Mysterious safety-tampering malware infects a second site

Re:Mysterious safety-tampering malware infects a second site by HeWhoLurksLate on Wednesday April 10, 2019 @04:11PM (#19628329)

From what I've heard, one of the problems here is that Windows 10's support of parallel ports (widely used in automation) is really bad, and there's no way that live updates are going to be acceptable on something that needs to be running 24/7. What ways are there to properly air-gap something like this?

[ Parent | on HN ]

Re:Mysterious safety-tampering malware infects a second site by varjag on Wednesday April 10, 2019 @04:30PM (#19628492)

The solution of course is to not use Windows, without ifs and buts. It was a bad idea coming to its conclusion.

[ Parent | on HN ]

Re:Mysterious safety-tampering malware infects a second site by ronsor on Wednesday April 10, 2019 @04:36PM (#19628534)

That's always the solution, even if it isn't a realistic one.

[ Parent | on HN ]

Re:Mysterious safety-tampering malware infects a second site by an_account_name on Wednesday April 10, 2019 @10:10PM (#19630550)

Plenty of software runs on platforms other than windows. Plenty of industrial control software, too.

[ Parent | on HN ]

Re:Mysterious safety-tampering malware infects a second site by coldacid on Wednesday April 10, 2019 @04:44PM (#19628597)

And of course once nobody's using Windows, attackers will pivot to target whatever everyone's switched to in its place. And they'll find holes. They always do.

[ Parent | on HN ]

Re:Mysterious safety-tampering malware infects a second site by varjag on Wednesday April 10, 2019 @04:55PM (#19628701)

We're talking about the difference between barely usable and unusable here. No system in the world has ever been slimefest of the scale of Windows. Even those which are deployed more than Windows.

[ Parent | on HN ]

Re:Mysterious safety-tampering malware infects a second site by thesimp on Wednesday April 10, 2019 @05:58PM (#19629183)

It is much to easy to blame Windows for everything. If this is another TRITON level attack then it did not matter what operating system is used, the attackers would have come in anyway. With enough resources you can break anything.

Check out the DEFCON 2018 talk "Through the Eyes of the Attacker" to see to what lengths the TRITON attackers went. These guys were dumping eeproms from boards running obscure MIPS processors and were looking at raw ethernet packets in Wireshark and flipping bits in the packets to see what would happen. That their command&control was running on Windows was just coincidence.

[ Parent | on HN ]

Re:Mysterious safety-tampering malware infects a second site by varjag on Sunday April 21, 2019 @02:30AM (#19710819)

> With enough resources you can break anything.

Very few adversaries have enough resources to break anything. The threshold for roughing up a Windows setup is the lowest in the industry.

[ Parent | on HN ]