Hacker News Reader

Comment by SahAssar | Hacker News Reader

> I've been a vulnerability researcher since around 1995. I feel significantly better about security today than I have at any point in the past.

Do you really feel that way considering what is internet (or other accessible networks) connected today compared to 1995?

Personally I feel the opposite (although I haven't been in the game as long) because of a lot of critical infrastructure is getting connected without a lot of security. A lot of surveillance cameras, door stations, networks that in 1995 would be localized failures are now national or global. People find open, password-less VNC into control panels for powerplants just by scanning the internet. Equifax, Turkeys MERNIS and on and on and on.

I don't get the sentiment that things are getting better in this area.

View on HN

The security is definitely better than in the 90s, for what I've heard. The impact of an attack is however greater. You can literally shut down an entire country today, something you could not do back then.

Documented state-level kinetic computer security attacks go back a lot further than you think they do.

Is there prior art before alleged sabotage leading to pipeline explosion in 1982? [1]

Zetter's Countdown to Zero Day points to that with skepticism and also talks about Kosovo as one of earliest cases, as does Sandworm.

Do you think this is roughly correct?

[1] https://en.m.wikipedia.org/wiki/At_the_Abyss

I'm thinking about Kosovo.

Yeah, that's what I meant. The security might be better, but the attack surface and attack impact has grown a lot faster than than the overall security.

I'm sorry, but how do you literally shut down a country? Hyperbole much?

Hack the power grid or core network/telecom infrastructure.

See also: suspected Russian attacks on Estonia related to the a statue being taken down

https://en.wikipedia.org/wiki/2007_cyberattacks_on_Estonia

I suppose if I point out a government hit by ransomware and forced to run with pen and paper just last year[1], an attack on a nuclear power plant which could have been targetted at power generation[2], an attack taking down 1/5th of the world's ocean freight and a company with enough annual revenue to be in the top 100 countries by GDP[3], or a classic software bug taking out power to 45 million people in the USA for two weeks[4], you're just going to claim those aren't important because they didn't "literally" shut down every operation in an entire country, or weren't deliberate attacks trying to do that, and therefore they aren't evidence that it could happen?

[1] https://nunatsiaq.com/stories/article/government-of-nunavut-...

[2] https://en.wikipedia.org/wiki/Stuxnet#Iran_as_a_target

[3] https://www.forbes.com/sites/leemathews/2017/08/16/notpetya-...

[4] https://en.wikipedia.org/wiki/Northeast_blackout_of_2003

Reply on news.ycombinator.com