Too much focus always on the “hackers” and never the obvious security lapses solved by diverting executive pay to more bodies and training to cover them, but oh well right?
What reason would we have to blame the company for poor security hygene? what possible outcome could we hope for when in 2021 nearly every Solarwinds customer renewed their license after the hack.
Please.
> Once they received the payment, the hackers provided the operator with a decrypting tool to restore its disabled computer network. The tool was so slow that the company continued using its own backups to help restore the system, one of the people familiar with the company’s efforts said.
It's hard to get the full story from a single article, and larger publications like the Washington Post tend to focus on the most recent statements from federal agencies and corporations rather than details that you and I find more interesting. Sometimes I wish that newspapers would do more of a synopsis of news stories a month or so after the fact to give more context and "lessons learned" or "what impact has this had?". I would prefer that much more to the "breaking news" approach.
[0] https://www.bloomberg.com/news/articles/2021-05-13/colonial-...
I'd wager a guess that their current IT team was worked to the bone on profit-focused projects, but will be 100% blamed internally by the execs.
It's almost like this arrangement was by design...
No one cares about that type of work that’s why. It’s ridiculous but true.
The market is literally saying they are undervalued.
The flogging will continue until bug bounties improve.
It's eerily similar to "burn it all down" https://en.wikipedia.org/wiki/Accelerationism, which, itself is on the rise and burning from both ends.
I infer your point to be that more attacks might cause the victims to step up their defenses. It's a cat and mouse game. Always has been in all realms.
"It'll get worse before it gets better." I've been hearing that for decades. I'm starting to wonder, due to what appears to be a decline in civility. Following the rules only works if we all do. Those who eschew the rules have an obvious advantage.
Where has integrity gone? We are tearing ourselves apart and justifying it ... or coming to terms with it I suppose, by saying it'll be better some day.
Well... when... exactly? By what measure will we know?
I know Stephen Pinker, Hans Rosling, and various folks say it's the best time to be a human. Okay. Sure. I see the math. I'd like to see them update their charts for data out over the past year.
But ... anecdotally, none of that math seems to percolate down to my community. The people around me are in constant fear. I just saw a woman walking down the road, all by herself, I had clear vision for a mile and so no one else but her... and she was wearing a mask.
She was afraid. She was anxious. Regardless of the relative safety that exists today, or the belief that it'll be safer tomorrow because of the lack of said safety, the people around me aren't feeling it.
They're buying guns because red people are coming for them... or the blue people already are. Or the government will. There is literally no milk at the store because of an HDPE shortage prompting the grocer to put a Force Majeur notice on the dairy fridge door.
Trust has broken down. Fear of our own neighbors is up. Crime is up. Poverty is up. Suicide is up. Cyber crime is up. Inflation is up. The Gini coefficient is up.
I really have trouble believing that making it worse real fast, or even reporting more of it, is going to make it better.
I don't see it.
I expect after a few major crises involving mass casualties or major economic losses the federal government will mandate that private industry completely disconnect certain critical infrastructure control systems from the public Internet. Basically the same approach used by SIPRNet.
The global chip shortage for replacement parts if they are needed seems like a strategic coincidence. Definitely an evolving story.
To shutdown a pipeline, it's not a management console issue, hence why I'd speculate it's in the ICS devices themselves, which probably use uClinux toolchains on SoCs from one or two large vendors. I did some smart meter and ICS security work in the 00's, and there were a few vendors who would be strategic targets. The attack tools available now are unbelievably better, while the attack surface is pretty much the same due to the long lifecycles of ICS components, and considering today we've got cheap SDRs and gnuradio blocks for most wireless protocols, AVR tools, buspirate and the good/greatfet, ghidra/ida, and python for reverse engineering, the vulnerability research on this stuff moves way faster than the industry ability to respond.
