Major cyber attack - Who is at fault?

[VK3DRB]

https://www.theage.com.au/politics/federal/morrison-reveals-malicious-state-based-cyber-attack-hitting-several-sectors-20200619-p5545z.html
The Prime Minister did not mention who launched the attack, but it was almost certainly China.

We will always be open to rogue states and individuals attacking organisations. It is up to the organisations involved to ensure they have competent people hired to provide adequate defence against attacks. It seems the victim is as much to blame as the enemy. If someone leaves their keys in the car that is parked at a shopping centre with the door unlocked and the car gets stolen, who is to blame? Both the thief and the owner of the car.

If standard electronics engineering practices were used in IT, our infrastructure would be less prone to attack. In a product, we provide protection from serious external disturbances (EMC susceptibility, over voltage), protection to the external environment (EMC emissions, overcurrent, fire) and protection to the user (safety). The product must meet regulatory approvals. It should be similar for IT infrastructure. All too often the IT industry is reactive, not proactive. In electronics, we don't wait until someone has been electrocuted before we decide on insulating a circuit.

Why are organisations so vulnerable? Is it because of clueless IT managers who evidently pervade industry and government? Is it because software vendors leave too many vulnerabilities in their products? Or is it just too complex compared to a circuit? Or some other reason?

[T3sl4co1l]

A variety of reasons, those among them, yes.

EMC is easy; we can, in principle, calculate or measure the fields, and design filters by analytical methods.  It may not be easy, or practical even, but it is eminently possible.  We can generate fields of arbitrary nature, and usually it suffices to try a few combinations of modulated frequencies and impulses.  Stateful signals are not typically required (if they were, there's still a method to explore that space in polynomial time, but it's not exactly low order).

Whereas for software, we have some methods to touch the edges of things -- static and dynamic analysis, fuzzing, etc. -- but no general approach, and provably so!  (Checking a general program for correctness is evaluating a proof of that program; the proof is itself a program; that proof terminating is therefore a Halting Problem.)

We're even more hopeless at social and political systems.  Humans will always be fallible, selfish, lazy, and suggestible.  Computer science, in and of itself, is in general intractable; with humans writing it and interacting with it, it's essentially a guarantee there are bugs.

Tim

[noreply]

Why are organisations so vulnerable?

Because 'convenience' is INVERSLY related to 'security' ...

and the IT industry - INCLUDING users (the public) - prefer to have 'convenience' without realizing the above direct relationship 

[golden_labels]

noreply and T3sl4co1l provided two reasons, which IMO are the most important. But there are also psychological factors.

Human brain is horrible at probability perception. The further one moves away from 50%, the more they round the perceived likeliness to 0% or 100%. And it happens fast. At the same time people rarely think with proper rigour, but rather make guesses based on what they have experienced either personally or heard about from other people close to them. Those two factors bring fatal consequences: greatly underestimating risks caused by low-frequency events. Security breaches are such events.

Emotional state, caused for example by framing, by environment in which one is or by personal beliefs, affects risk perception even more. Just like people, properly conditioned, may be afraid of very unlikely events to the point at which they consider it as a risk greater than something nearly certain, humans tend to ignore even considerable risks.

With wrong perception of the risk, what incentive is there to care about security? Why would anyone care if “it’s not going to happen to me”?

While this is a less important factor, one should not forget about persisting traits in development and administration. Administrators, who do not take any criticism and avoid audits. If one can’t reveal the precise principles on which the network protection is based, this should be alarming. If the idea of pentesting is disliked by an employee responsible for security, managers should really ask the important question: why. Perhaps giving that post to a person, who has no relevant knowledge or their knowledge is a mix of personal fantasies and misconceptions from 30 years ago, was not the best idea? Overconfidence and overestimating own skills happens among programmers⁽¹⁾. Have you heard one dimissing comments on doing something usafe by saying “you can use it, if you know what you’re doing” (implicitly: they know what they”re doing)? This is yet another reliable red flag. Many people are also unable to say “no” to their superiors, despite knowing some ideas are bad.
____
⁽¹⁾ Among all experience-based professions, to be honest.

[magic]

I will add the never ending growing complexity of software to the laundry list. Nothing will ever improve until the "Moore's law" stops and people are forced to start thinking about removing things not needed rather than adding things that might be useful, perhaps.

[GlennSprigg]

https://www.theage.com.au/politics/federal/morrison-reveals-malicious-state-based-cyber-attack-hitting-several-sectors-20200619-p5545z.html
The Prime Minister did not mention who launched the attack, but it was almost certainly China.

