5 ms·
Hacking Team Caught Taking Over Decoy Water Plant
- ChuckMcM 13y agoOk, that is an interesting result. I ran a honey pot BBS for a while (kremvax) which was fun to watch folks try to break into but this is more unsettling. Given the exploitable javascript also talked about at the conference it seems like if you were in a tor node you might still be able to do the equivalent of the DNS hack where private addresses are inverse spoofed. One of the things about radar guided missiles that interested me early on is that you pretty much have to have your radar on for them to work, and if you had a radar on you could find it and kill it (hence the variety of HAARM missiles). Similarly when people are trying to exploit our search engine it is hard to obfuscate since they have to include what they are trying to find in the search query in order for it to work. And now netwar requiring network traffic which has to return to the source to be useful.
- geoffmacdonald 13y agoThis is far more important than the NSA bullshit.
- LAMike 13y agoHow so?
- mjolk 13y agoBecause if the link's author is to be believed, China is sponsoring attacks on US infrastructure.
- lostlogin 13y ago2 wrongs don't make a right - but how many countries have had their infrastructure attacked by the US in the last few years? The US ways (that I know of) usually involved explosives however.
- btilly 13y agoIf Snowden is to be believed, the US is sponsoring attacks on Hong Kong infrastructure (and probably Chinese as well, though I only know of him releasing a list of IP addresses in Hong Kong).
- pionar 13y agothis is actually to lastlogin. Your answer is 2.
- at-fates-hands 13y agoimagine an attack on the power grid. Now think about a large portion of the US without electricity and it won't come back because these hackers have full control of the power grid. Be scared, be very scared.
- tantalor 13y agoPlease fix the title, should be: Chinese Hacking Team Caught Taking Over Decoy US Water Plant
- foobarqux 13y agoMaking the problem you raise more explicit: "Hacking Team" is an Italian security firm that has been in the news for other reasons.
- tantalor 13y agoThe community needs to know there are people explicitly targeting these systems Is there any evidence of this? It is possible they were looking for any vulnerable systems. I would not be surprised if they were explicitly targeting industrial systems, but that claim ought to be supported by facts.
- greenyoda 13y agoWhat I don't understand is why systems like power grids and water plants need to be connected to the public internet. Why couldn't the owners of these systems lease some fiber optic cables from the internet backbone operators (AT&T, Sprint, Level 3, etc.) and set up their own control networks that are totally isolated from the internet? From what I understand, there's lots of "dark fiber" capacity that's not currently being used, so it couldn't be that expensive to lease. Or, they could just contract with the existing backbone operators to run these private secure networks for them. And if that's too difficult or expensive, why not just set up secure VPN tunnels over existing internet connections to connect these sensitive sites? Anyone have any insight into why this isn't happening?
- WestCoastJustin 13y agoThese places are owned by many private companies, who might not understand the threats they face, or there is a culture where it is not a priority, plus there is no standard between these many companies, each has rolled their own solutions. Some might not be connected to the internet, but others are, there is a total mismatch between them. So, government has started to step in, by creating cybersecurity standards for infrastructure [1]. This will hopefully create a standard for everyone to start locking down their infrastructure in a consistent and reproducible way. This also plays into the moves to reduce data centers across the government [2], so they can create a standard, and hopefully reduce their security exposure. [1] http://www.bloomberg.com/news/2013-02-13/obama-orders-cybersecurity-standards-for-u-s-infrastructure.html http://www.bloomberg.com/news/2013-02-13/obama-orders-cybers... [2] http://articles.washingtonpost.com/2013-07-28/business/40859100_1_data-centers-federal-agencies-savings http://articles.washingtonpost.com/2013-07-28/business/40859...
- stretchwithme 13y agoAnd many are monopolies that have little incentive to prepare for black swans. They will just be bailed out or allowed to raise rates to clean up a catastrophe. Tokyo Electric Power Company in Japan was allowed to borrow billions after their colossal failure at Fukushima. A failure that could have been avoided with better planning. But with no competition, what incentive was there?
- cnvogel 13y agoPresumably these are the slides of the BlackHat 2013 talk mentioned in the article. http://www.slideshare.net/KyleWilhoit/bh-europe-2013wilhoit http://www.slideshare.net/KyleWilhoit/bh-europe-2013wilhoit The abstract of the talk is to be found on blackhat's server. https://www.blackhat.com/eu-13/briefings.html#Wilhoit https://www.blackhat.com/eu-13/briefings.html#Wilhoit Why can those online newspapers never cite/link to the original works? Or at least cite the correct title of the talk, so it's easily googable? It's a pithy.
- toyg 13y agoBecause it'd become too obvious that most online journos are glorified human clipboards, cutting & pasting from feed A to feed B.
- walshemj 13y agono you mean rewriting A to suit their owners agenda.
- teddyh 13y agoMore petty than pithy (or pity), I think.
- cnvogel 13y agoYou are right, of course. Still trying to improve my English ;-)
- stretchwithme 13y agoI don't understand why these systems need to be on the Internet. If engineers really need to be able to connect to them remotely, those seeking to connect shouldn't be establishing the connection, just requesting that one be established. Like the old modem connections where you just wait for a call at an already known phone number.
- chrisbennet 13y agoAt the end of the day, it is not in China's best interest to harm the US economy. J. P. Getty said "If you owe the bank $100 that's your problem. If you owe the bank $100 million, that's the bank's problem." We owe China a lot more than that.
- haldujai 13y agoGreat quote. However you're under the assumption that China will always act in the best interests of their people. You are right in that should China harm the US economy they would enter a massive recession, but who says the CPC care? Many civilizations (look at some of Africa and the Middle East for that last several hundred years) haven't particularly cared about their citizens beyond collecting tax. This helps to explain why North Korea and Iran do what they do despite the damage to their people.
- pkinsky 13y agoThe CPC cares about maintaining legitimacy and avoiding unrest. Their legitimacy rests on continued economic growth. China has had massive popular insurrections in living memory and continues to have local ones to this day.
- deleted 13y ago[deleted]