News for hackers. Stuff that matters.
Re:What’s interesting about the Florida water system hack is... by lisper on Wednesday February 10, 2021 @06:04PM (#26096065)
You're assuming that the goal here is to achieve security. It isn't. The goal here is to achieve the appearance of security. And that is not an entirely unreasonable approach because appearing to be secure can discourage people from even attempting an attack. Your home security system won't actually keep anyone who knows what they are doing from robbing your house if they decide to rob your house. What it could do is make them decide to rob your neighbor's house instead.
Re:What’s interesting about the Florida water system hack is... by ketzo on Wednesday February 10, 2021 @06:41PM (#26096366)
The article mentions that a huge number of water treatment facilities are controlled by publicly-accessible web portals.

Maybe the goal isn't to make every single facility 100% secure to all threats, but it's totally defeatist to say that we couldn't somewhat increase the actual security of many systems. VPNs alone would provide a great first line of defense, and even for a government-run utility, the barrier to installation is very low there.

I have a fair level of skepticism around security theatre, too, but I think it's unfairly cynical to suggest that we don't have a goal of making ourselves more secure.

Re:What’s interesting about the Florida water system hack is... by buzzy_hacker on Wednesday February 10, 2021 @06:12PM (#26096145)
I think the analogy falls apart because clearly trying to appear secure isn’t deterring Russia/China from hacking US infrastructure.
Re:What’s interesting about the Florida water system hack is... by lisper on Wednesday February 10, 2021 @06:17PM (#26096176)
That's true, but this almost certainly was not a state-level actor. When Russia or China decide to do damage to our infrastructure, they will almost certainly succeed. The deterrent in that case will be retaliation, not the appearance of security. But in no event can our civilian infrastructure be actually protected. It's just too hard. There's too much of it and there are too many people who legitimately need access.
Re:What’s interesting about the Florida water system hack is... by lupire on Wednesday February 10, 2021 @11:06PM (#26098146)
Russian government has quite successfully attacked our information infrastructure and goaded us into attacking ourselves. They didn't need any hacks; they walked right in the front door of Twitter x Facebook, et al.
Re:What’s interesting about the Florida water system hack is... by whatshisface on Wednesday February 10, 2021 @06:36PM (#26096333)
>When Russia or China decide to do damage to our infrastructure, they will almost certainly succeed.

What if there are 100 attacks per year, with a 99% success rate?

Re:What’s interesting about the Florida water system hack is... by TeMPOraL on Thursday February 11, 2021 @07:31AM (#26100771)
Maybe they are. But we can estimate that they're not too impactful - otherwise we'd notice either the attempts or the effects. If there are ongoing successful attacks, they do not cross the very important threshold, past which US government officials would start making public noises in the direction of nuclear chain of command.
Re:What’s interesting about the Florida water system hack is... by boomboomsubban on Wednesday February 10, 2021 @08:12PM (#26097034)
There'd be 99 hacks and they missed just one.

I don't get what you are asking.

Re:What’s interesting about the Florida water system hack is... by alasdair_ on Thursday February 11, 2021 @01:38AM (#26098898)
What if there were lots of of successful hacks and this just happened to be the outlier because an admin was online and looking at the system at the exact moment the hack occurred?

Any large adversary would compile a huge number of ways to disable infrastructure, then use them all at once, rather than one at a time.

Re:What’s interesting about the Florida water system hack is... by boomboomsubban on Thursday February 11, 2021 @02:03AM (#26099011)
The quote "When Russia or China decide to do damage to our infrastructure, they will almost certainly succeed," already made that point though.
Re:What’s interesting about the Florida water system hack is... by lordnacho on Wednesday February 10, 2021 @07:47PM (#26096862)
There ought to be a second principle here:

https://en.wikipedia.org/wiki/Kerckhoffs's_principle

In addition to assuming the adversary knows how everything is designed (as opposed to security-by-obscurity) there should also be an assumption that security is obtained through real implementations, not theatre.

Re:What’s interesting about the Florida water system hack is... by sellyme on Thursday February 11, 2021 @12:49AM (#26098655)
> Your home security system won't actually keep anyone who knows what they are doing from robbing your house if they decide to rob your house. What it could do is make them decide to rob your neighbor's house instead.

