Hacker News Reader

Comment by alasdair_ | Hacker News Reader

I agree. I’d give 60% odds that there is at least one significant attack (ransomware plus shutdown) on US power grids in the next 18 months.

View on HN

Basic game theory dictates that the cost of ransoms will continue to rise until it hits the price point at which the targeted company would have to replace its compromised systems from scratch.

5M, 50M, 500M, 5B, 50B?

I wonder how the government would react if a hacker group held gas/power/clean water/etc. hostage for millions of Americans for a ransom in the tens of billions

The government seems to have no problem with utilities doing this or worse to their own customers (PG&E, Texas power grid, Flint Michigan). But I guess if they could blame a foreign power that's an opportunity for a profitable war.

> The government seems to have no problem with utilities doing this or worse to their own customers (PG&E, Texas power grid, Flint Michigan).

The “utility" acting in Flint was state and state-imposed local government officials, 9 of whom have been criminally indicted for their role, so manifestly the government has something of a problem with it.

> I wonder how the government would react if a hacker group held gas/power/clean water/etc. hostage for millions of Americans for a ransom in the tens of billions

War.

Too grandiose a word for a targeted assassination of a handful of folks.

Not if the hacker group is a nation state. Sure, small time hacking is cute and all, but the US isn’t going to just roll over and be all like “oh no, you hit critical infrastructure that had a big impact on peoples life. Carry on”

Even this time too government was aware that Colonial paid the Ransom. The question was asked in the Whitehouse press breifing, it was told that this is essentially a private sector matter, Government will not advice Colonial in this regard. Also they said it was Colonial's prerogative to decide and act.

Transcript of Whitehouse Press Briefing: https://www.whitehouse.gov/briefing-room/press-briefings/202...

That's because nothing of consequence happened at this time. Had the actions resulted in deaths of a few hundred or a few thousand Americans the response would most likely be very different.

Wouldn't it cause more ransoms and more damage to millions of Americans?

continuing the unfortunate trend of the public spending to protect private profit.

Taking out a fuel pipeline in non-heating months seems a lot less likely to cause casualties than downing a power grid. Dead people get different responses than theft, even massive theft. Also, knowing how scary oil companies are, I wouldn't be surprised if some people turned up dead over the colonial hack. Even if they get the attribution wrong, a dead hacker group would have a chilling effect on such activities.

As per reports the ransomware had no effect in any of the physical pumping/operational systems required to pump/operate the pipeline, it only affected their billing system and they stopped pumping because later it would have difficult to reconcile the billing for it, not because the ransomware disabled the pumps.

Reply on news.ycombinator.com