If this is a serious attack, the only way to respond will be if they are very lucky, it's a worm and they can stand up a honeynet with spare gear to catch a sample and any good infosec firm can pull it apart. But if it's an active APT group, there's probably a political solution, as given what's possible, this would seem to be just a shot over the bow.
I bet there is a layer of windows XP machines involved in a legacy control system. XP machines that weren't supposed to connect to the internet somehow have malware on them. It doesn't even have to do anything. Simply the detection of anything in such circumstances is enough to warrant them being shut down.
I've said it a thousand times, all the security in the world will not defend a SCADA system if someone left TeamViewer running somewhere.
Don't mean to pick on TeamViewer. It could be any number of packages, but I think security minded people get an idea of the type of attack vectors I'm talking about.
A shutdown is a huge deal and means they’re taking this extremely seriously.
It may not have been a targeted attack.
Tangent - Also interesting, the WaPo article [0] bears little resemblance to itself from only hours ago [1]. The article has grown by about 50%, while contents have come and gone. That's my favorite application for archive dot is - Seeing the timelapse of iterative releases, watching journalism bend and sway in the current of its own response. I'm not making any judgements, the internet is already sloshing with useless hot takes about journalism and media. It's just fascinating to see the modern editorial process at work, out in the open.
[0] https://www.washingtonpost.com/business/2021/05/08/cyber-att...
It's certainly a security incident but until we know more it's hard to say the infrastructure was specifically targetted for an 'attack'
The greatest movie of all time, btw.
Based on a true story, though it's debated endlessly. Clifford Stoll's Cuckoo's egg deals with the same material.
- The Godfather
- Chariots of Fire
- Dr. Strangelove
- Das Boot (original German version)
- About Time
- Who Framed Roger Rabbit?
- Tron
Knowing what is happening now with critical infrastructure, through the internet, can be done in a completely safe manner. It is a solved problem.
Monitoring systems are usually separate and often have their dedicated network too, but they still need some sort of network connection to your critical infrastructure to do their job (monitoring).
Is it not possible to develop protocol or device that operates outside of the web but functions like the'two-man' rule used to launch nuclear bombs?
The appropriate analogy is more like a nuclear reactor. They require some system controls to stay functional and healthy (water temp increases in loop x, increase motor speed of pump y, if already at or exceeding speed z, set off an alarm).
These controls need constant monitoring in a control station somewhere, sometimes tuning or fixing if there is a bug or issue somewhere, etc.
A lot of the cost of a nuclear plant is trying to cover every possible scenario and being compliant with endless regulations for stuff like this (and everything else).
That most non-nuclear plants don’t want to deal with the hassle and expense shouldn’t surprise anyone. That non-nuclear plants often don’t even TRY to cover basic cases SHOULD dismay and surprise people. These issues have been well known and publicized for literally 30 years.
A reason safety guys in these industries have the saying ‘regulations are written in blood’ is often not because no one sees the danger. Rather, until the body count reaches a certain point, no one can justify the expense to require it be fixed.
Yes. It's called Threshold Cryptography and it generalizes 'two-man' rule to require that N of M authorized users agree to an action.
But it's not really necessary here. What's needed for infrastructure is to get it off the internet and to quit using insecure operating systems and languages.
According to some sources, it's been done before:
>CIA plot led to huge blast in Siberian gas pipeline
>Thomas Reed, a former US Air Force secretary who was in Ronald Reagan's National Security Council, discloses what he called just one example of the CIA's "cold-eyed economic warfare" against Moscow in a memoir to be published next month.
>Leaked extracts in yesterday's Washington Post describe how the operation caused "the most monumental non-nuclear explosion and fire ever seen from space" in the summer of 1982.
>Mr Reed writes that the software "was programmed to reset pump speeds and valve settings to produce pressures far beyond those acceptable to pipeline joints and welds".
https://www.telegraph.co.uk/news/worldnews/northamerica/usa/...
Would be nice to have separate data lines, running fiber optics sealed in pressurized conduits for double tamper detection. The military actually does this for their critical infra.
