The opposite of technically correct - there's some logic to their thinking of it as being about the 90s, but technically it very much did not happen "in the 90s".
US cyber capabilities have an edge because they can analyze all of our data stored with US tech companies and they have interception points on all major internet cables.
Their human intelligence is much better prepared to "convince" someone to act against their own interest if they can look at your last ten years of communication, family pictures, and web browsing history before they even meet you.
Imagine working in a foreign country where death penalty is applied to certain crimes, like blasphemy or homosexuality. They just need to find one person in the target organization who has a secret twitter account that talked badly about god and then they hit them up and tell them to plug in a certain USB stick to a certain system. Cyber operation succeeded because they have a shell.
Other than Americans wanting to feel superior (no offence intended, I'm sure most countries want to feel that when possible!) is there actually any public evidence that's the case?
Even when it comes to superiority of physical military forces, different people (with a range of different biases) have different opinions on stuff like whether a hot, all-out (but non-nuclear) war between USA and China would prove one or the other to be stronger, and while you may read that and think "I know which side is better and anyone who disagrees is just buying into delusional propaganda" at least to form that view you've had the ability to follow a lot of publicly available details on military developments over the years, learning about current and next gen fighter jets, drones, ships... etc.
But when it comes to cyber stuff, both offensive and defensive, it's generally a lot more secretive in terms of stuff that's actually been done (see for example the speculation in this thread that US power grid failures in recent years might have been caused by foreign adversaries - there's no evidence that's true, but if the US and China had both spent the last decade trying to take offline as many of the other country's power grids as possible we likely wouldn't have heard about it). Yet alone for hypothetical but saved for war capabilities. If a hot WW3 broke out tomorrow, who actually knows what hacking tools any country (from superpowers to smaller players) actually has, waiting to be used? Presumably they all spend a lot of effort trying to learn about each other's capabilities, and maybe they're successful enough that they actually do all know most of what everyone else can do - but they don't then announce that the way we hear about North Korea testing a new missile or about America developing a new fighter jet. I feel like we the general public just have no idea how advanced or not wartime capabilities might be. Am I wrong? (I may well be, as I'm in no way an expert in this field; I just believe that things like the document you linked are massively influenced by both the politics of the authors and the information available to them.)
There's also great potential to build misattribution in. Just pause between combining the attacks from the Internet and renaming variables to watch a Dolph Lundgren movie.
This. Also do not underestimate developing countries internal security budgets. Most middle income countries can now afford DACH sized cybersecurity procurement deals.
I think you missed the parents point. They were saying they don't have the resources for proper defense, my guess is parent would agree about their offensive capabilities
It's a performative announcement - most American and Israeli cybersecurity vendors either don't sell in China or white label a Chinese product for the Chinese market.
I know 2 companies in that list that have done that very thing because otherwise it would have put their FedRAMP and CMMC pipelines at risk.
I initially was in the Huawei client engagement where they wanted copies of all of our source code. We said “no, nobody gets that”. They just keep asking over and over.
On one hand, that seems like a sure way to get your product copied. On the other, they’d be totally nuts to run a cybersecurity product without the source code, right?
Seems like a situation where getting the interests to align is just very difficult.
Even with white labeled products so they stay legally compliant, is it really justifiable to increase the risk? They're having people flying in and out for "sales meetings", shared office spaces, devices, maybe even staff overlap.
I understand it's a good way to make money but it comes with some tail risk.
Basically, a Chinese MSSP or SI is selected and given the American/Israeli company's logo and makes a revenue share agreement, and an airgapped environment using a distinct fork is deployed.
That said, most companies decide not to operate in the Chinese market - the TAM is too small for the headaches that it entails (losing Gov and NATO+ defense procurement opportunities).
You're using "false equivalence" bias. Not every government is bad, especially if you still have russia, iran, and others as ongoing contenders for worst crimes against humanity.
So saying "every government is bad" is simply a bad faith argument and you should shamefully sink towards the planet core for using it. Andorra is not as bad as russia or iran.
Just yesterday there was a video where russian soldiers tie an anti tank mine around the torso of a black African mercenary soldier from Mali before forcing him on a suicide meat assault towards Ukrainian positions. Some countries are evil on another level.
Every govt's main agenda is to control and strip away any rights of the citizens. Directly or indirectly, that's their main motive. It will keep getting worse until people realize that anarchism will be the only choice.
The reality probably isn't far off... I know in the past the "breaches of critical infrastructure" breathlessly reported by the media have actually just been wide-open SNMPv2 services using the default community string. I'm sure something similar happened here. Turns out you can just connect to port 161, press "power off," and be reported in the news as an "advanced persistent threat actor"
Is it that, or is it more likely they paid some anti-Maduro electric company worker to walk into HQ and shove a dongle in the back of a PC somewhere on their internal network, ala Stuxnet?
I work in electricity, it wouldn't be one, but yeah essentially it's probably an unpatched RDP/vnc/remote desktop exploit. Or the password is contraseña123
I can see how a team of cyber bureaucrats is required to type in the fancy n you are using in your password. At least it is safe against brute forcing attempts with standard settings.
India has neither the ability nor the desire to attack the US. The very idea is silly.
The country has its hands full enough coping with its state of quasi-chaos and belligerent nuclear-armed neighbors without taking on the worlds leading superpower for absolutely no reason at all.
You need to give some details and arguments on your extraordinary claim because what can be asserted without evidence can also be dismissed without evidence.
Almost certainly not. The first impeachment trial revealed that Trump's foreign policy was for his personal benefit. It's pretty obvious Trump has figured out that nations, corporations and oligarchs will pay him for favors. I think the dots are connectable.
> In 2019, the Maduro government accused the United States of conducting a cyberattack on a hydropower plant that plunged much of the country into darkness for a week.
> The power failures caused sporadic outbursts of looting and unrest, bringing the government close to collapse.
In the 2019 book "Sandworm", which discusses cyber warfare against infrastructure like this, but between Russia and Ukraine, the author begs the question in an interview with a US military/intelligence official,
"why doesn't the US go after these hackers and designate targeting civilian infrastructure as a crime?"
To which the response was essentially "The US would like to reserve those types of cyber attacks for their own uses"
These quotes are very loose, I read it last year, but essentially, the US didn't make a stink about older grid attacks in order to save face when the US does it.
