Hacker News Reader

Comment by DoingIsLearning | Hacker News Reader

Maybe I am tinfoiling too hard...

In February this year there was an attack against Vodafone Portugal that brought down their whole mobile networks, 4G, 5G, and fiber, taking them several days to bring everything back up [0]. It also very clearly was a state actor, no threats, no ransom, sophisticated.

Taking down pipelines, taking down comms, taking down transport infrastructure. All within a few months. Always on NATO targets, always localized, never claimed with any statements, always sophisticated enough that it would require knowledgeable state actors.

It all seems like a training ground to find out if they can do it and probably a message to NATO members to not assume they are safe.

[0] https://arstechnica.com/information-technology/2022/02/vodaf...

View on HN

Yeah but I would assume the same attack is not going to be successfully against the same target a second time. So they are essentially providing free pentesting. And creating a climate that allows governments to introduce much stronger security measures. Without creating much actual damage.

Also I wonder if it was a physical oder purely software attack? If it was a physical attack on a critical system, it could have been anybody, not just state actors.

The German security landscape in general is in a pretty bad shape, hence such pentesting isn't all that valuable. Patch one vector, dozens or hundreds left open, and there is neither a strong security mindset nor a realistic option to implement meaningful security in infrastructure that often as not is decades old, fully analog, built without any security considerations at all, and falling apart on its own. IT security is pretty catastrophic (German law makes it hard to do it properly, it's much stricter than e.g. the corresponding US law), but physical security often as not turns out to be a sturdy closet with a hardware store combination padlock, even for things that would be considered critical and protected much better in other places.

I think this is about sending a message (we're aware of that situation + able and willing to take advantage of it) and to do it in a way that can't be kept under wraps. I guess this won't make it any easier for Chancellor Scholz to send the tanks Ukraine requested.

> IT security is pretty catastrophic (German law makes it hard to do it properly, it's much stricter than e.g. the corresponding US law)

To chime in on this, if you're in Germany and report a security vulnerability to a vendor there's a very good chance you'll get a criminal investigation, house searched, computers/phones seized for a long time etc. in return. Often in combination with a cease and desist or civil charges.

It's not a good idea to approach vendors directly with findings in general, but in Germany doing that can seriously screw your life up.

I wouldn't do security research in Germany at all. If you have talents in the area, just go to the US.

> If you have talents in the area, just go to the US.

I believe most simply go to another EU country since that's extremely easy to do and you can still serve the German market easily.

Really interesting topic: do you have any source you could share?

> there is neither a strong security mindset nor a realistic option to implement meaningful security in infrastructure that often as not is decades

Honestly, there is the opposite of a strong security mindset over here. Just a year ago, a security expert found an app of a major party leaking data of thousands of private persons - it was basically a web application without authorization. She tried to disclose this responsibly and naturally got sued due to unauthorized access to computer systems. Lilith Wittman is the person if you want to look further into it.

That's the standard here for security topics.

And if you keep digging into prosecution of cyber criminality, or at least actions of the state to increase cyber security, or at least actions to increase competency in cyber topics, it just gets worse. For example, they are looking for cyber security experts to join the police and state departments, but because they'd be working in various kinds of police jobs... they have to go through the same fitness and endurance tests as all police officers. Casual things like 12 minute runs, obstacle courses under pressure. Things IT-Nerds are good at.

I might have been interested some time ago, but currently that's just a recipe for criminal charges and disappointment.

>Casual things like 12 minute runs, obstacle courses under pressure. Things IT-Nerds are good at.

I might be able to do that, but then again the pay isn't great either. You can't ask for the right candidate with some useless extra requirements, if you don't even pay enough to get the right candidate without these extras.

Surprisingly, there was a video that aired just yesterday which talked about how deeply entrenched Russia is in Germanys IT infrastructure.

(German) https://youtu.be/dtZf-A4Qd5k

> The German security landscape in general is in a pretty bad shape

In some sense, they are doing pretty good. Much of German's companies and government organizations rely heavily on paper, telephone calls, tape recorders, physical meetings, and even fax. Many bridges (big, but also in rural areas) even have signs containing the max weight limits for various vehicle types including tanks. I sometimes wonder whether Germany's reliance on old-fashion methods are actually meant to be as reliable as possible in worst-case scenarios and to be difficult to hack. I mean, good luck hacking a tape recorder from thousands of miles away.

