Cyber Security: A pre-war reality check

What kind of diplomacy would have prevented Russia from invading its neighbours?

I mean you're either in a war period or a pre-war period ...

Although yeah the whole propping up non-democracies because they have cheap labor or cheap materials for decades does seem to have been a poor decision in the long run.

I wasn't expecting to see land wars in Europe even before the cold war ended.

You are the ultimate example of your own statements. Take another look at history and tell me again that war in Europe is a surprise.

Not exactly the first post cold war european land war either

Not sure I entirely agree?

#1 > Or disable a hospital.

The entire Ascension Healthcare system of hospitals (142 hospitals, 2600 total facilities) in on divert since 8 May because they had to switch back to paper records. Change Healthcare has lost $872M since it was attacked in February.

Maybe it's more like the pandemic: seems like nothing, unless it affects you.

https://en.wikipedia.org/wiki/Ascension_(healthcare_system)

https://www.wired.com/story/change-healthcare-admits-it-paid...

#2 > Does your stuff need computers working 5,000 kilometers away? [implying that's bad]

What if you live on the Gulf Coast, exposed to hurricanes? You want compute resources warm and ready far away from that region. After Katrina, the Tulane medical school was able to re-form quickly because the noteservice was running a bulletin board forum on a VM in Romania. Everything else was underwater.

#3 > This is the sound-powered phone

Have you used a sound-powered phone? I managed damage control in a ship. Sound powered phones barely works. And the coordination system to actually fight that fire requires radios and making overhead announcements that definitely depend on electrical power.

#4 > They tried to sort of renew this emergency telephone network

When the entire San Diego region lost power during rush hour for 4 hours in 2011, the cell phone system still worked. I was able to email documents to Tokyo from a car despite no traffic lights.

#5 > Because if the cable to the US is down

Sure, but there are a lot of disasters where the cables are fine. Graceful degradation is all about having widely distributed options. Lots of people have What. Signal is even better for people with more serious responsibilities, IMHO. And, friends, if you think IP networks are vulnerable, get yourself a starlink terminal and a HAM radio license.

https://en.wikipedia.org/wiki/SpaceX_Starshield

Trains use a variety of sensors for odometry. Losing one of them is not catastrophic.

Railroads...

Railroads can now outsource train control. Wabtec's "Wabtec Cloud Positive Train Control Communication Solution" - "A complete turnkey hosted office solution for I-ETMS-based Positive Train Control (PTC) systems"[1] (Wabtec used to be Westinghouse Air Brake.)

Wabtec has had break-ins, but claims they only involved employee info, not control systems.[2]

[1] https://www.wabteccorp.com/digital-intelligence/signaling-an...

[2] https://industrialcyber.co/ransomware/wabtec-suffers-data-br...

Railroads should absolutely use GPS. They also should supplement it with local transmitters, like aviation does.

They should have lots and lots of local transmitters.

As an SWE I do agree somewhat with what you say but this story is not complete. If you look at the attacks on Ukraine and the cybersecurity damage done it was fairly small in the grand scheme of things. Another important thing is that Microsoft helped them to fight back as well, so it was not a terrible investment. Was there any quantifiable risk assessment done to understand the potential damages if Russians carried out similar attacks in the Netherlands?

You talked a lot about how bad it is for governments to outsource stuff to Huawei and a handful of US clouds, but didn't really touch on what drive all those decisions beyond claiming it's due to non-technical leadership. It'd be great to see a somewhat deeper analysis than that in future. There are plenty of tech companies that also outsource a lot to the cloud, so it has to be more complicated than that, and there are European mini-clouds that don't get much love from European governments also.

The basic problem is fundamental: outsourcing is a very common thing you find in all walks of life, it is often the most reasonable choice due to comparative advantage. This is the reason I eventually gave up on "decentralization" as a worthwhile technical goal (after years spent working on Bitcoin). Everyone is trying to outsource everything that isn't their key competitive advantage, and that's because specialization is the heart of progress. The costs of centralization are obvious in terms of loss of resiliency, but when people aren't actually needing that resiliency for entire lifetimes it's hard to convince anyone to take the loss of progress that decentralization may appear to entail.

