Schneier on Security

Clive Robinson • August 30, 2026 5:19 AM

@ ResearcherZero, ALL,

With regards,

“Evidence left behind after the attack suggests that the Chinese-speaking actor had prior access, which assisted in prioritizing information for exfiltration which was targeted in the later intrusion.”

The same old two questions arise,

1, Why were these systems “externally connected”?
2, Why were early signs of intrusion by attackers missed?

And I suspect the answers will be the usual and boil down to poor “management choices”.

Clive Robinson • August 31, 2026 1:00 AM

@ ResearcherZero, ALL,

With regards to the CISA Red Teaming, consider this was still unassisted human attackers.

Now consider if you were a red team attacker today using AI Agentic tools against human defenders,

How do you think the results would change?

Yup me to. Hence me talking about the only viable solution for defenders being,

“Mitigation by Segregation”

With very minimal interconnection within an organisation, and effectively none outside the organisation.

Clive Robinson • September 2, 2026 6:49 PM

@ Bruce, All,

As Germany approaches a voting season it appears that infrastructure attacks blamed on Russia are becoming more numerous.

https://www.reuters.com/world/europe/german-power-grid-under-fresh-sabotage-attack-police-say-2026-09-02/

Buried away in the report is,

“Also on Tuesday, devices carrying conductive material damaged power lines at one of the most critical high-voltage nodes in the eastern state of Brandenburg.”

But does not go into details as to what the devices where.

Other sources claim that they were rockets trailing conductive wire designed to short out power lines.

These are of the same idea as the US used during the first gulf war.

Conceptually these are not difficult devices to make, simply the rocket pulls a long trace wire behind it which also keeps the rocket on course and restricted altitude. Providing the motor burn time is correctly calculated the conductive trace will drop across power wires on pylons that are not insulated except at mounting points.

Some reports indicate that these rockets were not home made as would be expected by a terrorist organisation but semi-professional “prototype grade” as would be made by a covert state level entity/agency.

What the truth of the matter concerned is, is almost not relevant due to the fact that increasing numbers of Germans in the East want a re-establishment with Russia due to the basic economics of wanting cheap energy again and not realising what the real cost in the future will be.

Oh and it looks like Russia leaders are planning on opening a new front on Ukraine through Belarus. That is there are indications that rather more than “little green men” advisors are heading into that area. This is despite increasing sentiment in Russia against what is seen as an increasingly pointless war that is killing the youth and will never return anything of worth for the Russian people who bare the direct cost of the war and the beginnings of unavoidable hyper inflation it is causing.

Clive Robinson • September 3, 2026 5:43 AM

@ lurker, All,

Technical details of what has been going on in Germany are “sketchy”

But if you look at this adticle,

https://clashreport.com/world/articles/more-than-20-homemade-rockets-found-in-germany-power-grid-sabotage-probe-28g0cokidxb

You find two what would normally be considered conflicting comments,

“… more than 20 homemade rockets and timed launch devices …”

“The projectiles had been specifically modified rather than used as conventional fireworks, according to Redmann, who said their preparation required significant work.”

As “an engineer” I know how to do “technical and/or exacting” modifications and what can be involved.

Having in the past sat down and worked out the orbital equations for projectiles and rockets from basic principles (Pythagoras). I would feel fairly confident that I could do the maths required to minimise “live fire testing” that would be publicly noticeable thus reducing “discovery risk”.

But honestly it I was doing this as an Operation by a nation state I would have done the engineering work in my home country where there is no “in public view risk”. And then I’d train the operatives in the things they would need to know to complete the task and also to “stay alive”.

And whilst I keep digging for information I shall assume as it’s the argument that makes most sense, technically that these are “trained operatives” in effect “living off the land”.

Even though “building rockets” from fairly easily available hobbyist parts would be “somewhat easy” as many You-Tube videos show all you need is a highish end workshop and appropriate precision construction skills.

Heck if you don’t mind dying via COPD or lung cancer you don’t need the expensive air filtration needed for working with Carbon Fiber or similar materials[1]. And whilst a small number will “think like that” most with engineering or STEM training to degree level or above very probably won’t[2].

[1] I have “contact dermatitis” to several products including fiberglass which has killed off certain aspects of my engineering career. Acquired when I was young and PPE was unknown in the workplace and hospitals had not heard of nitrile gloves to stop career ending latex allergies in nurses and doctors or in industry those using epoxy, thinners and the like.

[2] Even the casting of components for solid fuel rocket motors carries significant life altering / shortening risks beyond the obvious ones. And as for liquid fuels they are just unbelievably nasty both before and after use and you really really don’t want to go there as the book “Ignitionn!” takes a some what amusing view take on why,

https://www.librarything.com/work/1431927/reviews

One quote from which that is becoming highly relevant in this new age of AI and insufficiently trained “vibers”,

“Everyone who uses a computer frequently has had, from time to time, a mad desire to attack the precocious abacus with an axe.”

Clive Robinson • September 3, 2026 10:43 PM

@ lurker,

Re,

“Attribution is difficult.”

Is almost my old “attribution is hard” I used to say to make a point about US and later UK Internet Security firms saying it was one of the four horsemen nations[1] that US politicians wanted blamed at the time for mostly irrelevant reasons…

Common sense told us that just about every nation and it’s dog/goat was doing “cyber intrusion” and the like just because they could (thanks to Microsoft and similar Corps). But such nations never get publicly mentioned just “one of the four horsemen”… and almost in rotation. So as I used to note “not at all believable”.

Eventually a lot of these companies siding with US political wishes started to realise that they were not doing their companies reputations any good, thus started to change their analysis.

Any way it’s gone three thirty in the morning and I’m to tired to go through it all in depth.

[1] Also known as the “axis of evil” they are China, Iran, North Korea, and Russia.

All of whom for some strange reason US Politicians on the hill not just the executive want to go to war with currently, or have pushed hard towards this century (and ended up embarrassed by certainly Iran and North Korea both of whom have behaved as the “rational actors”).

Why there is this weird desire in US politicians is frankly unfathomable, especially as the current direct conflict with Iran and Conflict by proxy with Russia shows the US is not going to win no matter how many trillions of voting citizens tax money they throw at it. So much so there are more and more whispered statements about “the nuclear option being put on the table” being put out there.