" means exfiltration is hard in this case. If I were to dream about defense in depth, these SIM cards should be monitored for traffic anyway or have filtering rules at carrier level. Because at the end of the day, Russian numbers or not, mobile networks are insecure.
- lifestyleguru 1mo agoSlovakian prime minister is doing proud photos with Putin despite the ongoing war so the backdoor looks like a desired feature not a bug or fuck up.
- tokai 1mo agoIt seems like a silly mess. But its easier than it sounds to end up in such a situation. We're are a lot of HN Kagi users that just have to trust that the Yandex collaboration is fully watertight.
- yodon 1mo agoZero chance of vulns in flock, so we're good in the US /s
- sssilver 1mo ago[flagged]
- flohofwoe 1mo agoThe article is neither about Germany nor about the US.
- sssilver 1mo agoIt's about allies spying on each other, a common practice since the dawn of civilization.
- fwn 1mo agoImagine a headline reading, "People are starving in [city]." Someone might reply to that news by pointing out that starvation is as old as humankind. ...older even. Would that remark be on topic? Would it be noise?
- juliusceasar 1mo agoRussia to Slovakia is Israel to USA. Puppet state.
- toasty228 1mo agoMost people talking about Slovakia wouldn't even be able to put it on a map or know what currency they use, but they become instant geo political expert. They don't even know how to pronounce Fico properly... Give me a break lmao
- juliusceasar 1mo agoThat is your argument? Omg, the level of it...
- Animats 1mo ago> the cameras expose live streams to anyone without a password and who knows their broadcasting IP. Are these cameras in use in Russia? Can people outside of Russia look in at Russian traffic in this way?
- codedokode 1mo agoThere is a small number of cameras which broadcast the video publicly. For example, Moscow: [1] (Taganskaya square), [2] and Saint-Petersburg: [3] (Nevsky prospect and Gostiniy Dvor). Sadly the quality is not great and in reality those places look much better. For example, many of the small 2-floor buildings on Taganskaya square are over 100 years and have a nie classical architecture but one cannot see any fine details in the camera view. [1] https://gidcam.ru/camera/moskva-panorama-centra-stolicy-s-marksistskoj-ulicy https://gidcam.ru/camera/moskva-panorama-centra-stolicy-s-ma... [2] https://gidcam.ru/camera/moskva-volgogradskij-prospekt-i-ploshad-slavy https://gidcam.ru/camera/moskva-volgogradskij-prospekt-i-plo... [3] https://camguide.net/ru/europe/russia/saint-petersburg/nevsky-avenue/ https://camguide.net/ru/europe/russia/saint-petersburg/nevsk...
- ojciecczas 1mo ago[flagged]
- tomhow 1mo agoPlease don't fulminate on HN. The guidelines make it clear we're trying for something better here. You may not owe nation states better, but you owe this community better if you want to participate here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- deleted 1mo ago[deleted]
- koonsolo 1mo agoIt wouldn't surprise me if the Russian misinformation inside Slovakia is able to spin this into an anti-EU, anti-Ukraine story.
- thisisnotauser 1mo agoThe comments here seem to presuppose that somehow Slovakia is the only ones who would need to worry about this, and not, say, any town with Flock in it
- pvaldes 1mo agoWhat's the purpose of this? Opening a way to make the cameras going rogue and starting to fine everybody in a particular period of time to create massive discontent, administration chaos, and unrest? maybe just before an election? Aren't this cameras connected with some government computers?
- tpm 1mo agoPerhaps. What actually happened is that we have a demented interior minister in a unbelievably corrupt but also pro-russian government. So it's really anybodys guess if it's just pure corruption (the interior ministry wanting to buy some traffic cameras and someone bribing to get the contract while buying the cheapest they could find which were these russian ones) or indeed some covert russian operation (the responsible minister wouldn't know about it, he's too dumb for that, but there might be other government people who did know). In any case in a functioning state this would end up with the minister leaving his post at least. Not in Slovakia.
- sorokod 1mo ago"Кордон.Про" product page on the simicon site https://simicon.ru/rus/product/gun/cordon_pro.html https://simicon.ru/rus/product/gun/cordon_pro.html
- shevy-java 1mo agoThe problem I see is that Putin fully committed to the war. It is not only clear that he has no interest in ending the war, despite the lip service, but will continue to create problems and cause issues. This backdoor here is not an isolated problem - it is a systemic, concerted problem. All retaliatory moves are handicapped by orange Agent Krasnov being an asset for Russia. The EU needs to stop outsourcing its security. That includes having a nuclear arsenal available for all member states.
- deleted 1mo ago[deleted]
- hno5b8kgpg 1mo ago[dead]
- PinkSheep 1mo agoOver 100 comments, zero mentions that government funds should be spent on devices with auditable open-source firmware. Anyone here? No? Then I'm the first one to say this. SecureBoot is a funny one. It should be signed with the deployer's keys (Slovak), not the manufacturer's. Trusted boot probably wasn't a consideration here, really. Ironically, a custom firmware can now be used thanks to the lack of a digital lock... if you still trust the hardware. PS: Props to NBU for doing their job.
- srdjanr 1mo agoWould you be able to get those devices at all, especially at similar price as those with closed source firmware? R
- PinkSheep 27d ago"at all" -> I would like to believe a government tender to wield more power than just being at the mercy of commercial market offerings. "similar price to closed source" -> Good argument. But what if the _lower price_ is only lower thanks to a vendor lock-in? Thus, over a long period of time, you don't get a better deal? Furthermore, here an expensive reverse-engineering project had to discover the backdoors? What was its cost? Why can't the government have this work done (new cameras) on a contract basis? First step: "we want this and that, you may choose the hardware freely, but the project source code will be perpetually licensed to the government to use and extend upon." Second step: "we have this source code from the last contract, we want another 1000 of these traffic cameras with improved specs/features." The belief, that the market will do anything right, perpetuates this system of outsourcing everything to the market. Though I don't think it can work any other way, because nobody among the government workers wants to bear responsibility and liability. It's much easier to give party B the money and then argue with them based on the paper trails. This is what they've been trained to do after all.
- like_any_other 1mo agoMaybe you trust the hardware and software and firmware to not be malicious or negligent (currently such assurances are extremely rare [1], so it's hard to overstate what a step up in security just this bare minimum would be), but what if it simply gets hacked by a nation-state level opponent? And there are so many ways to hack it - hardware and software supply chains, interdiction and replacement with compromised parts, attacking the software systems connected to it (maybe the camera is secure, but what about the computers it sends its signals to?), or the human systems, blackmailing an employee to insert a backdoored USB key somewhere... Are traffic cameras worth the risk of giving away the movement of your key personnel, military and political, in the age of drone warfare and targeted strikes? [1] https://news.ycombinator.com/item?id=49248678 https://news.ycombinator.com/item?id=49248678
- physhster 1mo agoIt's almost as if electing a pro-Russia politician has consequences...
- zuzululu 1mo agoI think i read Japan does this to CCTVs sold in China Public Security Intelligence Agency (公安調査庁) apparently is sitting on a massive amount of data from China which imported their tech
- Lockal 1mo agoWait until they find that "Russian backdoor" sits inside their government and issues orders to purchase such cameras.