Hacker News Reader

Comment by sillysaurusx | Hacker News Reader

I invite you to become a pentester for a year and see if you still reject this line of thought.

You misunderstand - I am saying they need neither the computers nor the networks.

By running with loose tolerances and loose guarantees (and keeping systems as simple as possible) they remove the need for these tools - and their attack surface.

pen testing often involves walking into a building looking like you should be there. If no one is around to let you in it also can involve half a minute of getting the door open with some primitive every day tools. No computers or software required.

You just switched the attacker model from "script kiddie somewhere in the world, changing stuff for the fun of it" to "physical presence with specific malicious intent". Those are not in the same ballpark, not even the same country.

You underestimate the stupid things local kids can get up to for fun if they thought they wouldn't get caught. So you can at least throw out the "specific malicious intent".

Ok, but how many stupid local kids are there and how many worldwide script kiddies?

Kids who are trespassing are not stupid. You have to take the risk, observe the behaviour of the security and then behave reasonably so that people would forgive you if you get caught.

The action is stupid, but trespassing idiots get caught quickly - that's just "survival of the fittest" mechanics.

If you never trespassed in your life then you were probably not smart enough to get away with it?

Security is a big word, we are talking about large facilities with like 1 or 2 people on site.

As a kid I've tresspassed plenty, it often takes 'security' hours to even spot you

I’m not particularly worried about a group of kids contaminating a single rural water supply, I’m more worried about coordinated effort by a malicious nation state to accumulate security cracks and then use them in a coordinated effort during a war time scenario.

I think it would be quite possible to have the control systems completely offline, while installing a reputable alarm system that is connected to the internet. If those two things have no network connection, then you could monitor the premises, but even a remote hacking of that system would not enable changing of chemical levels.

But you have this problem as well, even if you use networked systems. Now you need to mitigate both.

You must be a pentester, because the commenter above you wasn't talking about pentesting at all.

His comment says that small rural town water treatment plants don't have to run for 24/7. Not sure what you thought he was saying.

>You must be a pentester, because the commenter above you wasn't talking about pentesting at all.

This sounds like it should be a punchline to one of those funny programming jokes https://news.ycombinator.com/item?id=25850739

Reply on news.ycombinator.com