A question about cyber attacks - Page 1
Forum section: electronics / general

author: SteveThackery
author_rank: Super Contributor
timestamp: April 28, 2025, 03:53:05 pm
content: The situation in Spain, et al, has prompted this question.We are frequently warned that important elements of our infrastructure are prone to disruption by cyber attacks. It seems to me that these cyber attacks must be mediated by the Internet, which raises the obvious question: why are large parts of our infrastructure connected to the Internet in the first place?I do understand why extensive networking is required in these infrastructures, to allow for remote control, diagnostics, alarms etc. But why do these networks have a connection to the Internet? Surely these networks could, and should, be "air-gapped" *, and thus immune from being hacked except by direct physical intervention.When I worked for BT, in the pre-Internet days, we frequently designed and built UK-wide networks that were completely private. These were usually for large companies with branches across the UK. They worked just fine and the only risks to their security was if a bad actor could obtain physical access to a server room (or similar).So, does anyone understand why we can't air-gap our important infrastructure networks?* I mean "air-gapping" in the logical sense as well as the physical sense - that is, blocked from radio connections as well (WiFi, Bluetooth, etc).

author: themadhippy
author_rank: Super Contributor
timestamp: April 28, 2025, 04:23:17 pm
content: Money,why spend a large wedge of your profits on a bit of wire joining 2 points when theres a phone line over there

author: NE666
author_rank: Frequent Contributor
timestamp: April 28, 2025, 05:14:31 pm
content: Quote from: SteveThackery on April 28, 2025, 03:53:05 pmThat the control points of the network need to be interconnected, I think we take as a given. Taking one example from the power grid, distributed protection relay systems, these require the ability to coordinate in order to determine the fault location and therefore at which node(s) to disconnect. Remote monitoring and operation from central locations is obviously desirable too.How they talk is where the 'cyber' aspect arises. In an ideal world, they'd use a fully private, closed network. But that is no doubt considered to be prohibitively expensive. Hence solutions such as MPLS get employed. Which is fine, but as with all shared infrastructures, the privacy and security aspect is subject to compromise both intentionally, by bad actors (internal or external), or through misconfiguration.

author: madires
author_rank: Super Contributor
timestamp: April 28, 2025, 05:58:18 pm
content: Profit maximization and morons. VPNs with dedicated lines are expensive and DSL/FTTH/LTE internet access is inexpensive. For internet access proper VPN routers should be used. They cost more (around 500 bucks) than a cheap SOHO router and need someone managing them (salary). So some experts take the cheap SOHO router and configure port forwarding for accessing the control system which still has the default PW set. What could possibly go wrong?Unfortunately a very common scene.

author: SteveThackery
author_rank: Super Contributor
timestamp: April 28, 2025, 11:46:31 pm
content: Quote from: NE666 on April 28, 2025, 05:14:31 pmYou know, I would think for an electricity company, the cost of a private network would be trivial compared with maintaining and operating their enormous estate of plant and equipment.But basically it looks like if our infrastructure gets hacked, then it's our own fault for being cheapskate and using shared data infrastructure (ie the Internet).

author: tatel
author_rank: Frequent Contributor
timestamp: April 29, 2025, 12:29:45 am
content: I have been told by workers of one big electricity provider (ENDESA) that the cause was a fire in southern France. They were waiting for autorization to put it up again. This (the fire) was confirmed later by different sources. So to speak about cyberattacks would be a non-starter.Portuguese officials were speaking about some dodgy theory, supposedly big temperature variations in Spain would have melted down the brain cells of many portuguese energy officials. I understand portuguese can't forgive Phillip the second's invasion in the 16th century and spaniards can't forgive portuguese kicked them off Portugal some decades later.In some places (like my destination, just made a 400 kms car trip after the outage began) I'm told electricity was back in about half an hour, but cell phone networks seem to be having big problems. I have been unable to call my mother to ask how things were going on at their home. Will try again tomorrow.However, Internet obviously works.

author: Halcyon
author_rank: Unknown
timestamp: April 29, 2025, 12:30:30 am
content: Quote from: SteveThackery on April 28, 2025, 03:53:05 pmThe short answer is, they shouldn't be.The longer answer is a bit more complex. It really depends on what kind of infrastructure you're talking about, and there is a big difference between what we know as "IT" and "OT" (Operational Technology). OT is like your PLCs etc...When we're talking about critical infrastructure, like water treatment plants, power grid assets, etc... You'll find a lot of the technology is very old and probably quite vulnerable to exploitation. On the other hand, how do you remotely manage that gear? As soon as you poke a virtual hole through the barrier, you run the risk of being exploited.There's no one-size-fits-all answer, and it's the reason why this area of cybersecurity is increasing rapidly. Want a well paid job? Get into cyber. For someone with 5+ years experience, you're probably looking at about AUD$120-140k per year as a base salary. Mid-level to senior level contract roles are going for about $1100-1300/day.

