Comment by GistNoesis | Hacker News Reader

Comment by GistNoesis | Hacker News Reader

Parent Full thread

Alternatively, you can view it as a OSI layer 1 attack.

A bunch of optic fibers have been cut, but the network was badly designed without redundancy (as evidenced by the current denial of service).

Strategic points (the attacks occurred at junctions of several axis) were left insufficiently guarded.

The location of these points also shouldn't have been made available to bad actors.

French people are not surprised because there are always problems with train when lots of people need them to go on holidays. Usually at this time of the year it's getting hot, and it's one or more electrical transformer that gets burned by high heats. When copper price get high, cables are usually stolen to be sold as metal. And there are also strikes.

There is an economic balance to be found between the cost of securing and maintaining the infrastructure vs fixing the problems once they occur. Probably can be better, but others probably have it much worse.

You can't really guard thousands of kilometers of rails, or have much redundancy considering the cost of the infrastructure. The incesseant budget cuts and progressive privatization certainly do not help.

If you begin to threat model the physical security necessary, you quickly see how asymmetrical it is, regardless of the money thrown at it.

@liotier, I've been rate-limited and cannot reply to you directly, so I'm editing my response into this comment. My apologies.

I didn't intend any slight to French infrastructure or those designing and securing it, just the dynamics of the problem. It is easier to attack than to defend, particularly in physical security. I'm sure critical infrastructure is well taken care of. Do you know if TGV is considered as critical as the other sites you noted? I'm curious of your opinion about what level of expertise and intelligence collection it required to carry this out.

Network redundancy (sometimes up to quadruple for some of the French electrical infrastructure) is indeed vulnerable to asymmetrical attack, if the attacker knows what secures what.

I can throw burning fuel into a manhole or at a street cabinet, and it doesn't take much insight to find one that carries important traffic - take your pick near a military base or a nuclear power plant. But the attack will be ineffective, because the attacker needs to know what other bits of infrastructure carry the backup circuits - and take them out simultaneously. And, of course, for the important stuff such information is classified. So, an effective attack on French critical infrastructure is more difficult than it seems at first glance.

Reply on news.ycombinator.com