Additionally, much of VZ's difficulty was due to the massive sanctions against the nation. Sanctions are effectively attacks on a nation's citizens to pressure the government. Disabling power infrastructure is absolutely in-line with the motives of sanctions and embargos.
I think perhaps nationalizing your oil companies, looting their assets for political reasons, and driving out the only people with the competencies to operate your only valuable industry might have a tiny bit to do with the state of the country.
I feel like Mother Goose had a cautionary tale about killing your golden goose that perhaps Venezuela’s leadership ought to read up on.
Good point. It's easier to say you got hacked by nation state actors than to tell your boss you accidentally screwed up a major system with no way to recover. It's not like 99% of the management could tell the difference.
Is there a particular reason to take any state account of anything at all at face value? At some point you either have to accept to play the game or reject all news.
In this case, it fits squarely in with American foreign policy, especially their orientation towards Venezuelan chavismo.
It also fits squarely with corruption in Venezuela, specially regarding energy. Venezuela has been rationing electricity across the country since 2009 and has been involved in countless corruption scandals involving Odebrecht, PDVSA, Derwick Associates.
I understand the US's foreign policy is a global threat, but let's not let that be an excuse for the atrocities and corruption of tyrants in Venezuela and other places.
Perhaps. This seems somewhat suicidal of a corruption scheme for the leader of a country. Surely there must be easier ways to personally profit than making an international embarrassment of the country—every other country on earth manages this sort of graft just fine.
What is the scandal supposed to be in the first one? No water in the dam? Mismanagement? Nationalization itself?
The Derwick one seems pretty light too, at least the article here just mentions an accusation from a journalist. And even then, if we are using corruption/overbilling with regard to a government contractor as an "atrocity" now.. That's going to have wider repercussions than here.
And ok, Venezuela took bribes from another government contractor, along with many other countries. I wouldn't call that an atrocity, but if that's what it is I guess I will give you the benefit of the doubt about it.
I give you benefit of the doubt about everything really! I just don't know if you have packaged your case here well is all.
The scandal is that the energy crisis was declared in 2009, and 17 years later, after investing $100 billion of which up to $80 billion disappeared, there are still blackouts across the country. That's all in the first article. The Derwick one is not just one reporter either, there's local and international reporters involved including claims from Reporters Without Borders where reporters received "threats, pressures, bribe offers". That's also in the article.
As for the attrocities I meant the Maduro (and current) government in general. There are currently over 1000 political prisoners in the country, a mix of protesters, politicians, reporters, etc. A lot of them have been tortured and many have died in custody. Most of the sources from NGO are in Spanish but the Wikipedia is a good start, specially the section about the Maduro government [1]
If you check the news right now you'll see that only in the past month about 50 have been released. There's a huge effort in the country right now to get the hundreds of others out.
Ultimately, what I want to say is that while we can express disdain for the US government we can do the same for the Venezuelan one, even if they claim to be against each other. Maduro and his gang are not the victims here, they've oppressed the Venezuelan people for 27 years, let's not give them an easy out
Let's not take Maduro at his word, he's great at playing the victim to hide their corruption. Venezuela has been in an energy crisis since 2009 with rationing still happening everywhere in the country except in Caracas [1] big part of it from the Odebrecht corruption scandal [2]
Let's hope those chicken never come home to roost. NSA has a history of losing offensive cyber tools.
IIRC both Texas and California had widespread power outages in the last few years. I am not convinced that US power grid is much better defended than the one in the EU.
> Let's hope those chicken never come home to roost.
Bare minimum it gives chinese tech suppliers a great pitch to convince buyers to choose their products over US suppliers. Even if theirs are also full of backdoors, at least they have no history of taking advantage of them to kidnap heads of state far away.
Yes, you're missing that if you mess with the power grid the US will go and kinetically strike back (read: bomb your country) or attack you with its own cyber warfare capabilities, unlike the EU. That's why the EU is experiencing cyber attacks and cyber warfare with clear culpability from Russia, but is unable to do much about it besides give Ukraine more weapons. If Russia launched a cyber attack and shut down JFK the way it did Heathrow, the US would actually do something about it even with all the Trump is a Russian agent stuff aside.
Please don't cross into name-calling or personal attack and please don't be snarky in HN comments, no matter how wrong another comment is or you feel it is.
Sure, of course it's not that simple. If China for example did a cyber attack it doesn't necessitate an immediate kinetic response or some sort of gargantuan nation-state level warfare to take place.
But if one of those countries shut down the US power grid we absolutely would respond and you're naive to think that the US would not respond out of some "fear" about only fighting very asymmetric wars.
Amongst some there seems to be this idea that because the US has taken military action in other countries over the years, more recent being more important, and because those countries "couldn't fight back" that the US is unable or unwilling to take further action against other nation states that theoretically could fight back (India could not, for example as a weak military power with nuclear weapons), but instead I'd caution you look at those action with respect to the ability of other countries to take action.
In other words, it feels good to throw in zingers like the US only beats up on weaker countries or something which, let's be frank would be every country or bloc except China, but you're missing the fact that those countries are not even able to project power to or willingness or ability to attack other countries.
> I only remember that if one US state loses power the other states laugh about it because obviously it is because the current governor is a black female democrat.
Yea that's obviously dumb, but the difference is you hear about America's problems, but not the problems in other countries. Russia has its oil facilities regularly bombed. China has institutionalized corruption down to the local level. It's not all peaches and rainbows in every country on earth.
> It'd be great progress to actually detect what caused it in a timely manner and then do a proper cyber attribution.
Who says we aren't?
> Generally I think you are using a lot of big words to compensate for the fact that the US ignored the Minsk agreement.
Can you elaborate? What's the broader point you want to get at here?
> The russian government has been publicly joking about Trump, broadcasting nude pictures of the first lady and boasting about possessing the Epstein tapes. Before that was the hack of Hillary's mail server and fake news campaigns. No kinetic repercussions, even red carpet for putin's visit in Alaska.
Yes, totally. The United States should have bombed Russia for publicly joking about Donald Trump. Give me a break. Why even post stuff like this?
> Apart from all this a modern drone war would be a big problem for the US, and countries like Ukraine, russia and china are much better prepared for such a scenario.
Who do you think is operating in Ukraine and advising the Ukrainians and learning from their drone warfare techniques and capabilities? Do you really not know how this stuff works? Are you not aware that the United States is actively testing weapons in Ukraine to prepare for drone warfare? Is that why you're saying stuff like the US should have a kinetic response against Russia for posting pictures and joking about Donald Trump?
