Hacker News Reader

Comment by gamblor956 | Hacker News Reader

When multiple major tech companies go down in short order, it's generally reasonable to assume a state actor is responsible.

There are only 3 countries with the resources to mount attacks of this magnitude...

View on HN

No I don't think that's reasonable at all. What time frame is "short order"? Pareidolia seems like a better explanation.

I only recently learned that term extended more broadly to pattern recognition, in addition to “seeing faces in stuff.”

What time frame is "short order"?

Three days.

Pareidolia

Given that Russia and China have been identified as behind multiple previous outages, it's reasonable to assume they are behind these as well.

I bet if you made a list of all the major tech companies, estimated the average time between failure, and did a little math then you'd find that, statistically, you should expect to see multiple failures within a few days of each other just by chance.

A lot more likely to be the NSA.

This is patently false and paranoid. Any one at most big tech companies can look into the internal report to see exactly which code change took down services by accident, and their remediation steps.

For example, the Google issue this week was an internal routing issue caused by some SRE modifying some config files on load balancers.

I agree its reasonable to speculate, given its a particularly vulnerable time in democracy with US election in 35 days and there's a lot to gain in disruption. Obviously MS/Apple/Google are all the juiciest targets for acquiring private communications, something that can (and possibly did) change the outcome of an election. I would expect this is an extremely active time in attack/defense in cybersecurity regardless of this incident.

IF this is the case, what do we think this could be? What's common among the different outages?

Google says 9/24's outage was traffic routing hardware. [1]

Microsoft says 9/28's outage was authentication error due to a bug in a service update, deployment tooling error, and a bug in rollback [2]

Apple's has affected many services including Apple ID but it isn't clear what root cause is.

[1] https://twitter.com/uhoelzle/status/1309313556328841216

[2] https://status.azure.com/en-us/status/history/

I promise you this is a self-inflicted wound.

Yeah, of the end-of-a-quarter kind.

IDK if its even that.

It's just as silly to promise something you can't possibly know as it is to assume this is a state sponsored attack

You think state-sponsored attacks are just as likely a source of outages as programmer error? Either you think the world is a much more perilous place than it is or you give programmers much more credit than they deserve.

I never said they were equally likely. I said it is just as silly to promise something you can't possibly promise as it is to suggest it is a state-sponsored attack. They easily could have said, "it is much more likely programmer error", and I would have 100% agreed.

> Either you think the world is a much more perilous place than it is or you give programmers much more credit than they deserve

It generally isn't a good idea to make this many assumptions like this about people you don't know. I think neither of those things.

> you can't possibly know

I promise you I can possibly know this.

Or a major network interchange pushed a shitty routing change.

Canada, Australia, South Korea? UK, Russia, German? France, Poland, Singapore? I can think of a lot of countries who have great technology resources.

Canada, Australia, SK, UK, Germany, France, Poland, and Singapore have middling-to-great tech resources, but not the resources to take down global access to the 3 biggest companies in the world.

Only 3 countries have the resources for that: the US, Russia, and China.

I'm super curious why you think that? A 17 year old from Florida tweeted as Elon Musk, Bill Gates or Barack Obama. Why couldn't the Canadian government do it?

Obtaining Admin access on Twitter probably can't take down Twitter. Although, an admin might be able to run heavy tasks that a normal user can't access to DOS the service. That hypothetical would be even easier for sysadmin's to track down though since I believe only a single admin account was compromised.

Not really. The Twitter hack was a community admin (account data, customer service rep), not a sysadmin (software config)

Twitter isn't anywhere in the same league as Apple/Google/Microsoft in terms of security.

It was an anecdote. If a 17 year old can socially engineer twitter, I don't think it's crazy to think that a room of comp sci PhDs in South Korea couldn't figure out how to mess with infrastructure, in fact I'm quite sure they could. There are not 3 countries in the world who could cause this type of outage, there are many.

Do we know a lot about Apple's internal reliability/security engineering? Google writes books about it and has things like Project Zero. Windows is used by governments everywhere and so Microsoft probably has some contacts in high places. I have never heard anything about Apple.

Anybody with access to a large enough botnet can take down services, it isn't rocket science.

True. But a botnet large enough to take down Microsoft, Apple, and Google without being detected would have to be extremely large or well-hidden, so if it is a botnet, then it's even stronger evidence of a state actor.

And yet many such botnets exist and are actively attacking all day long, yet aren't taking down the major professional services outside of tiny temporary corners.

Or, that when one goes down, people overuse the services of the others, causing them to go down, causing a chain reaction. Not denying the existence of state actors but they are not a given.

Sure, that would be a possibility for a different set of tech companies going down, such as if they all shared the same network backbone or overlapping users.

But they don't. We're talking about the largest companies in the world, with facilities geo-located around the world, all going down within a few days of each other.

Yet an attack that large was noticed by none of the major network providers or internet exchange points?

An attack on a large infrastructure is not necessarily a large attack. Social engineer into one account and disable some cron job somewhere and the infrastructure falls over.

Who are the others that are down?

How do you figure? Seems very optimistic to assume that these companies are incapable of this type of failure themselves.

Reply on news.ycombinator.com