> Yeah but I would assume the same attack is not going to be successfully against the same target a second time.

That's a bold assumption

And that's why the CIA started this merry band of shadowy infrastructure hackers :)

Chaos engineering... for public infrastructure? :)

They can't cut two cables again? And Voda phone has now been made hack proof, I assume? Infrastructure is not secure, either digitally or physically. The only thing keeping them up is threats from the three letter agencies, like that hacking group that accidentally hit infrastructure and apologized for the international incident. https://www.theverge.com/2021/5/10/22428996/colonial-pipelin... there is literally nothing protecting any of these targets from state sponsored hacking or two guys with some bolt cutters and grenades. What's our success rate against Joe randoms with a rifle attacking domestic targets, much less actual trained operatives

There are reports that a cable was severed. (https://twitter.com/gebauerspon/status/1578706469570351104) But it's just a tweet. Don't know for sure.

Tagesschau, citing the federal police, reports that two cables at two locations in germany were cut https://www.tagesschau.de/inland/bahn-sabotage-101.html

The locations are a few hundred kilometers apart.

That doesn't mean it wasn't a state actor, the act itself can be done by anyone but knowing which cables to cut for maximum effect does require knowledge.

Considering it was two cables I wonder if they were part of the same fibre ring. Usually with those if the cable gets cut the traffic can route the other way around the loop. This is why they use rings instead of simple links.

It's because fibre cables are easy to cut by mistake, a digging machine will cut through it without knowing. Unlike the old backbone cables of old that were thick as a sewer pipe and carried thousands of cable pairs and heavy armour.

How is this tinfoiling?

The tinfoiler would think it's an inside (NATO) job. That these things are being done to maintain the fear, to increase the military budgets (i.e., money that could be spent on social programs), to increase the us v them unity, etc. Like 1984?

But perhaps The MIC qualifies as a state actor? As it's said...follow the money.

There are so many entities that benefit from such things it's difficult to say. Was it X? Was it Y making it look like X? Unless there's indisputable evidence then it's always hard to say. Easy to assume. But hard to say.

> That these things are being done to maintain the fear, to increase the military budgets

Somehow I think the shooting war in Europe right now is doing that just fine without the need for tinfoil.

If there's anything that does not need to be further incentivized among European populations and governments right now, it's NATO coordination.

From your side of the fence, I'd imagine that's true.

On the other hand, as I understand it, the other side some years ago expressed concerns about encouragement on their borders*. In fact, I've heard it said there was an agreement that wouldn't happen...then it did. But that depth is lost? How convenient.

Once you accept (?) the lies about the WMDs then it becomes clear that there are actors that have no bounds. Believe what you must, but chance are good it's based on one side of the story (as it so often is).

* Very similar to UBL saying get out of our neighborhood, or else. But we don't want to talk about that as it dilutes the strength of the propaganda.

Meh. All I'm saying is that when real bullets are flying, you'll find you have a much (much) harder time selling people on conspiracy theories. Trying to convince people that it's really western illuminati at fault works poorly when it was the other side that rolled the tanks.

Exactly. So there's incentive for shenanigans because it's so easily dismissed.

History, especially recent history*, is clear...don't underestimate the nefarious, especially when their reputations aren't properly understood. Especially when they're so adept at controlling the narrative of their story.

* For example, just last week there was this:

https://lawstreetmedia.com/news/citing-new-evidence-survivin...

To continue to label the established MO of these outfits as "conspiracy theory" is lazy and out of touch with reality.

> Exactly. So there's incentive for shenanigans because it's so easily dismissed.

"It must be true because it seems to be false" is a giant red flag for conspiracy rhetoric, FWIW.

Again, I'm not interested in engaging on the subject. I'm explaining why regular people looking at real wars don't see things your way.

> I'm explaining why regular people looking at real wars don't see things your way.

I'm explaining the same thing, the difference is my interpretation is based on actual historic events. That is, ultimately, what regular people believe isn't an accident.

I’m feeling that way, too, but I’m also aware of confirmation bias (or maybe it’s a different bias?), similar things might happen normally, but we don’t remember them because they are unrelated events in other years, yet now we make connections where none are.

