Cyberattack shutters major NSF-funded telescopes for more than 2 weeks
science.org
science.org
That's best-practice from the days of yore: where your security team is a group of non-technical, all-powerful dictators. Those don't still exist these days, right? Right?
If security protocols are a pain in the ass generally the security team has been doing a bad job.
Of course a telescope might not have a security team at all.
Cerro Tololo isn't a single telescope, it's a site with multiple ones (nearly every observatory is now), and it sounds like Gemini North (in Hawaii) was the actual one affected, but that they've basically disconnected all the different sites from each to avoid possible infection.
My initial thought was that there are threat actors who just like kicking over the sand castles of “The West.”
However, this seems just a plausible:
> Cybersecurity experts are perplexed as to why Gemini North was the target. “Quite possibly, the attacker doesn’t even know they are attacking an observatory,” says Von Welch, retired lead of the NSF Cybersecurity Center of Excellence.
If it's not, it's a group doing it for practice, the lulz...and under the encouragement (or at least ambivalence) of the Russian or Chinese.
As the article explains: the attackers likely don't even know it's an observatory. Hackers will attack anything they find wide open, and anyone with a public server on the internet knows, they scan the whole internet all the time looking for victims - and they mostly don't care who the victim is as long as it can pay off.
They nerded something that would bring attention from media, but not a major outcry and security overhaul at the real target. A telescope fits the bill: it's not going to blow up or crash down, it has a small staff, and it's not an obscure thing that everyone would ignore in the news.
The problem is many ransomware gangs are opportunistic and will "target you" because you opened a word document or had an unpatched exchange server.
"had an exchange server" - fixed that for you. I mean, after the patch is before the patch, who still runs exchange servers just deserves it, there is occurrence after occurrence that repeatedly show they are not only incapable, but then also more blame others than taking responsibility for their swiss cheese software...
This isn't fun, it is wanton vandalism and you can practice on your own stuff.
I mean, not really. If you go down that route too long you end up with something that has an attack surface so small/specific you'll never see it in the wild. There are almost always unknown variables that you can't know about or control for until you actually encounter them.
Plus, popping your first live box is an ancient rite of passage.
Psychos do exist.
1. Mining cryptocurrency
2. Selling access to a botnet
3. Encrypting and ransoming the computer's contents
All of the above can be done to/with almost any computer on a network, so the intrinsic benefit from hacking extends to just about every computer with a network connection.
This might be a theft disguised as a mere takedown.
I think it's more likely that the attackers simply don't know they're attacking a telescope. It's opportunistic, not strategic.