Panetta Warns of Dire Threat of Cyberattack on U.S.

http://www.nytimes.com/2012/10/12/world/panetta-warns-of-dire-threat-of-cyberattack.html

by 001sky • 14 years ago

49 40 14 years ago

nytimes.com

chunkyslink• 14 years ago

> They could derail passenger trains, or even more dangerous, derail passenger trains loaded with lethal chemicals.

Why are passenger trains loaded with lethal chemicals in the first place?

ktizo4• 14 years ago

Due to the recession, the train companies have taken to making money on the side by turning every fourth carriage into a traveling meth lab.

DigitalSea3• 14 years ago

This comment reminds me of an awesome episode of Breaking Bad in season 5, I won't ruin it but those who've seen it will know what I'm talking about. Are these passenger trains carrying Methylamine by any chance?

pav3l• 14 years ago

Even worse! They could derail passenger trains loaded with lethal chemicals and nuclear weapons!

ktizo4• 14 years ago

And lions and tigers and bears! Oh my!

jrockway• 14 years ago

And, these nuclear weapon chemistry lab trains could derail ONTO CHILDREN. Won't somebody please think of the children?

(And BTW, trains derail even without evil cyber hacker criminals. First YouTube result: http://www.youtube.com/watch?v=xCbOUgr_r-E)

gfodor• 14 years ago

Saddam did it first with his mobile rail-based chemical weapons labs.

mturmon2• 14 years ago

Mock him if you must.

Panetta raises the issue that a combination of attacks could cause loss of life and a new sense of vulnerability among the public. (From the article: "...would cause physical destruction and the loss of life, an attack that would paralyze and shock the nation and create a profound new sense of vulnerability.")

The last time the public had that sudden sense of vulnerability, on 9/11 of course, there was a tremendous and partly counterproductive reaction that we're still dealing with.

It could be smarter to put in place laws to force private companies to report cyberattacks, so the government can understand the scope of the problem, than to pay for the reactive spasms that would follow a successful attack.

ktizo4• 14 years ago

“I’m not sure they’re going to volunteer if they don’t feel that they’re protected legally in terms of sharing information. So our hope is that ultimately we can get Congress to adopt that kind of legislation,”

Translation: Before we loot their databases, we have to reassure them that they are not liable.

drzaiusapelord• 14 years ago

The money wasted on these pork bills and civil rights violations that will probably pass with flying colors regardless of who wins the election could be better spent buying every 0day for sale. Imagine a few billion in a fund just for buying zero days for sale and forcing the companies with the vulnerable product to tell its customers that it had vulnerabilities and that they've now been patched. Heck, tax companies that write insecure software more.

Instead, we'll see some federal guidelines that do nothing but enrich connected defense IT contractors milking the endless cow of defense spending.

001sky2• 14 years ago

relevant > http://www.washingtonpost.com/wp-srv/special/local/highest-i...

rsync• 14 years ago

I wish that every headline of this type had windows in parentheses ... "Panetta Warns of Dire Threat of (Windows) Cyberattack on U.S."

How many years ago were we up on that stage at defcon while bo2k was demoed ? And 12 years later nation states (Iran) are getting owned by the same old autorun.inf.

ohashi• 14 years ago

Humans are still humans. Software security can increase but people are still weak and convenience versus security is a common trade off.

ynniv2• 14 years ago

What the hell is a "defensive" "cyberweapon"? Are we going to shoot down an incoming SSH session? Poison a compromised SSL session? Like screaming aircraft in space, these people have no idea what cyber warfare looks like.

How do they expect to defend against it?

stephengillie• 14 years ago

I'd use honeypots. Or maybe write viruses designed to infect and nullify IRC sessions. Or write viruses which install software updates and patches.

Wait, no. I'd call tptacek.

ktizo4• 14 years ago

How do they expect to defend against it?

I'd start with good design and engineering with due diligence, multiple redundancy, identification and delinking of potential failure points and well trained and equipped emergency response teams.

But they'll probably just hire lots of goons and get them to sit on facebook and stalk the insane.

rdtsc2• 14 years ago

He admitted he is pushing a bill, and in all probability, there is a defense company that is selling some network monitoring, firewall-ing, or anti-virus software has probably asked for his "help" and is "sponsoring" both him and the bill

mtgx• 14 years ago

If you look closely at what they are proposing, the new bills and the new budgets almost always go into "offensive cyber capabilities" not defensive ones. So while they keep the fearmongering about cyber attacks, all they are doing is building better weapons to attack others themselves, and has nothing to do with protection, which also creates a loop where if the US does get attack because the networks are not protected, they get to demand for even more funding, and continue the cycle.

ynniv2• 14 years ago

Exactly. This is a ploy to spend money building our offensive weapons. Pork for a campaign contributor, sharp sticks for the intelligence agencies.