At least German Telekom has been doing this for ages for the trunk cables serving entire areas with analog phone service - although not for tamper detection as an anti-spionage measure, but rather to detect and pinpoint damage to the cables, e.g. from excavators, tree growth or splice seals degrading.
https://www.wired.com/story/how-30-lines-of-code-blew-up-27-...
That lab tends to specialize in cybersecurity and infrastructure.
https://www.wired.com/2011/10/idaho-national-laboratory/
The critical infrastructure part of the lab:
You mean like a pandemic? ;)
Of course, Macros works in macOS too if the user has installed Microsoft Office
1) blame the lack of computer security in our infrastructure, and work on improving that
2) blame cybercurrencies, and try to eliminate them
Any bets on which one our government will choose?
The state of computer security is unacceptable and needs to be fixed. Today its profit-motivated extortionists, but anything they can do is also an option for spy agencies, and is it really that hard to imagine anti-oil activists pulling the same stunt some day?
On the other hand, crypto is the thing behind the profit motive. If crypto is impractical (if there were no way to convert it to real currency), the profit incentives for these attacks (and mining, for that matter) break down.
I realize this isn't a popular opinion around here, but we should probably do both.
Get out of here with this.
I’m not saying I support government action here but we should be honest about the situation.
The U.S. government has been addressing computer security in infrastructure for a long time.
One argument you can make is to partly defund the surveillance-based departments and agencies and put together a cybersecurity agency who is tasked with hardening the country's systems. I have no idea how someone would build a legislative and personnel firewall to protect it from the existing need to peep through keyholes, it's probably not possible.
3) blame Russia/China
Environmentalists used to chain themselves to trees. Would the same physical actions work for climate change?
Its difficult to see the public being opposed to this when coal infrastructure is on the edge of irrelevancy anyway and easily replaced.
https://www.msn.com/en-us/news/us/eight-months-later-colonia...
To me the only reasonable survival strategy is redundancy, but I have no idea how we can reach there.
[1] https://www.amazon.com/This-They-Tell-World-Ends/dp/16355760...
You are proposing that we attack them with explosives, are you fine with them retaliating in kind?
What if you lived next to some hackers targeting a foreign country, would you think it's acceptable to get blown up for their actions?
At least not with the 100% confidence that politicians would want before the US military starts dropping JDAMs on buildings.
I would give fairly even odds that something like this is the work of an organization nation state, and also even odds that it's the work of some underemployed teenagers in a basement.
The entire war machine will grind to a halt without oil. It would be one of the first thing to attack.
https://en.wikipedia.org/wiki/Category:2020s_conflicts
Remember when Russia invaded and seized part of Ukraine a few years ago? https://en.wikipedia.org/wiki/Annexation_of_Crimea_by_the_Ru...
Edit: it's also not the point of my post. The US invests in its military partially under the pretense of existential threats (basically, commies invading the mainland). That is undermined by having an laughably easy to cripple defense.
Some critical infra is air gapped though. Other systems implement SIS systems in parallel with general process systems to mitigate catastrophic failure further.
About that infrastructure security... this forum has gone over in detail the situation of infrastructure security in quite a bit of detail as other stuff has happened.
It's easy to say "you need to isolate your critical network from your office network" but that costs dollars and time and letting things fall to shit is free 'till the time comes and then other people the price rather than you.
The privately held, Georgia-based company is owned by CDPQ Colonial Partners L.P., IFM (US) Colonial Pipeline 2 LLC, KKR-Keats Pipeline Investors L.P., Koch Capital Investments Company LLC and Shell Midstream Operating LLC.
All the best names of neoliberalism!
If you don't realize what you are getting into, you may regret it because you will get a K-1 at tax time.
I don't know if it's any more of a tax dodge than an REIT.
https://www.nytimes.com/2021/05/08/us/cyberattack-colonial-p...
It would prevent inadvertent connections between the Internet and the critical infrastructure network.
