More technology, More problems

[GostHacked]

http://www.bbc.com/news/technology-27761756

One thing I have been saying for the past few years is the amount of problems that we will have. Our technology is moving at a face pace and in many cases technology just does not exist.

But anyways, smart TVs right? Anything wifi or with a net connection can be hacked and hijacked. At the more ways things get interconnected, the more problems you will see. We are already seeing them.

So these smart TVs are already being hijacked by the cable companies to throw more adverts or other information, or to gather more information about your viewing habits.

Millions of smart TVs can be hijacked by burying attack code in signals broadcast to the net-connected devices, security experts warn.

The attack exploits loopholes in widely used technology that helps smart TVs receive tailored adverts.

Once hijacked, the TVs could be made to send messages on behalf of attackers, find other vulnerable devices in a home or launch other attacks across the net.

Detecting and stopping the attack would be difficult, said the researchers.

The attack uses the Hybrid Broadcast Broadband TV (HbbTV) standard that is widely supported in smart television sets sold in Europe.

The HbbTV system was designed to help broadcasters exploit the internet connection of a smart TV to add extra information to programmes or so advertisers can do a better job of targeting viewers.

But Yossef Oren and Angelos Keromytis, from the Network Security Lab, at Columbia University, have found a way to hijack HbbTV using a cheap antenna and carefully crafted broadcast messages.

That part in bold is something to take note. And now that system can be hijacked.

And in the end, they don't care, and won't fix the problem.

Millions of smart TVs use HbbTV across Europe, and more than 60 broadcasters in the region have signed up to use the technology.

Mr Oren said the standards body that oversaw HbbTV had been told about the security loophole. However, he added, the body did not think the threat from the attack was serious enough to require a re-write of the technology's security.

But when the system goes down, or experiences an attack, they will get a ll uppity about it and do something.

[GostHacked]

The more things get connected .....

http://www.bbc.com/news/technology-30575104

A blast furnace at a German steel mill suffered "massive damage" following a cyber attack on the plant's network, says a report.

Details of the incident emerged in the annual report of the German Federal Office for Information Security (BSI).

It said attackers used booby-trapped emails to steal logins that gave them access to the mill's control systems.

This led to parts of the plant failing and meant a blast furnace could not be shut down as normal.

The unscheduled shutdown of the furnace caused the damage, said the report.

The real kicker is this :

{quote}The attack is one of only a few on industrial systems known to have caused damage. The most widely known example of such an attack involved the Stuxnet worm which damaged centrifuges being used by Iran in its nuclear enrichment programme.

Benjamin Sonntag, a software developer and digital rights activist, told Reuters: "We do not expect a nuclear power plant or steel plant to be connected to the internet.

"To be computerised, but to be connected to the internet and to be hackable - that is quite unexpected," he said.{/quote]

I am not sure if he was not expecting the hacks or expecting facilities like steel plants and nuclear facilities to be connected to the Internet.

[GostHacked]

Here are more problems.

[TimG]

Benjamin Sonntag, a software developer and digital rights activist, told Reuters: "We do not expect a nuclear power plant or steel plant to be connected to the internet.

Nuclear plants and other high risk installations use data diodes to allow connectivity without minimal risk. The diodes use hardware to ensure that network packets can only go in one direction.

http://en.wikipedia.org/wiki/Unidirectional_network

Edited December 22, 2014 by TimG

[GostHacked]

Minimal risk is still a risk. And with a nuke plant, that minimal risk can be devastating.

[TimG]

Minimal risk is still a risk. And with a nuke plant, that minimal risk can be devastating.

Network packets are only allowed to go in one direction at the hardware level. It means that data from the plant can be sent to external operations centers but no one - including authorized operators - can send commands to the plant itself without physically sitting at a terminal inside the plant. Minimal is close to zero risk. The control is done in h/w to ensure no s/w can override it. Edited December 22, 2014 by TimG

[GostHacked]

Is the terminal that access the other systems safe from hacking?

[TimG]

Is the terminal that access the other systems safe from hacking?

What do you mean? The steel plant hack was only possible because the passwords of authorized users were stolen and used to access the plant remotely. The data diodes mean that even if you had the passwords you could not use the remotely. However, someone could, in theory, steal those passwords and then break into the the plant and sit a physical terminal but that risk exists even if there was no connection to the Internet. That said, there are numerous ways to secure the physical infrastructure to make that kind of access very difficult.

[GostHacked]

I don't need to use the diodes directly. Only need access to the systems that have access to the diodes. If those systems are online to the Internet, then the diodes are at risk. You are only looking at the end point instead of the whole chain.