JoachimSchipper• 14 years ago

Good network monitoring, clever firewalls, that kind of thing. "Cyberweapon" is a bandwagon, of course, but there are devices and services that you can buy that do tend to make networks more secure, and having more of those is not a bad thing.

My employer sells a device that permits one-way connections only: http://www.fox-it.com/en/products/datadiode/. The "one-way" part is trivial, of course - the clever part is in making standard protocols work over such a link.

OldSchool• 14 years ago

I think we can safely assume that these bureaucrats know nothing at all about Cyber-anything. I don't think we even need to ask where this statement ultimately leads. It leads to a total loss of internet anonymity. It may take a generation for that to be a given, but that's clearly the goal. That goal provides about as much value to the nation as the "war on terror." The end of the cold war sure left quite a vacuum. It took about a decade to find something to take its place.

ck2• 14 years ago

Well then take those systems off the internet. Problem 100% solved.

Why the heck are they on the internet in the first place?

catshirt2• 14 years ago

unfortunately i think 100% is quite an overstatement. (given that we're talking about people dying, and all).

catshirt2• 14 years ago

i'm sorry. the downvotes would suggest when your network is not connected to the internet you are invulnerable to cyber attacks? lol

rdtsc2• 14 years ago

Now taking them off the internet is not going to sell overpriced, over-engineered, ineffective products designed to "fix" these "issues" ;-)

If Panetta is talking about specific "cyber-defense" capability, L3, or Lockheed (etc.) probably already have a product in the making and fulfills some of these requirements. They just need the law to be passed and the purchase order signed.

mrpollo• 14 years ago

I get your point but, while offline you could still get infected via physical media USB, CD, FLOPPY.

What I'm trying to say is that if a nuclear facility got hit and their machines where offline (from the internet) its still possibly to infect the rails using the Stuxnet attack vector.

But yes the claims are sensationalist, a better solution would be to increase security protocols and make standards out of those and have companies follow those in a more strict way.

mcantelon• 14 years ago

Modern witch doctor has things he wants.

DigitalSea3• 14 years ago

I have a genius plan to protect computers and networks from cyber attacks, I plan on selling it to the Government I really think it's a good idea. My asking price will be at least $1.2 billion for a minimum 10 year contract, but I'd be willing to negotiate a little bit to stay competitive with competitors like Lockheed.

1) Disconnect any computer from the Internet that controls anything that can be compromised.

2) Keep the computers disconnected.

BAM! no Internet connection, no cyber-security threat. Now if you'll excuse me, I'm just going to fire up my Ubuntu terminal and derail a passenger train full of chemicals whilst simultaneously breaking down a dam wall in another terminal window.

Seriously though, I think we're all doomed if dams, nuclear reactors, airports and passenger train networks are as accessible from the Internet as Panetta says they are in the first place...

fictorial• 14 years ago

I wonder if autonomous Internet surveillance understands sarcasm. You're probably on some watch list now, sad as that may be.

DigitalSea3• 14 years ago

I thought the exact same thing as you after posting and re-reading my comment. If they come after me, I guess I'll have to open up another terminal window and hack into their car computer system and make them drive in the wrong direction, after I hack all traffic lights to slow them down of course ;)

JakeSc• 14 years ago

Unfortunately, it's not that simple. Stuxnet showed us that offline networks can be attacked and have real-world consequences (e.g., exploding enrichment plants).

Almost all of our critical infrastructure is offline, and many of our infrastructure companies air-gap their critical networks. Yet we are all still vulnerable simply because we are using computers.

aidenn0• 14 years ago

Good thing we didn't provoke Iran by attacking with cyber-warfare.

pseingatl• 14 years ago

I have a friend who works for Saudi Aramco. They tried to play down the effects of the attack, but they had to replace 30,000 hard drives. My friend's work for the past year was wiped out. The only people who were saved were those who made local back-ups on USB drives which were not connected. In most large companies, there are strict rules about connecting personal hard drives to the company's network, but in this case, those who violated the rules were able to survive the attack best. Back-ups were compromised as well. It is not clear why Aramco did not have back-ups which were offline and accessible.

capex• 14 years ago

Probably spoken for the law makers.

crayola• 14 years ago

Since when is it ok for a US official to talk about China and Russia as "adversaries"?

haspoken• 14 years ago

This article appears to expose a serious violation against the International Olympic Committed by the inappropriate use of "Olympic Games".

While it is possible that a proper license was obtained, it seems extremely unlikely that the IOC would permit there trademark to be used for an operation instigating a terrorist attack against one of its members countries and I am currently unaware of the IOC adopting hacking as a completive sport.

The article states "Mr. Obama ordered sophisticated attacks on the computer systems that run Iran’s main nuclear enrichment plants, according to participants in the program. He decided to accelerate the attacks, which were begun in the Bush administration and code-named Olympic Games,"

Panetta Warns of Dire Threat of Cyberattack on U.S.

Related Stories