European wind-energy sector hit in wave of hacks
wsj.com
wsj.com
Nonsense. All it takes is "caring enough to put in a bit of effort to figure out how to do it."
The reason we haven't seen them, historically (and IMO...) is that nobody in the "evil hacker space" has generally been willing to attack actual physical targets directly. Over the past decade or so, we've seen a shift from "Only large, well funded actors attack physical infrastructure" (Stuxnet) to "More and more attacks on things increasingly close to physical infrastructure" (various pipeline attacks, the assorted industrial control system malware toolkits, etc). It's only a matter of time until the actual physical stuff is attacked, and this may or may not qualify - it sounds like the administrative side was attacked, but (perhaps?) not the actual turbines. Yet.
The reality of control systems is just like that of anything else "digital" and "microchip" and "connected to a network" - they're not secure against a wide range of attackers, and the only saving grace is that most of them haven't been targeted by a sufficiently motivated adversary.
We, as a general software ecosystem across a range of disciplines, add complexity faster (in hardware and software) faster than we understand and fix bugs. Shipping new things gets people promoted, "fixing weird old bugs in some poorly understood subsystem" doesn't - even if that archaic subsystem is useful to display (poorly encoded and often wrong) Xerox scans. See one of Apple's recent 0days...
If you want a "secure" system for industrial control, it can't be network connected anymore. Yes, it's convenient, and the tradeoff is that someone can and will hack it, some day. Does it matter? Up to you and your company.
But "air gaps" don't work, "Well, we'll use antivirus..." doesn't seem to matter, and "network connected computers" just suck at anything involving security.
Which points to the statement "Serious cyberattacks on industrial equipment aren’t common and take significant knowledge to prepare" being true.
The primary reason probably being that there are more profitable and more easily exploitable targets out there. Why go for the anything but the low-hanging fruit first?
Conflict situations (invasion, war, pandemic) change priorities pretty significantly.
Antivirus btw is useless even in office IT. Baseline yes. But useful no. Any decent professional hacker know the big few and test against them down to try to test whether it is in such env and react differently. Still think network based scanner etc is the better approach. Of course one worry about service denial by fake attack … still …
[1] https://weatherguardwind.com/cyber-resilience-byron-martin/
20 years ago, the blame would fall on "big oil", then it was north korea, now russia...
...and in reality, it might have been an angry former employee who just happens to know all the default passwords set everywhere.
Russia basically gains nothing by doing this, except even worse relations with the germans (it's not like the germans will say "oh, the russians hacked us, we better buy their gas now")
It turns out that all of the hysteria against 5G was an attempt by a psychopathic dictator in the future to end humanity by taking down all of the 5G towers to prevent the sabotage of the wind farms.
Close to heart because I know of a major wind project cancelled in my area due to the government commissioning an 'environmental review' which concluded the whole project had to be canned because it'd endanger a parrot. Meanwhile, the logging continued unabated...
Meanwhile the raptors are still shredded...
Again, I know of projects where that entire angle was just a political one used to cancel wind projects in favour of staying reliant on coal. I liked that parrot too; it's probably doomed anyway due to the fact that destruction of native forests is rampant. How will the raptors do in global warming?
Raptors will probably go extinct first because nutty activists imagine criticism of misguided environmental priorities may be safely ignored because of who brought it up...thus committing a tragic error.
My personal feeling is giant HAWT technology should be banned due to the potential for environmental damage.
The big threats to smaller birds are glass buildings and domestic cats, but they don't get as much discourse.
Same thing for surf beach communities. First time I stayed a few days near a surf beach I was surprised by the penetrating deep rumble of every single set of waves that crashed on the beach.
I think the health issues caused by living near a wind farm would be similar to those experienced by living near anything that the individual has some kind of righteous moral opposition to (read: lack of understanding of).
Imagine a future where airports can only be located 50km from any other civilisation due to the health effects that wind farms are accused of causing. Combine that with 4G being the upper limit of mobile connectivity because 5G was found to be both a Chinese conspiracy for world domination and a radiation health risk.