[TimG]

I don't need to use the diodes directly. Only need access to the systems that have access to the diodes. If those systems are online to the Internet

These systems can only send data to the Internet because the diodes block all incoming packets. It is impossible to access the system remotely.

[GostHacked]

How do you control the diode if it does not accept packets?

[TimG]

How do you control the diode if it does not accept packets?

It has two network ports - one for the internal network - one for the external network. Packets are allowed to go from the internal to the external network but all packets from the external network are blocked. This is enforced at a hardware level and cannot be overridden with s/w.

[Moonlight Graham]

Technology solves problems, that's the whole point. Without technological advances we would live far fewer years, be generally less healthy, have less access to free education etc. But yes, it does sometimes create new, different problems. Most of the ones you seem to be talking about is privacy and security concerns, which are serious problems we must solve.

Problems re: hackers is out of my realm of expertise to really comment, but increasing concerns over privacy with technology I believe should mean governments need new legislation to protect the privacy rights of citizens, whereby companies and governments should be forced to abide by strict privacy standards that protects and keeps private ALL identifiable information about technology users unless they expressly opt-in, and whereby giving up such privacy is not mandatory to use a product/service unless it's 100% needed for the product/service to function (ie: a GPS needs to know your location, but that doesn't mean the GPS maker should be able to store & track your whereabouts)

[TimG]

Technology solves problems, that's the whole point. Without technological advances we would live far fewer years, be generally less healthy, have less access to free education etc. But yes, it does sometimes create new, different problems.

Exactly. Companies don't connect their critical plants to the Internet unless there is a real impact on efficiency and productivity. One thing a company can do today to prevent the kind of attack described above is constantly send spear-fishing emails to their employees in order to train them to detect and report. Edited December 22, 2014 by TimG

[Scotty]

The big wake-up call will come when some hostile organization, North Korea or China or Russia or someone else with reach, manages to hugely disrupt either the power or financial or communications system in the West, especially in the US. What happens when the bank doesn't show a record of your deposits, of your account and the ATMs don't work anyway? How much money does the average person have on them? Many have almost none, relying on their debit and credit cards. What if they don't work one day and it takes weeks to sort out the mess? What happens when the power generators all shut down in such a way they're damaged or overloaded and take weeks to repair? What do you do with no cell phones, with no mobile communication? No internet? Who even has maps or phone books any more?

[Bonam]

The big wake-up call will come when some hostile organization, North Korea or China or Russia or someone else with reach, manages to hugely disrupt either the power or financial or communications system in the West, especially in the US. What happens when the bank doesn't show a record of your deposits, of your account and the ATMs don't work anyway? How much money does the average person have on them? Many have almost none, relying on their debit and credit cards. What if they don't work one day and it takes weeks to sort out the mess? What happens when the power generators all shut down in such a way they're damaged or overloaded and take weeks to repair? What do you do with no cell phones, with no mobile communication? No internet? Who even has maps or phone books any more?

Communication systems (the internet) are multiply redundant by nature (there are multiple paths through the network from any one node to any other). Not to mention there are many overlapping systems: cell networks, cable internet, DSL internet, fiber optic internet, etc, and most individuals/companies have access to at least two of these systems.

Individual bank networks and such may be (and routinely are) attacked and overwhelmed, but short of a massive EMP attack on a global scale, or destroying the vast majority of human civilization's electricity production, taking down the whole internet would be quite a feat. Consider that since the internet first came into existence, despite there always being people and groups trying as hard as they can to disrupt and shut down things, the internet as a whole has never "gone down" (as far as I know).

Edited December 25, 2014 by Bonam

[Scotty]

Communication systems (the internet) are multiply redundant by nature (there are multiple paths through the network from any one node to any other).

But there are main backbones, aren't there? Suppose I assign say, 100 hackers to figure a way to take down every one of them? I mean, yes, there are multiple redudancies, but the North Koreans, a pretty pathetic and poor country with a fourth rate education system has, allegedly, 3000 hackers in a building to do nasty things. How many does China have? Thirty thousand? A hundred thousand? What kind of havoc could they wreak on the internet if they were ordered to do so?

And hey, what if you combined that with some physical action. The Chinese have a lot of spies, after all.

http://gizmodo.com/5912383/how-to-destroy-the-internet

Individual bank networks and such may be (and routinely are) attacked and overwhelmed,

What if it's a government job? What if the networks which connect all the banks and credit cards get attacked by thousands of organized hackers with huge computing power working for the Chinese or Russian government?

[TimG]

But there are main backbones, aren't there? Suppose I assign say, 100 hackers to figure a way to take down every one of them?

