Top
Best
New

Posted by dredmorbius 7 hours ago

Slovakia finds Russian backdoor in traffic speed cameras(risky.biz)
318 points | 124 commentspage 2
tokai 6 hours ago|
It seems like a silly mess. But its easier than it sounds to end up in such a situation. We're are a lot of HN Kagi users that just have to trust that the Yandex collaboration is fully watertight.
ojciecczas 4 hours ago||
Fits perfectly in the russian thinking scheme, always infiltrating their neighbours and trying to get more. Fucking parasites.
shevy-java 2 hours ago||
The problem I see is that Putin fully committed to the war. It is not only clear that he has no interest in ending the war, despite the lip service, but will continue to create problems and cause issues. This backdoor here is not an isolated problem - it is a systemic, concerted problem. All retaliatory moves are handicapped by orange Agent Krasnov being an asset for Russia. The EU needs to stop outsourcing its security. That includes having a nuclear arsenal available for all member states.
koonsolo 4 hours ago||
It wouldn't surprise me if the Russian misinformation inside Slovakia is able to spin this into an anti-EU, anti-Ukraine story.
lifestyleguru 6 hours ago||
Slovakian prime minister is doing proud photos with Putin despite the ongoing war so the backdoor looks like a desired feature not a bug or fuck up.
irishcoffee 7 hours ago||
Next up, chinese solar inverter firmware.
hansoolo 4 hours ago||
Do they even need that since, when most of the converters are attached to the Chinese cloud?
irishcoffee 4 hours ago||
I made the logical leap that the firmware enables this. I don’t have the code in front of me, so that may have been an incorrect leap.
victorbjorklund 7 hours ago|||
To do what? Turn off the power in random individual houses?
jwr 5 hours ago|||
I think synchronized operations could really disrupt the grid — think thousands of inverters switching backfeeding to the grid on/off, causing waves and disruption. Or thousands of inverters having their grid sync disabled, simultaneously operating to shift the frequency of the grid (very bad).
wongarsu 6 hours ago||||
I'd be worried about the inverters in large commercial solar plants. On a sunny day you could easily cause a blackout by turning enough solar capacity off at once. Maybe shut down the entire grid when the sudden power imbalances trip the self- protection in half the grid. That's a pain to recover from. Spain went through that not too long ago

But maybe rapidly switching residential solar on and off in a coordinated way can also do funny things to grid equipment

rollulus 6 hours ago||||
Any idea what happens to the grid when a significant chunk of solar power suddenly disconnects?
victorbjorklund 2 hours ago|||
Not much if a couple of thousand homes in US switches off. There are way more sensitive targets than ”they could randomly hike the electricity usage with 0,0000000000000000001%”
hsuduebc2 4 hours ago|||
There are always some “stable” power sources kept on standby that can be activated within minutes, for example gas turbines. In European electricity markets, generators can actually be paid simply for keeping this reserve capacity available, even if they are not producing much electricity most of the time.

The problem is that a few minutes is still too slow when a large power source suddenly drops out. The grid needs an immediate response, which can come from fast reserves such as batteries, hydro, pumped storage and other generators that can react automatically.

Pumped storage is basically gravitational energy storage: you pump water uphill when electricity is plentiful, then release it through turbines when power is needed.

I quite fancy electrical grid.

Spooky23 2 hours ago||||
If you had enough systems under control in an area, you could probably create a brown out or some other type of scenario by turning off 1000 houses on the right day.
randoot 6 hours ago||||
DDoS, anonymizer proxy, and turn off power in large commercial installations. They kinda deserve it for investing in solar. US holds all the power in social media, can't blame China if they want to utilize their lead in solar for something too.

Hopefully mutually assured annoyance keeps everyone at bay.

nom 5 hours ago||||
nah, the ones connected to the grid... you turn them all off during peak sun hours at the exact same time

same issue with large loads like boilers, this stuff should never be connected to the internet, but it is

if you can control enough load on the grid you can do real damage

bdhdhduuyd 6 hours ago||||
To set roofs on fire?

In the end it's all about trust. Right now I don't see why China would like to burn down their market.

cyanydeez 6 hours ago||
guys, do we need to reinvent the same Hanlon razor but for capitalism: Dont attribute to malice that which can easily be explained by capitalism?
probably_wrong 6 hours ago||
If we're reinventing sayings, I suggest Clarke's third law first: Any sufficiently advanced capitalism is indistinguishable from malice.
vkou 5 hours ago||||
To piss away decades of hard-earned trust in its products for some short-term one-time political 'pwn' of the enemy.

If that goal sounds stupid to you, that's because it is. I would expect some countries that are not China to act with such a capricious lack of foresight.

irishcoffee 4 hours ago||
The US pulled a 1-time trigger on Japan… twice. Looks like it worked out. You should be careful tossing around words like stupid.
newsclues 6 hours ago||||
Track usage patterns to know when people are at home and then rob them.
emdash 6 hours ago||||
Some of those are networked I think?
tomas789 6 hours ago||
Most of them are. Including the biggest ones.
2OEH8eoCRo0 7 hours ago|||
The HN version of "I have nothing to hide."
giancarlostoro 6 hours ago||
The nothing to hide thing isnt even an HN only thing unfortunately.
szundi 7 hours ago||
[dead]
LogTrim 6 hours ago||
The detail that gets me is the Ministry saying the cameras were safe because they'd be on a closed network, while the backdoor can apparently be triggered via SMS from hardcoded phone numbers.

That's a pretty good demonstration of why "it's not exposed to the internet" isn't a security boundary if the device itself has an out-of-band communications path.

Add Secure Boot being disabled and unauthenticated live streams and this seems less like one unfortunate backdoor and more like nobody established what the trust boundary was supposed to be in the first place.

PinkSheep 2 hours ago||
"Not exposed to the internet" means exfiltration is hard in this case. If I were to dream about defense in depth, these SIM cards should be monitored for traffic anyway or have filtering rules at carrier level. Because at the end of the day, Russian numbers or not, mobile networks are insecure.
hno5b8kgpg 2 hours ago||
[dead]
yodon 6 hours ago||
Zero chance of vulns in flock, so we're good in the US /s
sssilver 5 hours ago|
[flagged]
flohofwoe 5 hours ago|
The article is neither about Germany nor about the US.
sssilver 5 hours ago||
It's about allies spying on each other, a common practice since the dawn of civilization.
fwn 4 hours ago||
Imagine a headline reading, "People are starving in [city]." Someone might reply to that news by pointing out that starvation is as old as humankind. ...older even.

Would that remark be on topic? Would it be noise?

More comments...