> I mean that by ignoring Minsk agreement and being a bitch about weapons deliveries on top of that, the US incentivized every single country to pursue access to nuclear capabilities.
Heh ok. I guess so. The US was a "bitch" about weapons deliveries (quick hide the numbers) therefore every single country is incentivized to pursue nuclear capabilities. Great argument you have there.
> They started with the public humiliation after they felt empowered because there was no credible US response to all the previous hacks that you glossed over in your response.
Name the hacks that were glossed over and what you feel is the appropriate response.
> Yes, the US stopped credit card payments and destroyed some payment terminals. I imagine they weaponized the apple and android devices, maybe this still continues. For a couple of days, we had those impressive russian rockets which turned around and destroyed their launcher. And of course the geofenced US weapon systems. But was US able to shut down any vital russian systems except starlink and McDonald's?
Sanctions seem to do the trick. But you probably aren't reading about and paying attention to the state of the Russian economy, or what equipment they're sending their soldiers to war in Ukraine with. Well, when they're not supplied by China that is.
How many Russian energy and oil facilities have been targeted by Ukrainian drone and missile strikes, and who do you think helped with the targeting?
> Old lavrov still walks around openly with his apple watch just to farm payloads.
Sure, why isn't the EU arresting him then? Why don't they launch operation Lavrov and go capture him? There's got to be a reason right? What reason do you think that is? It can't have anything to do with the US though, you can only explain why the EU isn't doing it.
> There are observers from many countries on the ground in Ukraine, and US might even be testing some weapons.
Yes, there are, but the relevant ones are from the United States and the United Kingdom. There's no "might" about the US testing new weapons, it's just a simple fact. And they're testing those weapons, both offensive and defensive, against drone warfare. Ukraine shares intelligence with the US.
> However US efforts are overshadowed by better performance of European weapons systems, both old and new.
What specific US efforts are overshadowed by better performance of European weapon systems?
> Meanwhile the US artificially limits supply for US systems, so they get destroyed because they need to preserve ammo.
Which ones?
> There is a lot of empty posturing and the results are really not speaking for the US.
Well we took down Iran and Venezuela, both Russian allies. Cuba is not looking good either. We're seizing Russian shadow fleet tankers (we've seized more in a month than the EU has since the start of the war), we've upheld sanctions and increased sanctions while Putin and his henchmen's kids galavant around Europe and the US continues to provide intelligence sharing to help Ukraine with targeting, advice, materials and equipment, and more.
The EU of course has helped too, but unlike you I'm not downplaying one party's involvement and participation and instead defending one party, as I would defend the EU if someone claimed they weren't doing anything either.
Please don't break the site guidelines, regardless of how badly another account may be doing so. Your comments have not been nearly as aggressive as the other's (that's good), but you've still gone over the line in several places.
You've been breaking the site guidelines badly in this thread. In particular, the way you've crossed into personal attack and nationalistic flamewar is not ok and will get an account banned.
We've had to warn you about this kind of thing in the past. If you'd please review https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.
Europe had Ukraine sabotage (according to European reports) its gas lines and gave it more weapons as a reward… so I guess the answer is that it’s complicated.
German intelligence thinks so… maybe they’re garbage. Also “the island” and “the guardian” maybe they’re garbage when they report on this but not on other things.
The former German president has/had a consulting contract with Gazprom, and refused to stop it after the invasion. There are large groups in government who received payments from russian sources. A state minister actively worked to circumvent US sanctions.
So unless someone from German intelligence goes on the record I'd be very reluctant to believe any of these anti-Ukraine claims leaked to the press.
There's an interesting book called "BND: Bedingt Dienstbereit" which talks about German intelligence headquarters in Munich. The eastern German spies from the Stasi had their offices right across the street and they used that location to train new spies.
At some point BND learned that the Stasi was actively monitoring their offices, but they could never figure out where the Stasi was located in Munich. The BND always suspected a Turkish national who rant he vegetable shop at the ground floor of their building to be a foreign spy, but never noticed the Stasi offices used for training purposes right across the street.
So while I'm confident German intelligence has improved from those days it shows that the variance in skill level is quite high.
Russia conduct cyber attacks on US all the time. North Korea did a high profile attack too. China flew a balloon over the whole country, not bothering a single airport, without any response. US never does anything to anyone that can hit back.
> Yes, you're missing that if you mess with the power grid the US will go and kinetically strike back (read: bomb your country) or attack you with its own cyber warfare capabilities, unlike the EU.
Sounds too good to be true. I'd love to believe it.
Didn't russia claim to have the full Epstein files, so how did they get them if not by hacking US government?
Attribution of cyber attacks is extremely difficult, and US seems to notoriously under invest into infrastructure. Unlike other countries, most of the power grid is above ground. How can you be so sure that it is safe?
> Unlike other countries, most of the power grid is above ground. How can you be so sure that it is safe?
I didn't say it was safe by virtue of defensive capabilities, but it's safe by virtue of the US will very likely come bomb you or use its own cyber capabilities if you do something to the US. This is in contrast to the EU which was the comparison point, which is unable and unwilling to do much against cyber attacks.
My original post was more focused on defensive capabilities, but those things are hard to discern - you need to know about vulnerabilities in order to protect yourself from them.
If the damage is done, of course the US can massively retaliate. But ideally no damage is done :)
Ideally yes, but there's a cost. All I was saying was that the US is better equipped than the EU because both are vulnerable but the US actually has and is willing to use offensive capabilities, which provide a defensive deterrent to an aggressor.
If US had such amazing offensive cyber capabilities, why are bug bounties like HackerOne not already bankrupt? The NSA hackers could just easily farm all those bounties and make significantly more than they earn at the government.
I feel the answer to this is that most of what we call NSA offensive capabilities are not "real" offensive capabilities in terms of vulnerabilities and exploits, but simple backdoors in US equipment and US tech companies.
And I think they got really complacent because analyzing Facebook, Google and Apple data combined with credit card payments, phone call and browser history is doing the job just fine in 90% of the cases.
Due to large size of US traditional military, they have advanced capabilities in terms of physical network tapping that many other countries don't possess. Maybe they have super binoculars to spy on people typing in their passwords through the window from space. But in the end it is again white-collar "analysts" going through the data instead of clever people actually finding novel vulnerabilities in software, which is also the skill that is rewarded in bug bounties such as HackerOne.