So what to do? As you found with your 1,600 line imgur alternative just starting over to make stuff be secure is ... hard. You wrote in C++ (not the most security conscious choice) and some of those vulnerabilities are very basic, like the one where you discover that due to a bug some users are getting empty passwords. You also sort of assume that your users will keep your app up to date, but we know they won't. So simply demanding programs be smaller isn't going to work. You'll just speedrun the history of vulnerabilities. Indeed, one reason to outsource stuff to a handful of giant providers is that they do a much better job of security overall. Yeah Microsoft may have problems with Chinese hackers, but government IT routinely has problems with greedy teenagers. So MS is still ahead of the pack.

IMO the most critical thing is really whole-systems analysis to find sources of unnecessary complexity and fix it. That won't necessarily turn the tide, but it can at least help. As a trivial example, HTTP stacks don't understand the concept of load balancing. They're still stuck in a world where every website is run by a single computer. That entails a lot of server-side complexity like dedicated LBs, maybe even DNS LB, replicated databases, health checks, drain periods etc just to avoid users seeing little dinosaurs due to normal maintenance. The complexity of this is overwhelming. When users accepted things like "This service will be offline on Sunday due to maintenance" you could get away with it but now people expect everything to be 24/7, so that complexity drives people to the cloud where it's somewhat handled for them.

Thus an obvious quick win - extend HTTP and DNS to understand IP address globbing and maybe even static route matching. If a connection to a server fails, have the stack transparently fail over to another one. Now you can scrap your server side LBs and reverse proxies but still have an HA service.

What were the vulnerabilities in your 1600 lines imgur alternative?

First, thank you for the article and discussion.

Do you have any thoughts on the role and practicality of deterrence in this space?

Is there a video version of this available?

No questions, but as a security person, I found this to be aligned with the view of many of the people i consider to have a good pulse on the warfare side of security. You're certainly not alone in these thoughts and efforts to fix.

This is off topic, but I’m idly curious about the history of shipbuilding regulatory changes after the Titanic. Where did Brenno de Winter learn about them?

Very good. Well said and most enjoyable.

Not a question.

However as a fellow european, having worked for large "national/eu important companies", this article resonated a lot with me and my frustrations. Granted I don't do anything "security" related.

Everything in "it infrastructure" has been outsourced to India, at best Poland. You have competent people in eu offices that don't have the power to use their own hardware. You have to beg for weeks to barely skilled ticket masters from outsourcing companies, endless meetings.

All eu staff is relegated to feature factories or process managers. Zero ops. "It's not our core competency."

I refuse to ever again work for the large "of national security" european companies. It's soul crushing. And it is very clear nobody cares.

It hurts me everytime I read how tens of billions are allocated for whatever EU soverignity. I have been in way too many 10 managers 2 engineers teams with way too many long meetings begging teams from $indian_outsourcing_company to let me do my job.

Good to see there's still some people vouching for old-school programming virtues. Among all the capital-driven centralization, scaling and complexification dominating the conversation I thought I was going crazy...

They do have other ways to navigate. Like land-based beacons (VORs).

Unfortunately these are being used less and less and even deprecated in favour of GPS waypoints. Even when they are still around the pilots have less experience with them because they no longer use them every day.

GPS is now often unavailable in eastern/northern parts of Europe due to Russian jamming. Some smaller airfields already had to update their systems not to rely only on GPS.

I was under the impression that GPS was a non-critical asset for aviation, ie. any plane can safely stop using it at any given time and keep flying with VOR and other navigational aids.

This article [1] introduces some of the scenarios where pilots rely on GPS only:

* GPS-based waypoints to optimize routing based on favorable winds and more direct routes even in the absence of VORs.

* RNAV departures and arrivals that rely "solely on GPS rather than radio-based [...] aids" with more precise spacing and hence higher capacity.

* GPS used as a substitute of ILS for some approaches e.g. in mountainous areas.

[1] https://simpleflying.com/gps-in-aviation-pilots-guide/

GPS is only one of three currently deployed satellite positioning systems, why aren't planes using the others?

Well US is not dependent on anyone for her Energy needs. Unlike China. Its quite vulnerable on that front if a few pipelines blow up ala nord stream.