The Internet was originally designed by the US military to survive a nuclear attack. It can handle a few hackers. The critical network infrastructure is physically protected and geographically isolated.

I mean, yes, there are multiple redudancies, but the North Koreans, a pretty pathetic and poor country with a fourth rate education system has, allegedly, 3000 hackers in a building to do nasty things.

NK was able to breach the corporate security of a single corporation and make its private data public. This is hardly a threat to the entire system. But yes, corporations and governments need to be diligent about cyber security and, yes, there will be attacks in individual entities which will cause headaches. But the system, as a whole, is resilient. Edited December 25, 2014 by TimG

[GostHacked]

It is a threat to the system. Globalization means that everuone is using the same hardware and the same software. How many computers run windows servers and desktop OSs?? Hack one, you can hack them all. Every computer is using the same protocol to communicate with each other, if you can hack TCP/IP (and it can and has been done) all other security measures mean squat.

I would suggest watching a few of the DEFCON hacker conventions on Youtube. The one with the deficiencies in the air traffic control system is quite eye opening.

I will go back to what I been saying to Mike Hardner, if you don't understand the tech, you have no idea how venerable it is, and what risk it is to you as an end user. I've been dealing with technology professionally for over a decade. I am still learning more and more, and I am just starting to scratch the surface. I've heard many times 'it can't happen', then I read a story about it happening.

I would not need to attack the whole net. All I would need to do is take down something like DNS. If you have no idea of the IP for the site, you cannot get there. The net is redundant, but with events of the Arab spring where you saw entire countries taken offline, you can bet it would not take much to do that on a global scale. I keep stressing a cascading event. Now even with 'The Interview' and the bullshit with North Korea, you have seen them go dark. Sure their systems are not grand and might not be as robuts, but you CAN take down networks with simply flooding them with garbage data. This is how DDOS attacks (denial of service) work.

The system is resilient to a certain point. If you can chip away at it, you can eventually take it all down. The faith in it being totally resilient is a false faith.

Everything is connected, and everything WILL be affected. You are already seeing evidence of it. How many times have viruses taken down networks or caused major issues. I've seen it first hand what a simple email virus can do to a large corporation. The email system had to be taken offline for the fix to happen. We were still feeling residual effects of this virus a week later. It was a whack-a-mole scenario.

[Michael Hardner]

I will go back to what I been saying to Mike Hardner, if you don't understand the tech, you have no idea how venerable it is, and what risk it is to you as an end user.

Except you keep forgetting that you ended up realizing that I knew what I was talking about in that discussion that we had. We don't have just one operating system, we have many...

The system is built so that things can be rerouted around problems. Maybe there are weaknesses but as with the predictions of Celente, the doom & gloom angle is more to get attention (and money) for those sources IMO.

[GostHacked]

Its not meant to be doom and gloom, it's meant to be a wake up call to the real reality. Yes you have a grasp on it, but really, ... do you? I thought I did, but over the last month or so, I have realized I do not understand it, therefore I am now understanding some of those threats that were never on my radar.

It can be rerouted, but if you take down enough nodes which require the flow to be routed to other places, then those routes become flooded. And things start to slow down.

The cell network sat system and the internet are ONE in the same. They are all part of it, and all using the same protocol to transmit information.

I could be wrong, but then so could all of you.

[Michael Hardner]

I could be wrong, but then so could all of you.

Can you explain how a TCP/IP hack works ?

[TimG]

Can you explain how a TCP/IP hack works ?

I assume he is talking about this: http://en.wikipedia.org/wiki/SYN_flood

They have written an RFC on preventing it: http://tools.ietf.org/html/rfc4987

And network infrastructure is getting upgraded over time so even if some places are vulnerable that will not be true forever.

[Michael Hardner]

Ok... well calling it a TCP/IP hack seems weird to me. It sounds like a regular DOS attack. As you pointed out, there are ways to defend against it.

[overthere]

What happens when the bank doesn't show a record of your deposits, of your account and the ATMs don't work anyway?

No doubt banks in particular would be hurt if their systems are down for any time at all.

But... it is also true that every Canadian bank has redundant, separate and independent capacity. Computing power has gotten much cheaper, and it is easy for a bank to copy every keystroke at every teller and every ATM in real time in multiple databases. They also all have duplicate operations centers set up near but not too near critical locations. If they lose their downtown Toronto HQ, for example, they can be online again soon enough in a mirror facility in Mississauga. It isn't Bay Street, but in terms of functionality a well equipped warehouse full of desks and computers does the same thing.