Why invest into learning how to reverse engineer a cisco router if you can just call your buddy at Cisco and tell them to commit a new backdoor to the code.
By not using these skills they atrophy and once you hit a "real" adversary who is not on Windows and permanently uploading their data to Facebook and iCloud while using a credit card with apple pay, they might struggle very much.
I recall things like omg cable being a revolution in red team pentesting. Of course they had prototypes before, but I don't think it was widely utilized. Because why invest into such fancy hardware gimmicks if you can get the data directly from a US tech company who is forced to provide access for you anyways. It's much cheaper and more reliable.
Edit: I just noticed that due to this significant reliance on backdoors in US equipment they also hurt the defensive posture much more. It's difficult to have different versions of firmware floating around and to ensure they are deployed for your own companies. It's much easier to add backdoors to companies from your own country than to add backdoors to foreign equipment. This is totally in line with what we observe with endless CVEs and backdoors in US networking equipment.
> New construction on thermoelectric power plants and other hydroelectric plants has been stalled for years, and localised power cuts are a daily occurrence around Venezuela.
> There have also been problems with the supply from the Guri dam in the past.
> In 2010, Maduro’s predecessor, Hugo Chávez, declared an “electricity emergency” after a drought caused by the El Niño weather phenomenon left waters at the dam dangerously low.
> Six years later, Venezuela’s worst drought in four decades again affected the Guri dam, which then provided about 70% of the country’s electricity.
> In May last year, a union leader representing workers in the state power corporation, was arrested by Venezuela’s intelligence service, Sebin, after warning that poor maintenance and systemic problems meant that a blackout was likely to happen.
I will use an extract from the Spanish Wikipedia article[2] about the 2019 blackouts because it summarizes the situation pretty well:
> On March 9, Ángel Javier Sequea, head of office and operations in Guyana, was found dead after being detained by SEBIN.[3] Ángel Javier left a recorded audio message about the lack of maintenance on high-voltage power lines. He worked for 13 years in the powerhouse next to the turbines at the Caruachi Plant.
> Between the night of March 11 and the early morning of March 12, 2019, SEBIN agents arrested and raided the Caracas home of journalist Luis Carlos Díaz, who was then transferred to the Helicoide.[4] Díaz was accused of inciting the blackout.[5] On the night of March 12, 2019, he was released after a hearing in the Caracas courts, in which, according to the organization Espacio Público, he was charged with the crime of “incitement to commit a crime” and was required to appear in court every eight days and prohibited from leaving the country, speaking to the media, and participating in public demonstrations[6]. On March 22, Francisco Alarcón Orozco, secretary of the Corpoelec union, was found hanged under strange circumstances[7]. Govany Zambrano, a Corpoelec worker, was arrested after participating in a press conference[8]. “Our infrastructure at the national level is in a state of neglect, vandalism, abandonment, and terrible conditions...” The government never accepted failure due to lack of maintenance as the main cause, as explained in 2010 by José Aguilar, an expert in electrical risk and international advisor[9].
As a Venezuelan, I can say that the national electrical system is in a terrible condition, with constant blackouts and power surges that damage household appliances and industrial equipment. Depending on the time of year, blackouts become more and more intense. It's very common to see news reports of areas that have lost power, and it can take weeks for CORPOELEC (the national electricity company) to fix the problem and depending on the location, even months.
No one here doubts that the blackouts of 2019 and all those that followed have been the government's fault due to lack of maintenance, failure to renew equipment, and failure to build new power plants.
Years ago, there were plans to install renewable energy sources such as windmills on the coast, but all the money disappeared thanks to the typical corruption around here[10].
Stuxnet was 15 years ago. This isn’t crazy news, it’s just the first time it’s being reported openly
I think I just got Mandela-Effected, I had to look this up. For some reason I thought Stuxnet was something that happened in the 90s, not late 2000s.
It happened to 90s systems which were used in the 2000s so you are still technically correct ;)
The opposite of technically correct - there's some logic to their thinking of it as being about the 90s, but technically it very much did not happen "in the 90s".
Ok so we settle for technically incorrect ;)
The worst kind
Because cyber is not a flashy capability like a new jet or missile but it's an area where the US has the clear edge: https://www.iiss.org/research-paper/2021/06/cyber-power---ti...
US cyber capabilities have an edge because they can analyze all of our data stored with US tech companies and they have interception points on all major internet cables.
Their human intelligence is much better prepared to "convince" someone to act against their own interest if they can look at your last ten years of communication, family pictures, and web browsing history before they even meet you.
Imagine working in a foreign country where death penalty is applied to certain crimes, like blasphemy or homosexuality. They just need to find one person in the target organization who has a secret twitter account that talked badly about god and then they hit them up and tell them to plug in a certain USB stick to a certain system. Cyber operation succeeded because they have a shell.
Your first sentence makes it sound like there’s a “gotcha” coming,
and then the rest of the comment just explains why the user you’re replying to is correct.
Other than Americans wanting to feel superior (no offence intended, I'm sure most countries want to feel that when possible!) is there actually any public evidence that's the case?
Even when it comes to superiority of physical military forces, different people (with a range of different biases) have different opinions on stuff like whether a hot, all-out (but non-nuclear) war between USA and China would prove one or the other to be stronger, and while you may read that and think "I know which side is better and anyone who disagrees is just buying into delusional propaganda" at least to form that view you've had the ability to follow a lot of publicly available details on military developments over the years, learning about current and next gen fighter jets, drones, ships... etc.
But when it comes to cyber stuff, both offensive and defensive, it's generally a lot more secretive in terms of stuff that's actually been done (see for example the speculation in this thread that US power grid failures in recent years might have been caused by foreign adversaries - there's no evidence that's true, but if the US and China had both spent the last decade trying to take offline as many of the other country's power grids as possible we likely wouldn't have heard about it). Yet alone for hypothetical but saved for war capabilities. If a hot WW3 broke out tomorrow, who actually knows what hacking tools any country (from superpowers to smaller players) actually has, waiting to be used? Presumably they all spend a lot of effort trying to learn about each other's capabilities, and maybe they're successful enough that they actually do all know most of what everyone else can do - but they don't then announce that the way we hear about North Korea testing a new missile or about America developing a new fighter jet. I feel like we the general public just have no idea how advanced or not wartime capabilities might be. Am I wrong? (I may well be, as I'm in no way an expert in this field; I just believe that things like the document you linked are massively influenced by both the politics of the authors and the information available to them.)