What happens when everyone in my street buys the same security system? Seems like we all just spent a lot of money buying something that now offers us no benefit.

Short of purchasing a honeypot property with (seemingly) no security system and going full Home Alone on the inside of it, it seems like you're going to need actual security at some point.

Re:What’s interesting about the Florida water system hack is... by bobthepanda on Thursday February 11, 2021 @01:01AM (#26098713)
There's an old tale about this where everyone switched from brooms to vacuum cleaners to save work, which then caused a coal plant to be opened for the increased power demand, which proceeded to dirty everyone's homes so everyone was working just as hard for a slightly dirtier home than when they were using brooms.

At least for the home example, you're usually better off reducing the factors that would make a break-in happen in the first place rather than trying to win an arms race against a determined attacker; there are high trust societies where people don't bother locking their doors and people don't get burgled. But obviously the threat model is different than a utility.

Re:What’s interesting about the Florida water system hack is... by TeMPOraL on Thursday February 11, 2021 @07:41AM (#26100851)
> Short of purchasing a honeypot property with (seemingly) no security system and going full Home Alone on the inside of it, it seems like you're going to need actual security at some point.

You mean men with guns stationed 24/7? There is no "actual security" against determined burglars available on the market for regular people. There's delaying action (e.g. laminated glass), noise making and deterrence (cameras). Each can be worked around.

This is also a general point on security: there's no perfect security, there's only adequate security - where "adequate" means it costs the attacker more to breach it than they can expect to profit. From this view, appearance of security is almost as good as actual security measures - you make security look expensive to breach, which achieves the same effect, as long as nobody is willing to call your bluff.

Re:What’s interesting about the Florida water system hack is... by pitaj on Thursday February 11, 2021 @12:58AM (#26098701)
They target a poorer neighborhood
Re:What’s interesting about the Florida water system hack is... by im3w1l on Wednesday February 10, 2021 @06:36PM (#26096329)
> Your home security system won't actually keep anyone who knows what they are doing from robbing your house

Sure but it might keep out all the people who don't know what they are doing. Like some clueless junky.

Re:What’s interesting about the Florida water system hack is... by andrei_says_ on Wednesday February 10, 2021 @06:47PM (#26096419)
Fun fact: addiction is a disease and not a choice. It is strongly related to trauma, ptsd, income inequality and other factors individuals don’t have a choice in.

Classifying someone as a “junky” adopts a cruel and unrealistic worldview blaming the victim and absolving a number of powerful actors of their role in contributing to addiction on mass scale.

Re:What’s interesting about the Florida water system hack is... by im3w1l on Thursday February 11, 2021 @12:26AM (#26098536)
Ok but I still don't want them impulsively robbing me when they are coming down and need money for the next fix.
Re:What’s interesting about the Florida water system hack is... by eloff on Wednesday February 10, 2021 @06:56PM (#26096471)
A junky is a victim of powerful actors contributing to addiction? Presumably if we're talking about someone who got addicted to precipitation opioids and then turned to heroin, yes. You do have a point there. It's like the partner that cheats because she feels neglected. Yes that was a contributing factor, but at the end of the day nobody put a gun to their head - it was a (bad?) choice that they made. Yeah physical addiction to prescription drugs is a little different, a little closer to having a gun to your head, but still.

What about those who were recreational drug users that went down a dark and dangerous path? Presumably in this case it's fair to put the blame on them. Yeah, maybe they had issues with their parents and maybe they had some other problems. But nobody put a gun to their head. They made a bad choice and paid the price. That's how life is.

You can't absolve personal responsibility either.

Re:What’s interesting about the Florida water system hack is... by andrei_says_ on Wednesday February 10, 2021 @07:01PM (#26096513)
> What about those who were recreational drug users that went down a dark and dangerous path?

What about the rev users who didn’t go down the dark path?

This precisely is the difference of having genetic predisposition to addiction, trauma etc.

No, it’s not a choice more than obesity / food addiction is.

If you’re interested in expanding your thinking see the work of Gabor Mate.

