Hacker News Reader

Comment by upofadown | Hacker News Reader

It's hard to make money out of attacking stuff like this because you can't normally keep the system broken in a way that is easily fixable when the money shows up. Once you contact your victim they just fix whatever is broken and then ignore you. Industrial processes are unreliable enough that one extra outage might not make that much difference.

It's kind of like making programs to run on Windows 95. You don't have to worry that much about making your program reliable because no one will notice a few extra crashes.

View on HN

Making money is not the only possible motivation for exploiting vulnerable industrial systems, though of course as the other reply says, there are ways to make money indirectly anyways.

First off, the damage to third parties might be extremely severe, especially in a targeted attack. Think of long-lasting power outages due to damaged equipment. Or think of environmental damage (e.g., suppose you got a nuclear power plant to vent radioactive gases, or worse, to have a meltdown).

Second, the damage to the owners of the industrial facility might be severe even if not to third parties. Here the attacker might benefit if, e.g., they are a competitor or have shorted the victim's stock.

The first case is of extreme interest to the public, don't you think?

Let's not dismiss concerns about industrial security.

Of course damage is bad but I was specifically addressing the apparent lack of interest from the criminal set.

For your first case, you failed to provide a possible. motivation. I will assume "terrorism" as that seems to be brought up as a motivation for most everything these days. There is more than one problem with this.

First, it is pretty much impossible to prove that an attack over the internet was actually carried out by any particular entity or even any entity at all. Things fail on their own. Second, it is usually easy to entirely prevent another attack. So no ongoing sense of vulnerability.

For your second example, it has always been fairly easy to damage industrial infrastructure but there have been almost no attacks of this kind. Stock market movements are not that severe in the case of even serious catastrophe much less the sort of trivial problems you could cause by attacking industrial controllers on the net.

you could make indirect money by doing things like investing in some markets/betting on them to fail.

"The market can stay irrational longer than you can stay solvent" is the traditional response to that.

Reply on news.ycombinator.com