Those young reporters were still at uni 15 years ago.
https://archive.is/rUYS4
I’m stuck Ina captcha loop with this site today
Third world countries lack the resources to secure their ICS and SCADA. Corrupted US govt doesn't even need NSA's capabilities for this.
Not sure if that’s the right way to divide the world.
Actually, poor countries can leverage cyber to pose a much bigger threat than they could traditionally.
Or in other words: Cyber can be used for asymmetric warfare. In relative terms, poor countries cause a lot more damage than rich ones.
There's also great potential to build misattribution in. Just pause between combining the attacks from the Internet and renaming variables to watch a Dolph Lundgren movie.
This. Also do not underestimate developing countries internal security budgets. Most middle income countries can now afford DACH sized cybersecurity procurement deals.
I think you missed the parents point. They were saying they don't have the resources for proper defense, my guess is parent would agree about their offensive capabilities
China should help them.
Beijing tells Chinese firms to stop using US and Israeli cybersecurity software - https://news.ycombinator.com/item?id=46618949 - January 2026
It's a performative announcement - most American and Israeli cybersecurity vendors either don't sell in China or white label a Chinese product for the Chinese market.
I know 2 companies in that list that have done that very thing because otherwise it would have put their FedRAMP and CMMC pipelines at risk.
I worked at a place that faced exactly that.
I initially was in the Huawei client engagement where they wanted copies of all of our source code. We said “no, nobody gets that”. They just keep asking over and over.
On one hand, that seems like a sure way to get your product copied. On the other, they’d be totally nuts to run a cybersecurity product without the source code, right?
Seems like a situation where getting the interests to align is just very difficult.
Even with white labeled products so they stay legally compliant, is it really justifiable to increase the risk? They're having people flying in and out for "sales meetings", shared office spaces, devices, maybe even staff overlap.
I understand it's a good way to make money but it comes with some tail risk.
Basically, a Chinese MSSP or SI is selected and given the American/Israeli company's logo and makes a revenue share agreement, and an airgapped environment using a distinct fork is deployed.
That said, most companies decide not to operate in the Chinese market - the TAM is too small for the headaches that it entails (losing Gov and NATO+ defense procurement opportunities).
Makes sense, thanks for elaborating. Just the logistics of it sound like a lot of overhead.
Usually it's included as a sweetener for a contract (generally LVM...(cough cough)...EMEA).
unlike rich countries, which only lack the will and care to secure their ICS and SCADA /s
Or the US in particular that applies a lot of resources into willfully keeping every ICS and SCADA out there insecure, including their own.
> Corrupted US govt
and Venezuela govt is not corrupt?
"Murder is bad!"
"So rape isn't?!"
Come on.
Every govt is. But whoever has most power is most corrupted.
You're using "false equivalence" bias. Not every government is bad, especially if you still have russia, iran, and others as ongoing contenders for worst crimes against humanity.
So saying "every government is bad" is simply a bad faith argument and you should shamefully sink towards the planet core for using it. Andorra is not as bad as russia or iran.
Just yesterday there was a video where russian soldiers tie an anti tank mine around the torso of a black African mercenary soldier from Mali before forcing him on a suicide meat assault towards Ukrainian positions. Some countries are evil on another level.
Every govt's main agenda is to control and strip away any rights of the citizens. Directly or indirectly, that's their main motive. It will keep getting worse until people realize that anarchism will be the only choice.
[dead]
It would be funny in this case if it was really just an open SCADA for their entire power grid that they clicked “off”, then “on”.
The reality probably isn't far off... I know in the past the "breaches of critical infrastructure" breathlessly reported by the media have actually just been wide-open SNMPv2 services using the default community string. I'm sure something similar happened here. Turns out you can just connect to port 161, press "power off," and be reported in the news as an "advanced persistent threat actor"
Is it that, or is it more likely they paid some anti-Maduro electric company worker to walk into HQ and shove a dongle in the back of a PC somewhere on their internal network, ala Stuxnet?
I work in electricity, it wouldn't be one, but yeah essentially it's probably an unpatched RDP/vnc/remote desktop exploit. Or the password is contraseña123
I can see how a team of cyber bureaucrats is required to type in the fancy n you are using in your password. At least it is safe against brute forcing attempts with standard settings.
Is the US attacking Russia and China and India as well because they’re the biggest threats?
India has neither the ability nor the desire to attack the US. The very idea is silly.
The country has its hands full enough coping with its state of quasi-chaos and belligerent nuclear-armed neighbors without taking on the worlds leading superpower for absolutely no reason at all.
> India has neither the ability nor the desire to attack the US.
Extraordinarily wrong on the first part.
Some countries have even outsourced some of their cyberattack capability to Indian companies in the past, and not for cost reasons.
You need to give some details and arguments on your extraordinary claim because what can be asserted without evidence can also be dismissed without evidence.
https://www.cybercom.mil/About/Mission-and-Vision/ This is a 4-star command.
No: 1) big bully only bullies little guys. 2) big guys have nuclear deterrent.
The US is almost certainly ready to attack China, Russia, India, and every other country. Currently attacking? No, at least not on this scale.
Also: Why is India on your list? "Biggest", certainly, but in what way are they a threat?
I read GP as a commentary of BRICS. There may/may not be interference there by the US and/or Five Eyes.
Almost certainly not. The first impeachment trial revealed that Trump's foreign policy was for his personal benefit. It's pretty obvious Trump has figured out that nations, corporations and oligarchs will pay him for favors. I think the dots are connectable.
> In 2019, the Maduro government accused the United States of conducting a cyberattack on a hydropower plant that plunged much of the country into darkness for a week.
> The power failures caused sporadic outbursts of looting and unrest, bringing the government close to collapse.
Is there any particular reason to take this claim from Maduro at face value?
In the 2019 book "Sandworm", which discusses cyber warfare against infrastructure like this, but between Russia and Ukraine, the author begs the question in an interview with a US military/intelligence official,
"why doesn't the US go after these hackers and designate targeting civilian infrastructure as a crime?"