author: CatalinaWOW
author_rank: Super Contributor
timestamp: April 29, 2025, 12:41:08 am
content: The level of cheapness required to make this mistake is pretty extreme. To me it makes sense to use the physical infrastructure of the internet to shift data from location to location. But for infrastructure equipment that doesn't need a general purpose communication channel to anywhere and everyone it seems it would not be particularly expensive to have fully and rigorously encrypted interfaces between the web and the machinery (not Windows, not Linux). There would by a little latency, but shouldn't matter for these purposes. Then the only internet hack that would really be possible would be DOS type attacks that literally made any communication over the net impossible, and even these would be difficult because finding the nodes to attack wouldn't be easy.

author: coppercone2
author_rank: Super Contributor
timestamp: April 29, 2025, 12:42:15 am
content: companies get a little funny when you have division of management and cost centers between software, hardware and 'services/fees' (i.e. subscriptions and services, which also might have different... oversight)one of them can decide to go for broke. and often does. Its like local politics and suddenly international relations that is decided by some space aliens. You can have a private super maglev with personal stewardesses and michelin star chef into isolated town Montana with a population of 200, no industry and mean income of 12,000 per year, or you can have a flooded muddy foot path into the megalopolis of tomorrow. Kind of like if one of those peruvian mountain busses was the only way to access silicon valley.and that is how you are going to have a trillion dollar fusion reactor that has remote access with a outdated linksys router in what used to be a burned out gas station

author: brucehoult
author_rank: Super Contributor
timestamp: April 29, 2025, 01:22:33 am
content: Quote from: themadhippy on April 28, 2025, 04:23:17 pmFunnily enough, the electricity grid consists of bits of wire joining 2 points.HomePlug units allowing domestic users to distribute ethernet over their house mains wiring appeared 25 years ago, but utility companies were using the same idea much earlier I think.NZs first non-government telco long distance service got its start leasing capacity from the newly privatised railway company, which had laid fibre alongside their tracks.

author: NE666
author_rank: Frequent Contributor
timestamp: April 29, 2025, 09:48:44 am
content: Quote from: brucehoult on April 29, 2025, 01:22:33 amMy understanding is that in UK at least, the ground (topmost) conductor of high voltage transmission lines (i.e. "Pylons", if you're from the UK, or towers elsewhere) is combined with fibre.However, that then doesn't extend downwards to lower voltage distribution overheads (e.g. 33kv, 11kv), so substations and equipment associated only with those would still need other comms provisions.

author: SteveThackery
author_rank: Super Contributor
timestamp: April 29, 2025, 09:57:13 am
content: Quote from: Halcyon on April 29, 2025, 12:30:30 amActually I would think that the older gear is a lot more secure. Why? - because it doesn't go anywhere near the Internet. It's important to remember that the water companies (the ones I know about) had extensive remote monitoring and control right back in the '70s, probably before. The system was built using "private wires" provided by the national telecomms operator (Post Office Telecommunications, latterly BT). The only way anyone could hack into that network* was with the help of extensive records, a manhole lid lifter and the means to open up cable joints. Basically, it ain't gonna happen (and I believe it never did).*I guess it wasn't what we would think of as a network in modern terms. It was actually dozens of point-to-point private wires leading back to a control centre.

author: u666sa
author_rank: Frequent Contributor
timestamp: April 29, 2025, 12:27:41 pm
content: @SteveThackerywell it wasn't cyber attacks.REE said it had identified two incidents of power generation loss, probably from solar plants, in Spain’s southwest that caused instability in the electric system and led to a breakdown of its interconnection with France.sourceSpain is one of Europe's biggest producers of renewable energy, and the blackout sparked debate about whether the volatility of supply from solar or wind made its power systems more vulnerable.//.Back to reality. The cheapest and cleanest form of energy is hydroelectric. It is the most powerful as well. Aluminum smelting plants are usually build near dams. Then come nuclear energy -- second cleanest energy source on planet. Clean and reliable. Solar, wind, geothermal are cleaner, but neither reliable nor powerful. You won't be building aluminum smelting plant near wind turbine.Vienna, Austria has a lot of wind turbines. A LOT!! I've been there twice within half a year. I've been there in January as well, during the cold season. Beside the layer of dirt on the streets -- literally -- there was a distinct smell in the air. They were burning something. Either coal or garbage, it was something burning and it was everywhere. I did not expect that kind of ecology from supposedly clean place with bunch of wind turbines all around.Point is, this green energy thing is overblown some places of the world. Obviously sun is not shining at night and obviously wind is not blowing all the time. Of course they are burning something when the wind is not blowing and sun is not shining.We had similar situation several years ago in Texas, who remembers that? Again, renewable energy was the culprit.Nothing better than hydroelectric plant!! Cleanest energy form on this planet. Next to it is nuclear power plant. Then come dirty boys, natural gas, coal, garbage. Then come unreliable energy sources like wind and solar.