I'm just saying that it's convenient to just blame russia for everything without any proof.
So, who else?Who has a motive and the capabilities to do this?
Realistically... by stirring the shit up in europe, the country that gains the most is.. well.. USA. Do something, blame russia, make EU economy worse, worsen the relations, make european countries stop production due to energy crisis, sell them american products, and if things get even worse, sell weapons, maybe even to both sides if things get desparate enough, watch europe destroyed again while their own economy gets a great boost.
It seems more of a response/warning to the sending of weapons that has a tiny bit of teeth but not enough to escalate further.
If they consider themselves at war with NATO this attack does make sense.
Realistically... by stirring the shit up in europe, the country that gains the most is.. well.. USA. Do something, blame russia, make EU economy worse, worsen the relations, make european countries stop production due to energy crisis, sell them american products, and if things get even worse, sell weapons, maybe even to both sides if things get desparate enough, watch europe destroyed again while their own economy gets a great boost.
EU <-> Russia relations are about as bad as they can get short of open war, trying to make them worse is somewhere between meaningless and self-destructive for the US. If the US wanted to escalate they have easier ways.
Russia is better off when the alternatives to their energy are poorly performing or nonexistant.
Don't make it more complicated than it is. You can go round-and-round all day with: it looks like A did it, but oh that's what they _want_ me to think, or maybe _that's_ what they want me to think. Really 9 times out of 10 it's the obvious.
It also looked like iraq had weapons of mass destruction and iraqi soldiers were killing babies... but a few years later, it looked a bit different.
This war is just one of the many in the last decades, and the west only cares, because it's the russians doing it and not americans/nato. The world that didn't care about a 20 year long occupation of afghanistan (... and iraq, syria, libya, etc.), because the media didn't tell them to care... now they care, again, because of the media. So yeah... an attack, where russia literally gains nothing and the result is only worse relations seems iffy to me.
They're two hairs away from direct war. You've lost the plot.
This hack attack "attacks" Germany without actually doing any meaningful damage. It serves US interests more than Russian.
>Really 9 times out of 10 it's the obvious.
9 out of 10 hack attacks are attributed on the basis of little more than an IP address and the politically convenient culprit is blamed. It'd be an easy thing to get away with.
The US has little to gain, Germany<->Russia relations are already in the trash. Why bother trying to achieve what Russia already did for you?
The US has a _lot_ to lose and extremely little to gain. If they were shown to be at fault it would be a huge PR win for Russia and would basically tank the goodwill that intra-NATO has gained.
A whipping boy is innocent. Russia is largely not.
> Remember when Russia was our "friend"?
No.
Do that to a couple thousand wind turbines and yes, "better buy their gas now". Even better if you do it the other direction - take the brakes off in a storm, and you get https://www.youtube.com/watch?v=l3tqjuvy7i0.
There's a lot of interest in this sort of thing. https://www.wired.com/story/how-30-lines-of-code-blew-up-27-...
They're _currently_ buying Russian gas.
And they'd be able to prove that how?
The worst thing russia can do to get them to buy more gas, is to directly attack them. Do you really expect them to even talk to russia, if russia did that? Just the outrage (fueled by the media) would make people forgive the government the highly inflated prices of imported electricity, while they fixed the wind production. Russia literally has nothing to gain by doing this, and a lot to lose...
I'm not Tucker Carlson trying to get you to think Russia isn't all bad, but I'm also saying that when it comes to hacking, there could be others involved.
Since day one all Russia has done is sabre rattle about the war.
Unless, as they know, the Russians know, and everybody knows, they don't have any choice in the matter. They can't replace Russian gas imports, and without them their economy would be severely crippled ( as argued by many unions, trade body representatives, etc.).
If I were executing any kind of hack attacks these days I'd consider masquerading as a state actor to be standard opsec.
