Hacker News Reader

Every one of these potential attacks would require a lot of things to go very right. It's easy to do X or Y under experimental conditions. The real world is far more chaotic and the odds of success are lower.

Further, none of these things would cause an enemy to capitulate. If an enemy shut off power or caused car crashes in several major cities at once, the US isn't going to just surrender or even think about it. They're going to strike back with the widest array of options for employing force that earth has ever seen. Every option you listed would be pin pricking a giant.

Cyber warfare is super cheap, but it's also orders of magnitude less effective than sustained aerial bombardment or a complete naval blockade. Another tool in the tool chest, but not something I would base my national defense on

The difference is that the US homeland isn't used to feeling repercussions for it's foreign policy and aggression abroad. The US populace most certainly isn't hardy enough to suffer through extended power, water and connectivity outages because of diplomatic failures. It's not about forcing a surrender, but more about making hostilities and aggression unpalatable to the citizenry.

It's historically rare for homeland "hardship" to be a fast path to victory. More likely it would induce a total war mentality and calls for reprisal attacks.

The British aisles hadn't seen war since the 1700s prior to WW1. Neither German strategic bombing in WW1 nor the much larger blitz in WW2 brought about surrender or capitulation.

Yes, this attacks are just the result of sanctions against those countries, we, over here in the US shouldn't be policing the world, if those countries want freedom they should rise up on their own, is hard, but have had happened in the past.

Hirohito and Hitler had similar thoughts about the US population. History tends to repeat itself

It rhymes. They taught Bin Laden how to provoke disproportionate retaliation to his own ends.

Nothing done by Hirohito or Hitler to the mainland US population compares to a sustained loss of power, fuel or communications.

Neither Hirohito nor Hitler managed to strike the US mainland.

Generally true but there were a few small attacks on the mainland. While they didn't produce much damage they did provoke significant responses, particularly the attack on Ellwood which was used to justify the internment of Japanese Americans.

https://en.wikipedia.org/wiki/Bombardment_of_Ellwood https://en.wikipedia.org/wiki/Fu-Go_balloon_bomb https://en.wikipedia.org/wiki/Attack_on_Orleans

Amazing how good the US was at covering up the fire bombs sent to the Pacific Northwest, the shelling of the west coast, etc.

Not that they were huge casualty incidents, just amazing that most people believe the myth even today.

https://en.m.wikipedia.org/wiki/American_Theater_(World_War_...

Well, I know about the few incidents. It's just that it wasn't really a strike, it was much moreso for show.

I mean, if Iran or North Korea directly and intentionally caused even a small forest fire today, no one would say its 'just for show,' but yeah I agree with you.

Like, in principle you're right. In practice, cyber attacks at the level of terror that is equivilent to a "full scale nuclear first strike" simply have not happened (yet).

I do believe that you might be making a bit of hyperbole with the scale of possible terror potentially possible for such small amounts of money. Some crazy mofo should have done this by now. You're telling me that ted kaczynski types don't exist for hacking?

No, the reasoning that it is easy enough for some crazy person to do so, but none have done so yet, therefore it is unlikely to be possible is deeply flawed. On 2001/09/11 hijackers flew Boeing 767s into buildings for the first time in history and killed thousands. Yet, Boeing 767s had been flying for 19 years by that point and there were planes equally good for such a task for 40-50 years. On 2016/07/14 in Nice a person drove a truck into a promenade killing 86 people. Yet, cargo trucks had been in operation for 100? years by that point. These ideas are obvious, easily achievable, available for decades, and require no particularly advanced knowledge or skills to plan, yet took literal decades to occur after the point at which they became feasible.

The capability to engage in a large scale cyber-physical attack is maybe 10-15 years old. Not even a generation has passed since it became technologically feasible. To put that into perspective, Ted Kaczynski started his attacks when he was 36. If at the very moment that it became possible an 18 year old "crazy mofo" also figured that out they would still not be as old as Ted Kaczynski was when he started.

At these prices, cyber attacks are much cheaper than cruise missiles but too expensive for most criminals/terrorists without an explicit objective.