Yep... Decades ago, it would have been 'Russia', and the U.S. still has issues with them! (Trump!?).
Wow, what a 'coincidence' that China is 'pissed off' with Australia recently, (by 'daring' to be pro-
active from day-1 with this Covid-19 business!).  These days, another 'Cold-War' continues against
Western civilization, but with different 'players'. We are Complacent these days, and all deal massively
with China in the way of Trade etc. However, we get 'reminded' occasionally when they "raise the whip"
to bring the subservients back into line. That might work with the likes of locals, & Hong-Kong, physically
in their 'whipping' distance, but the rest of the World has a certain 'Finger' for that!!    

[nctnico]

A variety of reasons, those among them, yes.

EMC is easy; we can, in principle, calculate or measure the fields, and design filters by analytical methods.  It may not be easy, or practical even, but it is eminently possible.  We can generate fields of arbitrary nature, and usually it suffices to try a few combinations of modulated frequencies and impulses.  Stateful signals are not typically required (if they were, there's still a method to explore that space in polynomial time, but it's not exactly low order).

Whereas for software, we have some methods to touch the edges of things -- static and dynamic analysis, fuzzing, etc. -- but no general approach, and provably so!  (Checking a general program for correctness is evaluating a proof of that program; the proof is itself a program; that proof terminating is therefore a Halting Problem.)

IMHO one of the problems is that software is rarely designed to be robust. In most cases software is developed based on a description of the primary function without consideration of how that primary function can be abused / without consideration whether the software can be brought into an undefined state.

[Jeroen3]

Software barely works.
If all software was developed at aviation standards projects like Google Chrome would be prohibitively expensive.

[VK3DRB]

https://www.abc.net.au/news/2020-06-20/australian-departments-routinely-audited-for-cyber-readiness/12375050

Some (most I would suggest) IT managers are incompetent and that is why there are vulnerable systems out there.

Example 1. I personally knew a bloke who took charge of the Victorian Government's main website. The front page showed a map of Victoria with the slogan "Victoria - The Place To Be". Hackers easily modified the front page to show a Real Estate "SOLD" banner on an angle across the front page . This was at a time when the state government was selling off our vital assets and real estate to foreigners. There was next to no security on the website. The hack was hilarious and it hit the news. The defaced web page stayed hacked for over a day.

Example 2. I suffered under an IT manager who literally did not know the difference between bits and bytes. He ran the worst IT department I have ever seen . The Internet was so slow, engineers had to go home to download datasheets on a USB stick, which compromised security. I could write a book on him.

Example 3. An IT manager failed to have any UPS battery maintenance processes. One day when the mains power did fail, 73 servers crashed. After that he thought he might need to replace the dead batteries in all the UPS's. His department was formally called "Information Systems", but everyone including the department themselves called it "IS" .

Example 4. The Victorian Dept of Education spent megabucks on very expensive firewalls for each school even for tiny country schools with 20 kids in them (~20K each?). No training provided. No support.  An IT guru I know that was involved said a $200 router/firewall would have done the same job and would have been much easier to set up.

Example 5. The recent census was a huge debacle by the federal government. They failed to estimate the peak demand on census night and the system crashed, being out of order for weeks. They blamed hackers. If it were hackers as well, they were ill prepared. They had to extend census night for a month.

To be fair, there are a few IT people I have come across that are worth their salt. Some are brilliant. It seems genuine enthusiasts are more valuable, irrespective of qualifications. Good hackers who played around with Commodore 64's or the TRS-80 in their younger years and know how a PC and network function, seem to have the knack. Two of the best IT boffins I have known did not have degrees. One big reason why the EEVBLOG is so good: It attracts people with the knack like bees to a honeypot.

[golden_labels]

IMHO one of the problems is that software is rarely designed to be robust. In most cases software is developed based on a description of the primary function without consideration of how that primary function can be abused / without consideration whether the software can be brought into an undefined state.

This is not a counterargument to what T3sl4co1l has said. It’s a separate issue, which is not even tangent to the complexity problem. It doesn’t matter how honest you are and how hard you try to make your product good, proven and well-tested: you simply can’t due to the nature of the problem itself. Along with diminishing returns effect, this is why it is very rare to see formal proofs in software even if someone is truly willing to make their program as good as possible. The idea has been mostly abandoned after it has been noticed the goal was unachievable for complex systems and the cost becomes prohibitive even for partial proofs.