It is way too tempting to blame state actors for a variety of reasons:
* Public/shareholders will be more forgiving.
* Insurance (as is the case with Sony).
* Makes you seem more competent if you "know" who did it straight away.
To add to that, once youve picked your culprit you kind of have to double down on it which means embarrassing evidence to the contrary uncovered later will be swept under the carpet for fear of humiliating everybody who said it was [ state ] when it was [ script kiddies in a basement ].
Thus masquerading as a state actor offers a decent amount of protection for a non state attacker coz once attribution is locked in the motivation to track you down evaporates.
War is not a pre condition.
Who attacks wind farms for fun anyway?
It is clear that the attack is politically linked and economically motivated.
“Machines displayed codes that looked like hieroglyphs, Mr. Brandt said, indicating servers had been encrypted with malware.”
Nice rabbit hole...
I'm glad Tesla seems to leverage an experienced team like canonical for their basic software, I'm deeply concerned about the whole yocto derivatives world. It's random luck if your car software has regular security patches or not.
Which vendors other than Tesla have the capability to roll security updates quickly? From detection via test out to the fleet? Which have security know how on par with, say, Russian hackers?
North Korea has been behind a ton of crypto hacks and thefts, and they're simply ignored. The Russians attacked Colonial Pipeline, and they're simply ignored. There's a list as long as my arm. For whatever reason we've decided cyberattacks are not war.
1. A malicious actor is abusing the scenario, but everyone thinks "If it was set up properly in the first place that wouldn't have been possible." Victim blaming in a sense.
2. Attribution is hard.
There is likely more.
I think as long as people are not killed it's not war.
There was very little international reaction at the time, which probably emboldened the Russian takeover of eastern Ukraine. But now Dutch artillery is being shipped to the Ukranian army.
If they did enough damage in the physical world, it's possible they would be. But, since we had to read about these "hacks" in a news article about hacks rather than in, say, a news article about widespread blackouts in Germany, it does not appear that these did all that much damage. Problematic, for sure, but mostly at the nuisance level compared to, say, lobbing missiles or shooting people.
"As soon as you can" is very rarely the best timing. Preparation is key.
This is where the NSA's of the world have the dual purposes of securing internal infrastructure and finding insecurities in any and all non-internal infrastructure. For the internal stuff, there is tension on disclosure if the same security holes are present externally as well.
Whether this adversarial attack is what's happened in this case, who knows. The timing is certainly interesting, but you also can't rule out false flag operations to justify other countries 'entering the conflict'.
In a contest. Not at war.
Decades of fighting guerrillas has left us loose with words. Tanks rolling past Kyiv should remind us of the bright line between annoying and engaging an enemy.
[A proxy war relationship] usually takes the form of funding, military training, arms, or other forms of material assistance which assist a belligerent party in sustaining its war effort.
I'm not complaining about that, mind, but it's not like it's surprising or unfair that they'd try to hit us in limited ways, if they can.
Day one of the invasion I double checked our backups (ahead of schedule) and security. And the company I'm with isn't at all involved with anything military, nor do we have any particular interest (business-wise) in Ukraine—some kind of mass automated attack still seemed likely enough to be worth a little of my time. I assume CISOs with infrastructure and military orgs were on a war footing before the shooting started. At least, I hope they were.
Proportionality. Weapons are being shipped to Ukraine for use on Ukrainian territory. Not Russia. I don't know if explicit red lines have been drawn. But the Moskva was sunk by Ukranian missiles [1]. And I believe the cross-border raids were done with Mi-8s, not the Mi-17s Kyiv’s been provided by the West [2].
If Russia wants to open its territory to retaliation, that's its choice. But it would be one more blunder in a series of idiot moves. (To be clear, this story looks like Russian criminals being Russian criminals more than anything state directed. If we didn't have the backdrop of the war, the headline would probably mention Bitcoin.)
[1] https://en.wikipedia.org/wiki/R-360_Neptune
[2] https://www.washingtonpost.com/national-security/2022/04/20/...