You'd expect state actors to use these attacks to achieve a particular goal, where the cyber attack option is weighed against the cruise missile option. Permanently destroying a power grid doesn't make a ton of sense for any reasonable objective other than total war.

Read up on NotPetya.

https://en.m.wikipedia.org/wiki/Petya_(malware)

I'm not sure where you are pulling these numbers from but my napkin math would go way differently. 1st question is how much does a security professional cost who is willing to do illegal stuff and knows how to do it properly. I'd say the number is around 300-500k$ a year. How many of these do you need? How do you find them? You need to pay quite a lot to someone with knowledge about how to find these people. How do you know your professionals will manage to find anything? You could waste millions this way and still come up with noting. In reality you are not the one who would be organizing this. You need to find someone who usually does this and pay him 3-10x the cost he has for running this. And you need to pay the guy who helped you find this guy. So I guess you end up at around 10-50mil$ to fund an operation like this with questionable outcome, together with the risk of exposing yourself or ending up in some undercover police plot and end up in jail. And whats the worst you can realistically do? Get private info about people which gets leaked all the time or turn smart lights on and off for many people at the same time?

Yes but think about a nation-state. They aren't looking to hire black-hat hackers and dodge the police, they're creating a military division that recruits and trains the hackers, and they are their own police. They'll be able to manage their talent flow to ensure they can execute operations properly.

With regards to potential impact, I'm afraid it's a little more serious than smart lights changing colour. One could disable power-plants, steal money, vandalize factories. I saw a DefCon talk where the guy stumbled onto a totally open control panel for a waste-water treatment plant.

With a little creativity and co-ordination, this can be a very effective form of war. See also the Israeli's (or someone) disrupting Iran's nuclear ambitions.

For US citizen it may be 300-500k, but for people from some other country 50k could be enough.

That's some seriously scary (and concerning) stuff. As a non technical person, what are some things I can do to protect my company against complex cyber adversaries?

Also, considering the destructive potential of those cyber weapons, are there any international laws surrounding the usage of them against civilian targets?

Defence in depth. It's not a buzzword anymore, but the principals hold up.

Basically, each component in your threat model should have no less than two controls to protect it. Assume that 'active' systems (antivirus etc) can and will fail. Passive measures are predictable and cost effective, but have limitations - a mixture of both is ideal.

Think of it like a well fortified house. You don't just stick a robotic machine gun on the roof and command it to shoot people it doesn't recognize - everybody knows from intuition that's a bad idea. Instead, you layer up your defences. Passive measures are a great start: a steel door, bars in the windows, bollards to keep vehicles away, etc. Then you layer active measures: lights and cameras, sensors in windows and doors, keycard access to different areas, etc. Anything more than that you need to develop your threat model; are you defending against bears or against a helicopter gunship? A moat won't protect you from a chopper, and radar guided anti-aircraft missiles won't be very effective against bears.

>As a non technical person, what are some things I can do to protect my company against complex cyber adversaries?

That usually comes down to - who are your adversaries? Parent implies that given enough money, high value targets can be compromised for less money than conventional military arsenal.

For an average individual, small company dealing with non-sensitive data - preventing non-targeted attacks is likely high priority e.g. Preventing your applications, data from getting compromised because its vulnerability was detected in the random scan of the attacker (or) your staff plugged in a flash drive with ransomware.

Some simple non-exhaustive preventive measures are - Operational Security(Training staffs to not click unwanted links, social engineering attacks(not to reveal too much about their work online, Better identity management etc.) Application Security(Ensuring security focused application development, keeping up-to date with the patches for libraries etc.), Collecting less customer data as possible(Ensuring customer privacy).

>what are some things I can do to protect my company against complex cyber adversaries?

Employ on site Red and Blue teams or pay externals for regular penetration tests and security audits that feed back results to your site/infra/dev-ops teams.

None of this is new but most businesses ignore them since it's seen as an expensive snake oil and most importantly, "it's never gonna happen to me".