This is also why the US has such a large presence in the middle east.

It seems like a reasonable assumption to me that major world powers probably have enough 0-days at any one time that they could use them together to format a significant proportion of the world’s computers and phones.

If that is true, then how come we have not heard much about erasure of data on phones and computers in Ukraine by Russian hackers?

Please don't say that the Kremlin is holding its 0-days in reserve for a more serious conflict! the Kremlin sees the Ukraine situation as extremely serious for Russian national security. It uses large numbers of missiles costing over a million dollars each to degrade Ukraine's electrical grid. It has attempted to assassinate the president of Ukraine many times. Why wouldn't it be all-out trying to do as much damage as possible to Ukraine through cyberattacks?

I wonder if we, in secret, have “mutually assured destruction” of cyber-warfare.

Low-orbit nuclear EMP would be that option. Not cyber... technically.

Everything is computerized now. And most adjacent power wars will most likely be non-nuclear in nature until it crosses a red line.

The day to day problem will mainly exist because our computer systems are down.

The underlying assumption of e.g. food distribution are that a certain part of infrastructure remains intact. This assumption comes into greater question the more individual parts are dependant on large software installations.

E.g. some countries have an entire redundant telecommunications network for government functions precisely so that it can actually withstand such a scenario. The more enmeshed that infrastructure is into other systems the more likely it is that it too will fail.

We need to prepare to not be destroyed on the cyber front brings us closer to war? Hard disagree. In a world with sharks, you don't make having to battle a shark more likely by looking less like prey.

Not preparing brings us closer to someone (Russia, China, Iran, ISIS, Al-Qaeda, whoever loses the next presidential election) being able to blackmail society with war-like consequences if we don't do what they want. Worse, more than one adversary could have that level of blackmail on us at once. That's the kind of situation that free peoples fight wars to get out of. And the ones who won't, aren't free for long.

If you consider "not fighting wars" to be more important than "being free", there is nothing more for me to say. And if you think that being free will endure without fighting wars, I think you are hopelessly naive.

Cuba would be the most resilient nation on earth I’d guess

Yes. Front analysis [0] and also critical path analysis are useful.

Real graphs look like social networks, with some clusters and nodes with very high relational degree, and some with almost none. But for security they are more like dependency graphs rather than just attack paths as in Blotto. An adversary blockades/sabotages them or blocks those on which they depend etc. The more resilient graph is the best connected by alternative paths. Go back and look at some DARPA papers on route security in the formative "Internet".

What we have today are very insecure graphs with millions of logical dependency links going in/out of single centres of functionality, and not much peer connectivity.

Hit a few critical nodes and the whole lot goes down.

[0] https://en.wikipedia.org/wiki/Blotto_game

My colleagues and I submitted a similar talk/paper for a different NCSC conference (but weren't accepted). I see that this talk by Bert Hubert covers mostly the ground. so I am pleased, but worried about what this take misses out.

Hubert is addressing much of the ground that lies between security and resilience.

Our emphasis is on how mitigation lies in education and autonomous systems over regulation. Not that regulation is wrong, just that it doesn't work as a stick without a carrot. We also looked at timescales and how so much is already too late because of the lag-time from drafting to efficacy. And what I know from hanging out here on HN is that technologists appear hostile to regulation, but giant companies love it so long as they get to write the rules that give them more monopoly power.

Where we went wrong I think is lack of political tact. Hubert stops himself from even finishing off the remark about the quality of Microsoft products. But I don't think the real problem can be ignored for much longer. Instead, we went all-in and emphasised (as previously here [0]) that "Big Tech is the cybersecurity problem" (as Bruce Schniere recently echoed) because it pushes (in addition to highly centralised single points of failure) an irresilient "insecurity industry" that is based on protection not security.

Hubert's talk doesn't get to the key issue;

Security and protection are not the same thing.

Protection leads to dependency that ultimately erodes real security.

However "protection" is easy and profitable to sell. Real security is not.

That is ths succinct way in which it must be put.

If the intel appraisal is accurate and we are entering a serious war footing than we can have no more patience for the profitable but dangerous "insecurity industry" that gives an appearance and simulation of security, without the reality.

