Schneier on Security

1&1~=Umm • March 20, 2019 9:45 AM

From the article,

“‘Their research paints a worrying picture of a sophisticated cyberweapon built and deployed by a determined and patient hacking group whose identity has yet to be established with certainty.'”

Is in effect pointing out the attribution problem. The article goes on to indicate that a company thinks it has even identified a University Professor behind it.

Politically it sounds good as it targets Russia, but Originally the same types of researcher pointed at Iran because it appeared to be the Geo-Political choice at the time.

Does this worry people?

It would me if I was a member of that Professors family or one of his students etc. It’s about a decade now since the US raised the ‘kinetic response’ flag. But we forget that some countries actually follow through, as with Israel and Gerald Bull. Oh and the US are known to go after individuals with cruise missiles and more modern reusable thus far less costly UAV drones with weapons like ‘hell fire’. As you would expect there has been collateral damage, that if this continues could easily be comming to a nice middle class urban area near you real soon.

It’s something people real should be having serious conversations about. Especially as there is way to much ‘That’s horible, nobody would do that’ thinking. People realy should get to grips with the notion of ‘If it’s possible then someone will do it sooner rather than later’ as this malware amply demonstrates.

The article mentions Union Carbide and the Bhopal ‘accident’ what few remember now is it was not just cheap labour that caused the plant to be ‘out sourced’ there. At that time there was no compensation law in India that could be used by potential victims to get compensation and the Indian government had put in place various policies for amongst other things what we now call ‘arms length managment’ where Union Carbide were not exactly actively involved. Also local parts sourcing giving rise to the use of undesirable or substandard parts thus xausing not just maintenance issues but safety ones as well. Further as those involved in the early days of ‘outsourcing to India’ officials would include in their labour cost promotions the fact that the compensation laws were ‘business friendly’. So if the plant did blow up ‘so what’ it won’t effect the profits with massive compensation claims and the attendent legal fees. But further they also pushed the lack of ‘zoning’ thus the workers would live literaly in the plants shadow, thus transportation provision was not needed…

It’s worth looking up what happened after that. It’s a clasic case of ‘attribution failure’ oh and Stratfor and wikileaks get to make appearances.

Even though India has brought in legislation since, it still has shocking working conditions with child labour still being exploited, who’s lives are often misserably short. It’s clear that there is no ‘trickle down’ effect of any meaning as the differential between the few at the top and the masses at the bottom just continues to widen.

But there is also another important lesson in there for all of us. The Triron attack got caught by pure chance and the fact the Saudi Company involved was actually more security concious than the industry standard. But attacked it was and via the Internet through what you could fairly call ‘Industrial IoT Devices’. They miggt be bigger and more expensive, but they have a lot of DNA in common with those ultra cheap Chinese ‘spy on you’ IoT devices that try to leverage profit by the gathering and marketing of your PII. Both have a very soft and vulnerable undervelly and a lot of the security failings in one appear in the other.

I’ve been around the block a few times when it comes to Industrial Control Systems (ICS) and their very distinct lack of security due to technical transparency being given prefrence. Thus I’m well aware of the failings waiting for those that adopt IoT. Which is why I avoid them entirely, because I know that sooner rather than later some one with no morals or ethics will do the same again.

Thus we should be talking about when not if there is a ‘Triton for the home’ and just what the heck we are going to do as clean up afterwards. Do we alow the War Hawks to walk around humming ‘Send in the Drones’ or do we ensure that we have suitable spares and maintainence people to keep not just the lights turned on but clean water flowing in and sewerage flowing away to be dealt with. Because if we don’t the ‘Great Stink of London’ will be coming to a town close to you, not that you will care because the chances are the delivery schedual systems for supplying shops will have failed and the shelves will be bare of staples such as food… Need I remind people of the ‘KFC Crisis’ where people could not get the bargin bucket they wanted or some such that became national news.

Slight joking aside if you realy want to hurt civilians in big numbers you have two choices,

1) Cascade Failures in infrastructure

2) APT type attacks on the ‘supply chain’ managment systems.

As many have found chairs are not easy to sit in when one leg has gone, but two? Thats become a skill that will appear on ‘The US has got tallent’ show 😉