> it's never gonna happen to me

Or they see that multiple Fortune 500 companies were affected by breaches and all of them are doing fine. So attitude can be - "it's inevitable, but we'll be OK anyway"

Don't connect anything critical to any network, directly or indirectly, except a dedicated one separate from the Internet if unavoidable.

Never browse the web, read e-mail or otherwise run any Internet client from any machine with data on it and instead use a separate machine or if unavoidable a VM on top of a reasonably secure hypervisor to run the browser.

Secure every single systems assuming that the network is compromised.

Restrict access data to only those who need it.

Avoid software written in C/C++ for anything security critical at all costs unless there is no alternative.

Only hire competent programmers and sysadmins.

Invest in proper physical security.

About the only commercially available solution that provides defense against attackers with more than $1-10M is a system that is inaccessible to a remote attacker. As a company this means complete physical disconnection of the systems you want to use in addition to a complete removal of all possible connectors except for a very limited set of explicitly enumerated entry points that you add back onto a system that is completely physically disconnected.

To evaluate the quality of your security, you should hire a red team, a team that emulates an attacker, to attempt to breach your security. If they are able to breach your systems then the key takeaway is that your security process is systemically incapable of defending against attackers with that level of budget and resources which is supported by the empirical evidence that a team with that level of budget and resources did, in fact, breach your systems. This is in contrast to the standard takeaway which is to just fix the specific defects discovered since obviously the only defects that exist are specifically in the areas that were probed. To actually remediate the problem you need a systemic overhaul otherwise you will just keep getting the same quality of output that is equally defective.

Unfortunately, the prevailing state of cybersecurity has no functional solutions to these problems once you get to attackers with a few million dollars outside of the heavy-handed and highly inconvenient solution of disconnection. For systems with safety standards, that is a cost that should be paid. For any other system, you need to evaluate if disconnection is worth it in the context that there is a 100% chance that anybody with a few million dollars can successfully completely compromise your systems. If you only consider direct harms such as monetary damages, disruption of business, stock price changes, it is highly unlikely to be worth it compared to getting insurance at this time as most attacks that do direct harm are still being done by financially unsophisticated attackers who are still underutilizing their blackmail potential by at least 10-100x, so it is almost always financially prudent to just eat the cost. As for indirect effects, it is up to you to consider if IP loss, reputation loss, leakage of confidential information, etc. at the cost of a few million dollars is worse than the negative effects of disconnecting.

What’s your budget & what are you protecting?

Without that info, I think one of the only universal recommendations (whether you’re a trillion dollar FAANG or 2 person startup) is buy U2F keys for everyone* and enable them everywhere. Also try to know what assets you have, and patch everything regularly.

* yubico make great U2F keys which I recommend. Others such as google also make keys

> For ~$1M you could target the current model year of any brand of car in the world and develop a remote attack to simultaneously target every car of that model year at rush-hour and engage the cruise control at maximum speed, engage the anti-lock braking to disable the brakes, and, if applicable, engage the autosteer to turn slightly into oncoming traffic as these researchers [1] demonstrated could be done 5 years ago on a budget of only $80k.

If it were that easy, why hasn't a hack happened with a massive loss of life yet? Most big breaches involve credit card numbers or other personal info.

Fortunately, countries with "nuclear first strike" do not perform them liberally, due to the threat of mutual destruction.

Hopefully, the same thing also applies to cyberspace.

I don't think there is much to "cyber-destroy" in retaliation even with a country like China.

On other hand, you have much more countries constantly exerting overt aggression despite retaliation by Western countries being quite possible... but never coming for all reasons from co-opted politicians, and insiders, to power of their public image, to plain cowardice.

Note that all of these attacks are easily defendable and closable, unlike closing a border for attacking tanks. The only reason the attack vectors exist is the legacy of Microsoft Windows and not having competent enough embedded system programmers. Risks have been externalized in the name of short term shareholders profit. The only way to fix the situation is to have investors to suffer if their company inadequately deals with cyber security.

Windows or 150 other apps that run on Windows?

Where can I purchase this? you have an ebay or amazon link or something?