> always sophisticated enough that it would require knowledgeable state actors.

Maybe I’m missing something, but that doesn’t seem to be the case here?

NATO is big. There is nothing as yet to suggest this is international and not just normal domestic crime.

Same feelings about those bridges in Italy not too long ago.

Regarding the pipelines, it seems odd to call them a NATO target when they’re largely owned by Russia. Likewise, Russia had more to gain from just holding the gas supply hostage by stopping it, but offering to return the supply were Europe to give in to demands after a cold winter or two. Meanwhile, did you watch the video of Biden threatening to take them out from this past February?

Here in north-east Poland we're quite used to it. The most frequent are GPS spoofing and lte jamming.

Its not like they even try to hide their location or anything.

If I was to put my tinfoil hat on I would say those current attacks concentrate on Germany because due to long standing influence of Russians on German politics German's political class is a de-facto ally of Russia (against the will of its own population). Those attack's purpose is to scare ordinary Germans into letting their politicians continue pretend they help while they continue doing all in their power to help Putin's regime(or its equivalent under a different name).

I don't buy that theory. First of all: outside of the party "Die Linke" and the left wing of the SPD, there's little ideological friendship to Russia in German politics, it's either regular corruption (Gerhard Schröder) or industrial politics ("you give us cheap energy, we keep our eyes closed and don't mention the smell"). If anything, actions like these will make Germans more willing to spend extra money on defense, suffer during the shift to different energy providers, and support Ukraine.

As it's usually the case with these events, it's easy to find motives if you discount the possibility of being caught. The US might do it for the reasons I mentioned. The German govt might do it to make the population more willing to follow orders. Some anti-capitalist group might do it because ... idk, trains are evil (they've been sabotaging mostly local trains in/around Berlin in the past decade or so, but they typically claim their actions, so we'll see). The DB might be behind it to get more money to upgrade & secure their infrastructure.

I'm pretty sure it wasn't me, but everyone else has a motive.

>don't buy that theory. First of all: outside of the party "Die Linke" and the left wing of the SPD, there's little ideological friendship to Russia in German politics, it's either regular corruption (Gerhard Schröder) or industrial politics ("you give us cheap energy, we keep our eyes closed and don't mention the smell").

You don't buy what? Why does there have to be "ideological friendship" for two groups of criminals to cooperate and root for each other? It has been obvious to anyone looking at actual actions made rather than words and political theater.

Right wing AfD also seems to sympathize with Russia. Unclear how much because they like Putin's "traditionalist" policies and how much because they are Russian controlled shit stirrers.

Ah, yes, you're right. I didn't even consider them, because they're pretty much irrelevant, at least for now. I also believe it could be both + there's probably a bit of "the enemy of my enemy is my friend" as well (the "enemy" of them being the current center-left government), and a good splash of insanity. Add tribal behavior where you're moving with the group you're a part of and I guess this is what you get.

You both are right. Don't forget that "Die Linke", "SPD" and other marxist invested parties serve the same role today as they did during the first cold war. Their ideology works towards a class struggle by uncivil means, destabilising their democracy. The same goes for their economic policy, it would drive the country into the ground. Or the "greens" using terror and fear campaigning against nuclear energy in the past; it got us where we are today. Point being: There is no need for ideological friendship/alignment for actors to be on the Russian side. Many people are simply controlled without realising it.

> Many people are simply controlled without realising it.

I'm sure that's true in general, and you'll never know whether you did someone else's bidding without realizing it, unless they tell you (but would you believe them?) or you uncover some huge conspiracy (but then who says that's not fake to make you do something else?). I vaguely remember an interview that Adam Curtis made with some British economist for one of his movies concerning stagflation and the general direction of the economy and wages at that time, and he said something like "when I can't sleep, I sometimes wonder whether what we did was exactly what someone wanted and they knew what would happen".

As for Die Linke, (the far-left wing of the) SPD and the Greens, I don't believe they're malicious. I believe they mean well, even though I probably disagree with them on most of their core issues.

2/3 non NPC people within a political party is someone else his strawman ( on average ). But that does not automatically mean they are malicious.

Its NATO

Reply on news.ycombinator.com