What you have mentioned is rather an effect of no incentive to create good software in the first place.

[vk6zgo]

https://www.abc.net.au/news/2020-06-20/australian-departments-routinely-audited-for-cyber-readiness/12375050

Some (most I would suggest) IT managers are incompetent and that is why there are vulnerable systems out there.

Example 1. I personally knew a bloke who took charge of the Victorian Government's main website. The front page showed a map of Victoria with the slogan "Victoria - The Place To Be". Hackers easily modified the front page to show a Real Estate "SOLD" banner on an angle across the front page . This was at a time when the state government was selling off our vital assets and real estate to foreigners. There was next to no security on the website. The hack was hilarious and it hit the news. The defaced web page stayed hacked for over a day.

Example 2. I suffered under an IT manager who literally did not know the difference between bits and bytes. He ran the worst IT department I have ever seen . The Internet was so slow, engineers had to go home to download datasheets on a USB stick, which compromised security. I could write a book on him.

Example 3. An IT manager failed to have any UPS battery maintenance processes. One day when the mains power did fail, 73 servers crashed. After that he thought he might need to replace the dead batteries in all the UPS's. His department was formally called "Information Systems", but everyone including the department themselves called it "IS" .

Example 4. The Victorian Dept of Education spent megabucks on very expensive firewalls for each school even for tiny country schools with 20 kids in them (~20K each?). No training provided. No support.  An IT guru I know that was involved said a $200 router/firewall would have done the same job and would have been much easier to set up.

Example 5. The recent census was a huge debacle by the federal government. They failed to estimate the peak demand on census night and the system crashed, being out of order for weeks. They blamed hackers. If it were hackers as well, they were ill prepared. They had to extend census night for a month.

To be fair, there are a few IT people I have come across that are worth their salt. Some are brilliant. It seems genuine enthusiasts are more valuable, irrespective of qualifications. Good hackers who played around with Commodore 64's or the TRS-80 in their younger years and know how a PC and network function, seem to have the knack. Two of the best IT boffins I have known did not have degrees. One big reason why the EEVBLOG is so good: It attracts people with the knack like bees to a honeypot.

In my last job before retirement, we had one computer which was only used for operating the equipment that was our primary reason for existing.
This was not connected to the network, or the Internet, & had a proprietary program used to control the equipment.

We also had a contracted IT bloke, who would come in of a night every few weeks, do updates on the PCs  & the Server.

One morning, I came in, to find the operators in a panic, because the control PC was not showing the whole control window, especially the equipment "on & off" functions.

I fiddled around, & got that back, but another problem arose, in that, every 3 minutes or so, the required display would disappear, replaced by a generic "Windows" one, unless the operators wiggled the mouse a few times.

I bailed on that one, & went to tell the Boss.
She was already preparing to ring the IT guy, as none of the office PCs worked!

On another occasion, after he had been, I sent an email to a supplier, & was amazed to see it rejected by our Server, due to "Racial vilification".

What!!

On investigation, I found that if I stood on one leg, scrinched up my eyes, & held my head just so, it just, sorta looked like the supplier's name & his ABN number was ever so slightly like a very nasty comment about indigenous people.

Astounded by this, I sent the Boss an email saying "The bloody thing rejected my email"

You guessed it----rejected for "profanity!"

I dragged my aged bones down the stairs to tell the Boss.
Again, she was ahead of me, & was on the phone to the IT guy, with flames pouring out of her mouth------not a happy lady!!   x 10

Ok, the IT guy was useless, by why anyone thought providing a censorship function to the email program was a good idea, is beyond me!

Previous to that, I worked at a place where they were paranoid about their "intellectual property", to the extent that they wouldn't even give us schematics of their "mother board" (which was actually an interface board--all the real "smarts" were in a couple of PCs).

The IP in that board was all "Public Domain" stuff straight from the "National Semiconductors" handbook! 

They were always worried about getting "hacked", & didn't like it when I pointed out somebody could break into the place with a "sharp fingernail", leave a small TV camera over one of the IT guy's desk, (or, I suppose, use a key logger, but I'm an old TV person), capture all his keystrokes when he logged in to his PC, come back in the next night, log in, & "have the run of the place", software wise!

Physical security was non existent--- from memory, they "lost" a laptop at one stage.

They kept a bunch of software guys on call to help customers with their problems, but most of the time, they were dealing with hardware problems which they had no expertise in.
The software itself was rugged, but some of the hardware was seriously dodgy!