To which the response was essentially "The US would like to reserve those types of cyber attacks for their own uses"
These quotes are very loose, I read it last year, but essentially, the US didn't make a stink about older grid attacks in order to save face when the US does it.
Additionally, much of VZ's difficulty was due to the massive sanctions against the nation. Sanctions are effectively attacks on a nation's citizens to pressure the government. Disabling power infrastructure is absolutely in-line with the motives of sanctions and embargos.
I think perhaps nationalizing your oil companies, looting their assets for political reasons, and driving out the only people with the competencies to operate your only valuable industry might have a tiny bit to do with the state of the country.
I feel like Mother Goose had a cautionary tale about killing your golden goose that perhaps Venezuela’s leadership ought to read up on.
Good point. It's easier to say you got hacked by nation state actors than to tell your boss you accidentally screwed up a major system with no way to recover. It's not like 99% of the management could tell the difference.
Agree. In hindsight though the claim gets a little more credibility.
Is there a particular reason to take any state account of anything at all at face value? At some point you either have to accept to play the game or reject all news.
In this case, it fits squarely in with American foreign policy, especially their orientation towards Venezuelan chavismo.
It also fits squarely with corruption in Venezuela, specially regarding energy. Venezuela has been rationing electricity across the country since 2009 and has been involved in countless corruption scandals involving Odebrecht, PDVSA, Derwick Associates.
I understand the US's foreign policy is a global threat, but let's not let that be an excuse for the atrocities and corruption of tyrants in Venezuela and other places.
https://en.wikipedia.org/wiki/Energy_crisis_in_Venezuela
https://en.wikipedia.org/wiki/Odebrecht_case#Venezuela
https://en.wikipedia.org/wiki/Derwick_Associates
Perhaps. This seems somewhat suicidal of a corruption scheme for the leader of a country. Surely there must be easier ways to personally profit than making an international embarrassment of the country—every other country on earth manages this sort of graft just fine.
What is the scandal supposed to be in the first one? No water in the dam? Mismanagement? Nationalization itself?
The Derwick one seems pretty light too, at least the article here just mentions an accusation from a journalist. And even then, if we are using corruption/overbilling with regard to a government contractor as an "atrocity" now.. That's going to have wider repercussions than here.
And ok, Venezuela took bribes from another government contractor, along with many other countries. I wouldn't call that an atrocity, but if that's what it is I guess I will give you the benefit of the doubt about it.
I give you benefit of the doubt about everything really! I just don't know if you have packaged your case here well is all.
The scandal is that the energy crisis was declared in 2009, and 17 years later, after investing $100 billion of which up to $80 billion disappeared, there are still blackouts across the country. That's all in the first article. The Derwick one is not just one reporter either, there's local and international reporters involved including claims from Reporters Without Borders where reporters received "threats, pressures, bribe offers". That's also in the article.
As for the attrocities I meant the Maduro (and current) government in general. There are currently over 1000 political prisoners in the country, a mix of protesters, politicians, reporters, etc. A lot of them have been tortured and many have died in custody. Most of the sources from NGO are in Spanish but the Wikipedia is a good start, specially the section about the Maduro government [1]
If you check the news right now you'll see that only in the past month about 50 have been released. There's a huge effort in the country right now to get the hundreds of others out.
Ultimately, what I want to say is that while we can express disdain for the US government we can do the same for the Venezuelan one, even if they claim to be against each other. Maduro and his gang are not the victims here, they've oppressed the Venezuelan people for 27 years, let's not give them an easy out
[1] https://en.wikipedia.org/wiki/Torture_in_Venezuela
Maduro lies about many things, so his claims in particular should be viewed with more skepticism than any other state account picked at random.
Let's not take Maduro at his word, he's great at playing the victim to hide their corruption. Venezuela has been in an energy crisis since 2009 with rationing still happening everywhere in the country except in Caracas [1] big part of it from the Odebrecht corruption scandal [2]
[1] https://en.wikipedia.org/wiki/Energy_crisis_in_Venezuela
[2] https://en.wikipedia.org/wiki/Odebrecht_case#Venezuela
Let's hope those chicken never come home to roost. NSA has a history of losing offensive cyber tools.
IIRC both Texas and California had widespread power outages in the last few years. I am not convinced that US power grid is much better defended than the one in the EU.
> Let's hope those chicken never come home to roost.
Bare minimum it gives chinese tech suppliers a great pitch to convince buyers to choose their products over US suppliers. Even if theirs are also full of backdoors, at least they have no history of taking advantage of them to kidnap heads of state far away.
> at least they have no history of taking advantage of them to kidnap heads of state far away.
Ha. Someone else wrote:
> USA is only willing to fight very asymmetrical wars.
I say:
> China is only willing to kidnap defenseless people
Yes, you're missing that if you mess with the power grid the US will go and kinetically strike back (read: bomb your country) or attack you with its own cyber warfare capabilities, unlike the EU. That's why the EU is experiencing cyber attacks and cyber warfare with clear culpability from Russia, but is unable to do much about it besides give Ukraine more weapons. If Russia launched a cyber attack and shut down JFK the way it did Heathrow, the US would actually do something about it even with all the Trump is a Russian agent stuff aside.
[flagged]
Please don't cross into name-calling or personal attack and please don't be snarky in HN comments, no matter how wrong another comment is or you feel it is.
If you'd please review https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.
Sure, of course it's not that simple. If China for example did a cyber attack it doesn't necessitate an immediate kinetic response or some sort of gargantuan nation-state level warfare to take place.
But if one of those countries shut down the US power grid we absolutely would respond and you're naive to think that the US would not respond out of some "fear" about only fighting very asymmetric wars.
Amongst some there seems to be this idea that because the US has taken military action in other countries over the years, more recent being more important, and because those countries "couldn't fight back" that the US is unable or unwilling to take further action against other nation states that theoretically could fight back (India could not, for example as a weak military power with nuclear weapons), but instead I'd caution you look at those action with respect to the ability of other countries to take action.
In other words, it feels good to throw in zingers like the US only beats up on weaker countries or something which, let's be frank would be every country or bloc except China, but you're missing the fact that those countries are not even able to project power to or willingness or ability to attack other countries.
[flagged]
> I only remember that if one US state loses power the other states laugh about it because obviously it is because the current governor is a black female democrat.
Yea that's obviously dumb, but the difference is you hear about America's problems, but not the problems in other countries. Russia has its oil facilities regularly bombed. China has institutionalized corruption down to the local level. It's not all peaches and rainbows in every country on earth.