Re:What’s interesting about the Florida water system hack is... by filoleg on Wednesday February 10, 2021 @07:37PM (#26096795)
> No, it’s not a choice more than obesity / food addiction is.

I agree that obesity/food addiction and drug addiction are both on a similar level, but to me they both sound like a choice.

Mostly because if we decide to apply the same standard you use for qualifying whether something is a choice or not, then literally nothing is a choice.

A man who physically abuses his wife and children? Not a choice, he is doing it simply because he had some experiences in his life that made him that way or he is just simply genetically predisposed. Someone cheats on their partner? Not their choice, they were predisposed to do it or their partner was just not making them happy enough. Harvey Weinstein? Not his choice, he was just a victim of his own circumstance who was also genetically predisposed to do what he did.

You get the idea, but I honestly do not believe that most of those things are anything but choices, unless we decide to pretend we believe in predetermination and complete lack of free will. In which case, I would agree with you, those decisions were not choices, because choices don't exist in the context of belief in predetermination.

Mind you, I am not saying there are no circumstances in which those situations would not be a choice. There are indeed some scenarios like that. However, and that's purely subjective based on my personal observations, those scenarios are a minority.

Re:What’s interesting about the Florida water system hack is... by cratermoon on Wednesday February 10, 2021 @11:20PM (#26098219)
> to me they both sound like a choice

Addiction Is a Brain Disease, and It Matters: https://science.sciencemag.org/content/278/5335/45

Re:What’s interesting about the Florida water system hack is... by lupire on Wednesday February 10, 2021 @11:09PM (#26098167)
The logical trouble you are having is trying to fit an analogy multidimensional phenomenon into a binary model.
Re:What’s interesting about the Florida water system hack is... by filoleg on Thursday February 11, 2021 @01:53AM (#26098967)
To be fair, I simplified, and I agree with your critique of what I said.

I don't think it is a binary choice vs. not choice. If speaking frankly, I do believe that any of those things discussed feature both a choice component and a predisposition component. The proportion of each of those two components varies heavily based on a person and a situation.

However, even with this in mind, it is difficult to say that the choice component is ever at zero.

We can discuss to which degree humans have a choice in their actions, because it is definitely debatable, since they all agree on the ground truth that there is always some degree of choice. But that discussion cannot coexist with a belief in total predetermination, since that removes any ground truth completely.

Re:What’s interesting about the Florida water system hack is... by eloff on Wednesday February 10, 2021 @07:34PM (#26096769)
> This precisely is the difference of having genetic predisposition to addiction, trauma etc.

Maybe. Or maybe just the culmination of a series of bad choices.

> No, it’s not a choice more than obesity / food addiction is.

That's a choice. Nobody is making you buy the potato chips and cheesecake. Nobody is holding you back from the gym. It might annoy a lot of very fat Americans, but you've got effectively the same DNA as everyone else - but they're not as fat. It's a cultural thing and a choice.

Yes I know I'm glossing over some nuance here, but personal responsibility remains. Ignoring that seems like just resigning yourself to be blown wherever the wind takes you.

Take responsibility for your decisions, take a good honest look at where you are, what you don't like about that, make a plan to change that, and then execute it.

Re:What’s interesting about the Florida water system hack is... by danaliv on Wednesday February 10, 2021 @08:24PM (#26097124)
You're arguing against the clinical consensus on addiction, which is backed by decades of evidence. You're going to have to do much, much, much better than just saying, "well, I think that's wrong." You're no more justified in your belief than a climate change denier.
Re:What’s interesting about the Florida water system hack is... by eloff on Wednesday February 10, 2021 @10:35PM (#26097989)
Are we taking about drug addiction or food "addiction" here? Because despite using the same word, those are physiologically very different things.

I think I'm familiar with the consensus views. What am I saying that you feel is unjustified?

Re:What’s interesting about the Florida water system hack is... by paddlepop on Wednesday February 10, 2021 @08:55PM (#26097334)
A clinical consensus on whether addiction is a choice? Perhaps you are thinking of a clinical consensus on how best to treat addiction? This is often glossed over by the "addiction is a disease" crowd. The efficacy of treating addiction as a disease does not make it any more "true" as an explanation for the circumstances leading up to it.