Hacker News Reader

Comment by captainmuon | Hacker News Reader

Yeah but I would assume the same attack is not going to be successfully against the same target a second time. So they are essentially providing free pentesting. And creating a climate that allows governments to introduce much stronger security measures. Without creating much actual damage.

Also I wonder if it was a physical oder purely software attack? If it was a physical attack on a critical system, it could have been anybody, not just state actors.

View on HN

The German security landscape in general is in a pretty bad shape, hence such pentesting isn't all that valuable. Patch one vector, dozens or hundreds left open, and there is neither a strong security mindset nor a realistic option to implement meaningful security in infrastructure that often as not is decades old, fully analog, built without any security considerations at all, and falling apart on its own. IT security is pretty catastrophic (German law makes it hard to do it properly, it's much stricter than e.g. the corresponding US law), but physical security often as not turns out to be a sturdy closet with a hardware store combination padlock, even for things that would be considered critical and protected much better in other places.

I think this is about sending a message (we're aware of that situation + able and willing to take advantage of it) and to do it in a way that can't be kept under wraps. I guess this won't make it any easier for Chancellor Scholz to send the tanks Ukraine requested.

> IT security is pretty catastrophic (German law makes it hard to do it properly, it's much stricter than e.g. the corresponding US law)

To chime in on this, if you're in Germany and report a security vulnerability to a vendor there's a very good chance you'll get a criminal investigation, house searched, computers/phones seized for a long time etc. in return. Often in combination with a cease and desist or civil charges.

It's not a good idea to approach vendors directly with findings in general, but in Germany doing that can seriously screw your life up.

I wouldn't do security research in Germany at all. If you have talents in the area, just go to the US.

> If you have talents in the area, just go to the US.

I believe most simply go to another EU country since that's extremely easy to do and you can still serve the German market easily.

Really interesting topic: do you have any source you could share?

> there is neither a strong security mindset nor a realistic option to implement meaningful security in infrastructure that often as not is decades

Honestly, there is the opposite of a strong security mindset over here. Just a year ago, a security expert found an app of a major party leaking data of thousands of private persons - it was basically a web application without authorization. She tried to disclose this responsibly and naturally got sued due to unauthorized access to computer systems. Lilith Wittman is the person if you want to look further into it.

That's the standard here for security topics.

And if you keep digging into prosecution of cyber criminality, or at least actions of the state to increase cyber security, or at least actions to increase competency in cyber topics, it just gets worse. For example, they are looking for cyber security experts to join the police and state departments, but because they'd be working in various kinds of police jobs... they have to go through the same fitness and endurance tests as all police officers. Casual things like 12 minute runs, obstacle courses under pressure. Things IT-Nerds are good at.

I might have been interested some time ago, but currently that's just a recipe for criminal charges and disappointment.

>Casual things like 12 minute runs, obstacle courses under pressure. Things IT-Nerds are good at.

I might be able to do that, but then again the pay isn't great either. You can't ask for the right candidate with some useless extra requirements, if you don't even pay enough to get the right candidate without these extras.

Surprisingly, there was a video that aired just yesterday which talked about how deeply entrenched Russia is in Germanys IT infrastructure.

(German) https://youtu.be/dtZf-A4Qd5k

> The German security landscape in general is in a pretty bad shape

In some sense, they are doing pretty good. Much of German's companies and government organizations rely heavily on paper, telephone calls, tape recorders, physical meetings, and even fax. Many bridges (big, but also in rural areas) even have signs containing the max weight limits for various vehicle types including tanks. I sometimes wonder whether Germany's reliance on old-fashion methods are actually meant to be as reliable as possible in worst-case scenarios and to be difficult to hack. I mean, good luck hacking a tape recorder from thousands of miles away.

> Yeah but I would assume the same attack is not going to be successfully against the same target a second time.

That's a bold assumption

Chaos engineering... for public infrastructure? :)

And that's why the CIA started this merry band of shadowy infrastructure hackers :)

They can't cut two cables again? And Voda phone has now been made hack proof, I assume? Infrastructure is not secure, either digitally or physically. The only thing keeping them up is threats from the three letter agencies, like that hacking group that accidentally hit infrastructure and apologized for the international incident. https://www.theverge.com/2021/5/10/22428996/colonial-pipelin... there is literally nothing protecting any of these targets from state sponsored hacking or two guys with some bolt cutters and grenades. What's our success rate against Joe randoms with a rifle attacking domestic targets, much less actual trained operatives

There are reports that a cable was severed. (https://twitter.com/gebauerspon/status/1578706469570351104) But it's just a tweet. Don't know for sure.

Tagesschau, citing the federal police, reports that two cables at two locations in germany were cut https://www.tagesschau.de/inland/bahn-sabotage-101.html

The locations are a few hundred kilometers apart.

That doesn't mean it wasn't a state actor, the act itself can be done by anyone but knowing which cables to cut for maximum effect does require knowledge.

Considering it was two cables I wonder if they were part of the same fibre ring. Usually with those if the cable gets cut the traffic can route the other way around the loop. This is why they use rings instead of simple links.

It's because fibre cables are easy to cut by mistake, a digging machine will cut through it without knowing. Unlike the old backbone cables of old that were thick as a sewer pipe and carried thousands of cable pairs and heavy armour.

Reply on news.ycombinator.com