> It'd be great progress to actually detect what caused it in a timely manner and then do a proper cyber attribution.
Who says we aren't?
> Generally I think you are using a lot of big words to compensate for the fact that the US ignored the Minsk agreement.
Can you elaborate? What's the broader point you want to get at here?
> The russian government has been publicly joking about Trump, broadcasting nude pictures of the first lady and boasting about possessing the Epstein tapes. Before that was the hack of Hillary's mail server and fake news campaigns. No kinetic repercussions, even red carpet for putin's visit in Alaska.
Yes, totally. The United States should have bombed Russia for publicly joking about Donald Trump. Give me a break. Why even post stuff like this?
> Apart from all this a modern drone war would be a big problem for the US, and countries like Ukraine, russia and china are much better prepared for such a scenario.
Who do you think is operating in Ukraine and advising the Ukrainians and learning from their drone warfare techniques and capabilities? Do you really not know how this stuff works? Are you not aware that the United States is actively testing weapons in Ukraine to prepare for drone warfare? Is that why you're saying stuff like the US should have a kinetic response against Russia for posting pictures and joking about Donald Trump?
[flagged]
> I mean that by ignoring Minsk agreement and being a bitch about weapons deliveries on top of that, the US incentivized every single country to pursue access to nuclear capabilities.
Heh ok. I guess so. The US was a "bitch" about weapons deliveries (quick hide the numbers) therefore every single country is incentivized to pursue nuclear capabilities. Great argument you have there.
> They started with the public humiliation after they felt empowered because there was no credible US response to all the previous hacks that you glossed over in your response.
Name the hacks that were glossed over and what you feel is the appropriate response.
> Yes, the US stopped credit card payments and destroyed some payment terminals. I imagine they weaponized the apple and android devices, maybe this still continues. For a couple of days, we had those impressive russian rockets which turned around and destroyed their launcher. And of course the geofenced US weapon systems. But was US able to shut down any vital russian systems except starlink and McDonald's?
Sanctions seem to do the trick. But you probably aren't reading about and paying attention to the state of the Russian economy, or what equipment they're sending their soldiers to war in Ukraine with. Well, when they're not supplied by China that is.
How many Russian energy and oil facilities have been targeted by Ukrainian drone and missile strikes, and who do you think helped with the targeting?
> Old lavrov still walks around openly with his apple watch just to farm payloads.
Sure, why isn't the EU arresting him then? Why don't they launch operation Lavrov and go capture him? There's got to be a reason right? What reason do you think that is? It can't have anything to do with the US though, you can only explain why the EU isn't doing it.
> There are observers from many countries on the ground in Ukraine, and US might even be testing some weapons.
Yes, there are, but the relevant ones are from the United States and the United Kingdom. There's no "might" about the US testing new weapons, it's just a simple fact. And they're testing those weapons, both offensive and defensive, against drone warfare. Ukraine shares intelligence with the US.
> However US efforts are overshadowed by better performance of European weapons systems, both old and new.
What specific US efforts are overshadowed by better performance of European weapon systems?
> Meanwhile the US artificially limits supply for US systems, so they get destroyed because they need to preserve ammo.
Which ones?
> There is a lot of empty posturing and the results are really not speaking for the US.
Well we took down Iran and Venezuela, both Russian allies. Cuba is not looking good either. We're seizing Russian shadow fleet tankers (we've seized more in a month than the EU has since the start of the war), we've upheld sanctions and increased sanctions while Putin and his henchmen's kids galavant around Europe and the US continues to provide intelligence sharing to help Ukraine with targeting, advice, materials and equipment, and more.
The EU of course has helped too, but unlike you I'm not downplaying one party's involvement and participation and instead defending one party, as I would defend the EU if someone claimed they weren't doing anything either.
Please don't break the site guidelines, regardless of how badly another account may be doing so. Your comments have not been nearly as aggressive as the other's (that's good), but you've still gone over the line in several places.
If you'd please review https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.
Sorry, I'll try and do better. My bad. Thank you for the reminder.
[flagged]
You've been breaking the site guidelines badly in this thread. In particular, the way you've crossed into personal attack and nationalistic flamewar is not ok and will get an account banned.
We've had to warn you about this kind of thing in the past. If you'd please review https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.
Europe had Ukraine sabotage (according to European reports) its gas lines and gave it more weapons as a reward… so I guess the answer is that it’s complicated.
source: toilet in google headquarters
German intelligence thinks so… maybe they’re garbage. Also “the island” and “the guardian” maybe they’re garbage when they report on this but not on other things.
The former German president has/had a consulting contract with Gazprom, and refused to stop it after the invasion. There are large groups in government who received payments from russian sources. A state minister actively worked to circumvent US sanctions.
So unless someone from German intelligence goes on the record I'd be very reluctant to believe any of these anti-Ukraine claims leaked to the press.
There's an interesting book called "BND: Bedingt Dienstbereit" which talks about German intelligence headquarters in Munich. The eastern German spies from the Stasi had their offices right across the street and they used that location to train new spies.
At some point BND learned that the Stasi was actively monitoring their offices, but they could never figure out where the Stasi was located in Munich. The BND always suspected a Turkish national who rant he vegetable shop at the ground floor of their building to be a foreign spy, but never noticed the Stasi offices used for training purposes right across the street.
So while I'm confident German intelligence has improved from those days it shows that the variance in skill level is quite high.
Russia conduct cyber attacks on US all the time. North Korea did a high profile attack too. China flew a balloon over the whole country, not bothering a single airport, without any response. US never does anything to anyone that can hit back.
Three points:
1. You don't actually know what actions the US has taken.
2. The only country outside of one using nuclear bombs that could theoretically "hit back" is China.
3. Flying some balloons across the US doesn't necessarily necessitate some sort of massive response. There's levels.
Oh I thought you said the actions would be kinetic.
No, sorry. I wrote:
> Yes, you're missing that if you mess with the power grid the US will go and kinetically strike back (read: bomb your country) or attack you with its own cyber warfare capabilities, unlike the EU.
Sounds too good to be true. I'd love to believe it.
Didn't russia claim to have the full Epstein files, so how did they get them if not by hacking US government?
Attribution of cyber attacks is extremely difficult, and US seems to notoriously under invest into infrastructure. Unlike other countries, most of the power grid is above ground. How can you be so sure that it is safe?
