Comment by somenameforme | Hacker News Reader

Comment by somenameforme | Hacker News Reader

Parent Full thread

I agree with your premise, but not your conclusion. The problem is not the scope or scale of things, but treating them in an absurdly stupid fashion. Why are power systems internet connected? It certainly enables some greater degree of power and flexibility, but it exposes them to potentially catastrophic outcomes in case of malfeasance. So what happened at some point is somebody convinced somebody else that the security was super duper ultra good, and that's simply not true.

And I'd go one step further to say that it probably can not be true. This has always been true and probably will always be true. All LLMs are doing is demonstrating that. And the LLMs of tomorrow will demonstrate that the most LLM hardened system of today is still just a vulnerable mess. So the conclusion is simple - things should not be connected to the internet unless the worst case scenario from hacking/exploiting is relatively low. If somebody wants to connect their coffee maker to the internet, for one can only imagine whatever reason, then the worst case scenario is a broken coffee pot - who cares, go for it. But connecting e.g. power, water, or other core infrastructure to the internet? No, never.

Just because something hasn't been proven to be a problem today does not mean it won't be a problem tomorrow. We shouldn't learned that yesterday, hopefully we can learn it today.

> Why are power systems internet connected?

Are they?

Yes.

Consider the old joke, "what do you call the medical student that graduated bottom of his class? 'Doctor'".

Same thing applies to sysadmins and IT. Sure there's plenty of skilled people working in facilities out of bumfuck, but also consider how few people want to work in the low-paid, low-respect IT jobs.

Those roles are often filled by the apathetic, mid-skilled, and close in proximity. They're connecting shit to the internet because their boss wants more data points.

Shockingly...yes, and in some cases that is being done intentionally e.g. solar/battery systems require communication within the grid and the Internet is being used as the network.

What makes this particularly embarrassing is that power companies literally run thousands of miles of cables and could easily build a private network instead of using the Internet. The regulations should be amended to require it.

Private networks are not that much of a savior... It is incredibly easy to bridge networks intentionally or unintentionally. Stuxnet is just one example. Even private networks have to be as completely secure as a public one. Worse because it's 'private' people think it needs less internal security because "Why secure it, no one can get to it".

The military's approach to that problem is to use color-coded cables and ports, and we already use things like 802.1x to prevent unauthorized devices from being attached to corporate networks. This is not a novel or unsolvable problem.

>prevent unauthorized devices

Again, STUXNET shows that bugs get into authorized devices really easily. One of the biggest issues is you have power guys that don't know dick about computer security using fleets of laptops that will need a huge amount of training to bring them up to the needed high levels of security.

More so there are thousands of these devices out in the field in power company trucks. All it takes is someone picking one of these up and infecting it for the problems to spread.

It is an insanely hard problem to solve. Breaches happen in military networks pretty often. As a measure of secrecy, they never tell you about it.

I would not call STUXNET proof that this can be done "easily" -- that was joint work by the NSA and Israeli intelligence, who are among the best hackers in the world, and it used 4 separate 0days simultaneously.

While you certainly make a good point about the difficulties that come with securing the laptops and other equipment, the military has the same problem. Most of the users of classified military systems are not themselves experts in computer security. The necessary training is not a graduate level course in security; it is training people to always match cable colors to port colors, to only use laptops provisioned by the organization, etc. The military disables, sometimes by physical means, USB ports on laptops that are used on classified networks to close one of the key security holes Stuxnet took advantage of.

Sure, it is challenging, but this is not impossible to solve. Utilities would have to be forced to do it and they would need time to overhaul their operations, but they certainly can do it, and there is an argument that the NSA's IA division should help (as the electrical grid is a critical for national security). It can be done, we just have to be willing to do it (and pay the cost of doing it).

Reply on news.ycombinator.com