We've established this precedent over decades in earlier proxy wars like Vietnam and Afghanistan where the US and USSR armed each others opponents. It certainly doesn't make the supplier an 'effective war participant' as you stated.
This was even true when the US and USSR sent actual personnel in as 'advisors' or combat pilots, even though that is direct involvement. It's not a casus belli.
Yes yes, russia, current year, politics, government actors,... but again... why is it connected to the internet in the first place?
I'll give you points on security concerns but your other comment is borderline ridiculous.
In terms of internet needs - there are many reasons that renewable assets need internet connectivity not strictly forecasting and it isn't unreasonable to be able to get secure connections.
Did they though? From what I read they only lost remote control and the wind turbines continued to operate in "auto mode".
Given stormy conditions you maybe could break some wind turbines remotely by somehow disabling their brakes/turning them into the wind, but if you only brick some electronics on a normal day, that's an easy fix. They're not complicated technology and replacement electronics/expertise are readily available.
The funding coming on my back out of my labor and my taxes.
Is this the democracy which started when it forcibly overthrew the elected government, banned a number of political parties right after that, and which just banned the second largest political party recently? Some democracy.
The "elected government" which restricted rights of speech and protests, ordered police to open fire on protesters killing more than 50 people, and then fled to Russia.
>and which just banned the second largest political party recently
The head of that political party is Victor Medvechuk, a close associate of Putin who proudly claimed that Putin is his daughter's godfather, who was charged with treason and put on house arrest a year ago for funneling money to the DPR / LPR whomst Ukraine has been at war with for 8 years, and was recently captured while attempting to flee the country in a stolen Ukrainian military uniform after escaping his house arrest.
And the point of it, for those that don't know, is to remove the last shreds of legitimacy from any BS referendums Russia might try to hold in occupied territor, in which a minor pro-Russian politician whose party had low-single-digit support in previous elections is suddenly "elected".
> Is this the democracy which started when it forcibly overthrew the elected government
You just parrot a blatant lie by Russia
I'm not a big fan of my country's military spending, and it's probably trivial even in terms of percentage of GDP, in comparison to that of the US, Russia or China.
In terms of regime change "approach", if the US did manufacture the overthrow of the previous Ukraine government, it has the appearance of a much lower cost of human life than the approach Putin is taking. And I'm no fan of the US' "manifest destiny" ego trip but I don't want to get too far into whataboutism.
It's politically interesting (cringe), the line between assisting Ukraine's defense by sending weapons and funding as opposed to actively committing troops and implementing a no-fly-zone etc. Interesting that Russia is now accusing NATO of effectively conducting a proxy war against Russia - it seems that Russia wants to have war declared upon it in order to post-justify their invasion as "see, this is what was going to happen anyway" - it doesn't have to make sense to anyone other than the Russian leadership in order for them to be assured of the righteousness of their own cause.
Energy independence used to come up more often in US elections until prices collapsed in 2014ish and the US became a net exporter of refined petroleum products. The whole “Nuclear Renaissance” that began under W. was derailed by insanely cheap natural gas production, so it just kinda fell off everyone’s radar since people in the US considered the problem solved for the time being.
Nobody could make the hard choice and they hoped that technology would solve the issue eventually - which to be fair, it did look like that was going to happen.
On the other hand, we have this situation. In my country natural gas prices have risen 40% in the last month and some items in supermarkets are close to double what they were a year ago.
It's probably always been like this in politics though.
Switch to renewables is such a huge win for everyone (less oil producing nations). Cheaper, cleaner electricity (unlocking new manufacturing capabilities on price), lower social unrest impacts from climate change, better water quality, less reliance on foreign oil, etc. Costs are now starting to hit the point where it's far cheaper to go renewable - if we could get some political will power to push us further we could get continued wide spread adoption and massive scale up.
(The German nuclear shutdown looks extremely bad in hindsight, though)