[0] https://techrights.org/o/2021/11/29/teaching-cybersecurity/

Knowing how frail software out there really can be, I made moves to Qubes OS and GrapheneOS as my primary operating system distributions over a year ago. Haven't looked back since the first month!

PC users should be using some kind of segregation like VMs these days; you most likely don't have a MAC policy protecting your files from your porn site bunker-busted browser, so your data is likely going up the pipe to North Korea (but you did make sure to be a user so at least it can't install the printer driver wrapped rootkit).

Looking at the XZ attack from last month, a lot of people that write software have no idea of the depth their software is being used in secure systems.

The reason I personally think Stuxnet is so interesting is because of it's reach. The goal was so specific and it accomplished it while infecting lord knows how many machines (but I bet Wikipedia knows).

Impact wasn't massive by any means, but the scope of the project will always impress me.

Stuxnet was a very graphical demonstration of the possibilities. Even if the results weren't that great, it demonstrates to nontechies the expensive real-world consequences of 1 usb stick with malware.

I understood the hole in the ozon layer was similar. Even if the actual danger of it was probably overrated, it made people imagine how we broke earths radiation shield and would be hit by all kinds of nasty space radiation. This resulted in real world policy changes.

Non-technical people should be stopped.

Cybersecurity 'good actors' are centralized, proprietary and bounded.

IME the main problem is that, with rare exceptions, building secure products is seen as a distraction that is best pawned off to the cybersecurity team. And that cybersecurity team is more often than not fairly light on actual product development engineering talent. So they do what they can, which is mostly buy yet another tool from the thousands of vendors hawking The Answer, the final service you need to buy and then you'll be secure.

Which to anyone who has built secure products, should obviously sound like nonsense. Because it is nonsense. Most of these tools are mildly useful (some useless) but not that great. They're certainly not The Answer.

To build secure products you need to actually make it a tier one requirement and design it in from day one. It's as simple, and as difficult, as that.

This is definitely one of the best submissions I've seen on HN.

I don't think it helps with the ranking, but you can still favorite the thread.

TFA:

Ukraine was already at war for two years and battle-hardened. So anything that was simple to break was already broken by the Russians. Then after two years, the Russians managed to break Kyivstar, one of the biggest telecommunications companies of Ukraine, This was a very destructive attack. But the Ukrainians (in and outside Kyivstar) are good enough that in two days they were back up and running, because these people were prepared for chaos. They knew how to restore their systems from scratch. If we get an attack like this on VodafoneZiggo or on Odido, and they don’t get external help, they will be down for half a year, because they don’t know anything about their own systems.

Not to be confused with Bert Kreischer, the unfunny comedian.

blush :-)

If COVID-19 didn’t move the needle on how dependent we are on foreign countries to do our scut work.

I believe the search-term you are looking for is "Friendshoring".

"Some companies and governments pursue friendshoring as a way to continue accessing international markets and supply chains while reducing certain geopolitical risks... Bonnie Glick first used the term "allied shoring" at the start of the Covid-19 pandemic, while serving as the deputy administrator of the United States Agency for International Development... The new U.S. Trade Policy, including USMCA and IPEF, complies with the Friendshoring arrangement." [1]

[1]: https://en.wikipedia.org/wiki/Friendshoring

I think what is missing from this analysis is the offensive capability of American cyber.

The way it is completely downplayed I suspect is proportional to its strength.

If there was all this chatter how we need to invest more in offensive cyber I would be worried. The way we pretend like it doesn't even exist is all you need to know.

It's really bad right now. I've learned to not stir the pot over the years. Unless you're primary role is security it's best to go with the flow. I've seen some massive security holes at every company I've worked at. As long as the boxes are checked for insurance, they don't care.

(author here) You might be interested in my writing on this very subject -> https://berthub.eu/articles/posts/cloud-naive-europe-and-the...

Thanks!

Well, every major city being eliminated by a nuke would also hamper these systems in a total war between developed countries.

At least in my education, the Therac-25 incidents [0] featured pretty prominently as an example of software overconfidence.

https://en.m.wikipedia.org/wiki/Therac-25