> Unlike other countries, most of the power grid is above ground. How can you be so sure that it is safe?
I didn't say it was safe by virtue of defensive capabilities, but it's safe by virtue of the US will very likely come bomb you or use its own cyber capabilities if you do something to the US. This is in contrast to the EU which was the comparison point, which is unable and unwilling to do much against cyber attacks.
My original post was more focused on defensive capabilities, but those things are hard to discern - you need to know about vulnerabilities in order to protect yourself from them.
If the damage is done, of course the US can massively retaliate. But ideally no damage is done :)
Ideally yes, but there's a cost. All I was saying was that the US is better equipped than the EU because both are vulnerable but the US actually has and is willing to use offensive capabilities, which provide a defensive deterrent to an aggressor.
If US had such amazing offensive cyber capabilities, why are bug bounties like HackerOne not already bankrupt? The NSA hackers could just easily farm all those bounties and make significantly more than they earn at the government.
I feel the answer to this is that most of what we call NSA offensive capabilities are not "real" offensive capabilities in terms of vulnerabilities and exploits, but simple backdoors in US equipment and US tech companies.
And I think they got really complacent because analyzing Facebook, Google and Apple data combined with credit card payments, phone call and browser history is doing the job just fine in 90% of the cases.
Due to large size of US traditional military, they have advanced capabilities in terms of physical network tapping that many other countries don't possess. Maybe they have super binoculars to spy on people typing in their passwords through the window from space. But in the end it is again white-collar "analysts" going through the data instead of clever people actually finding novel vulnerabilities in software, which is also the skill that is rewarded in bug bounties such as HackerOne.
Why invest into learning how to reverse engineer a cisco router if you can just call your buddy at Cisco and tell them to commit a new backdoor to the code.
By not using these skills they atrophy and once you hit a "real" adversary who is not on Windows and permanently uploading their data to Facebook and iCloud while using a credit card with apple pay, they might struggle very much.
I recall things like omg cable being a revolution in red team pentesting. Of course they had prototypes before, but I don't think it was widely utilized. Because why invest into such fancy hardware gimmicks if you can get the data directly from a US tech company who is forced to provide access for you anyways. It's much cheaper and more reliable.
Edit: I just noticed that due to this significant reliance on backdoors in US equipment they also hurt the defensive posture much more. It's difficult to have different versions of firmware floating around and to ensure they are deployed for your own companies. It's much easier to add backdoors to companies from your own country than to add backdoors to foreign equipment. This is totally in line with what we observe with endless CVEs and backdoors in US networking equipment.
China just has white collar analysts and no real cyber capabilities because if they did then all the bug bounty websites would be out of business.
Swap the US/China here and you can see for yourself why you're making a poor argument.
According to The Guardian[1]:
> New construction on thermoelectric power plants and other hydroelectric plants has been stalled for years, and localised power cuts are a daily occurrence around Venezuela.
> There have also been problems with the supply from the Guri dam in the past.
> In 2010, Maduro’s predecessor, Hugo Chávez, declared an “electricity emergency” after a drought caused by the El Niño weather phenomenon left waters at the dam dangerously low.
> Six years later, Venezuela’s worst drought in four decades again affected the Guri dam, which then provided about 70% of the country’s electricity.
> In May last year, a union leader representing workers in the state power corporation, was arrested by Venezuela’s intelligence service, Sebin, after warning that poor maintenance and systemic problems meant that a blackout was likely to happen.
I will use an extract from the Spanish Wikipedia article[2] about the 2019 blackouts because it summarizes the situation pretty well:
> On March 9, Ángel Javier Sequea, head of office and operations in Guyana, was found dead after being detained by SEBIN.[3] Ángel Javier left a recorded audio message about the lack of maintenance on high-voltage power lines. He worked for 13 years in the powerhouse next to the turbines at the Caruachi Plant.
> Between the night of March 11 and the early morning of March 12, 2019, SEBIN agents arrested and raided the Caracas home of journalist Luis Carlos Díaz, who was then transferred to the Helicoide.[4] Díaz was accused of inciting the blackout.[5] On the night of March 12, 2019, he was released after a hearing in the Caracas courts, in which, according to the organization Espacio Público, he was charged with the crime of “incitement to commit a crime” and was required to appear in court every eight days and prohibited from leaving the country, speaking to the media, and participating in public demonstrations[6]. On March 22, Francisco Alarcón Orozco, secretary of the Corpoelec union, was found hanged under strange circumstances[7]. Govany Zambrano, a Corpoelec worker, was arrested after participating in a press conference[8]. “Our infrastructure at the national level is in a state of neglect, vandalism, abandonment, and terrible conditions...” The government never accepted failure due to lack of maintenance as the main cause, as explained in 2010 by José Aguilar, an expert in electrical risk and international advisor[9].
As a Venezuelan, I can say that the national electrical system is in a terrible condition, with constant blackouts and power surges that damage household appliances and industrial equipment. Depending on the time of year, blackouts become more and more intense. It's very common to see news reports of areas that have lost power, and it can take weeks for CORPOELEC (the national electricity company) to fix the problem and depending on the location, even months.
No one here doubts that the blackouts of 2019 and all those that followed have been the government's fault due to lack of maintenance, failure to renew equipment, and failure to build new power plants.
Years ago, there were plans to install renewable energy sources such as windmills on the coast, but all the money disappeared thanks to the typical corruption around here[10].
[1] https://www.theguardian.com/world/2019/mar/13/venezuela-blac...
[2] https://es.wikipedia.org/wiki/Apagones_de_Venezuela_de_2019
[3] https://www.aporrea.org/ddhh/n339228.html
[4] https://www.europapress.es/nacional/noticia-detenido-caracas...
[5] https://elpais.com/internacional/2019/03/12/actualidad/15523...
[6] https://www.elmundo.es/internacional/2019/03/13/5c888f29fc6c...
[7] http://www.venezuelaaldia.com/2019/03/23/muere-otro-trabajad...
[8] https://web.archive.org/web/20190713213240/http://puntodecor...
[9] https://web.archive.org/web/20100816181129/http://www.el-nac...
[10] https://climatetrackerlatam.org/historias/la-paralizacion-de...
javascript only
They can only do JS cyberattacks?
Maybe they need to use RISC-V assembly ;).