Hacking Group Linked To Chinese Army Caught Attacking Dummy Water Plant 214
holy_calamity writes "MIT Technology Review reports that APT1, the China-based hacking group said to steal data from U.S. companies, has been caught taking over a decoy water plant control system. The honeypot mimicked the remote access control panels and physical control system of a U.S. municipal water plant. The decoy was one of 12 set up in 8 countries around the world, which together attracted more than 70 attacks, 10 of which completely compromised the control system. China and Russia were the leading sources of the attacks. The researcher behind the study says his results provide the first clear evidence that people actively seek to exploit the many security problems of industrial systems."
Actually... (Score:5, Funny)
Re: (Score:2)
Along the lines of telling the Germans "All your spies are belong to us".
Re: (Score:3, Insightful)
The honeypot plants may have been more real than real plants. Chances are real plants have nothing this sophisticated.
(Some of these honeypots were designed to look like they were "located" in China, Russia, Australia, and Brazil. Did they think the attackers would be fooled by these things? Not all of those places would be running the same model of water plant.).
Then it says:
None of the attacks displayed a particularly high level of sophistication, says Wilhoit, but the attackers were clearly well versed in the all-too easily compromised workings of industrial control systems. Four of the attacks displayed a high level of knowledge about industrial systems, using techniques to meddle with a specific communication protocol used to control industrial hardware.
Well which is it? Not too sophisticated, but the busted into his lame decoys easily enough.
He was able to access data from their Wi-Fi cards to triangulate their location.
He claims to have triangulated where the
Re:Actually... (Score:5, Interesting)
Forcing a door open is not the same as sophisticated lock picking. But nonetheless, the point about sophistication seems to be what they did once they got access. Most did menial tasks while 4 meddled with a specific communication protocol.
I'm not sure your reading comprehension is up to speed here. The web interface that was hacked embedded an exploit framework called BeEF [beefproject.com] so the researcher could gain access to the attackers system through the browser. What he likely did was query the networks detected by the wifi cards then crossed them to data from sites like WiGLE [wigle.net] or perhaps something even more specific.
This is more then enough to get a Geographical location of a person and narrow it down to not only country, but city and even neighborhoods within the city.
Oh, and the triangulation isn't on where the wifi car itself accesses a router, but with the names of the specific networks the wifi cards can see. If you see several distinctly different named networks, the odds of them being in more then one location is low so you know it has to be a location close enough to all of them to be seen at the same time. For instance, if I see the SSIDs duck_butter, shoreline, bbangsoon, and linksys, I can find that I am near the Chicago Water Commissioner's office at Pfc Milton Olive park, near the Chicago harbor. Go ahead and look it up. [wigle.net]
I think that happens to all of us every once in a while. I was laughing pretty good earlier at someone too.
Re: (Score:2)
Using a compromised machine to do your hacking is pretty basic. I imagine the wifi cards in question are in compromised machines, not the attackers.
Re: (Score:3)
I'm not trying to defend WiGLE but it isn't really identifying by IP or any other stock measure. I understand about the geolocation data based on IP addresses but the WiGLE site is mostly user generated by war drivers along with GPS data built by programs like Kismet and netstumbler. It refines the locations by averaging the latitudes and longitudes of the SSIDs gathered using the signal strength (squared) as a weight.
In other words, it relies on users- not out dated published materials who have visited the
Re: (Score:2)
InSANE -- why...?!!! (Score:5, Insightful)
Why are critical systems on the 'net?
They functioned perfectly 30 years ago without the internet...
CAPTCHA = 'yourself'
Re: (Score:3)
Remote access for people who don't want to be physically at the plant.
IE: Management
Re: (Score:2)
Give them a locked down laptop for a couple thousand dollar which can only log into the VPN for the plant and fuck all else.
Re: (Score:2)
Re:InSANE -- why...?!!! (Score:4, Insightful)
So one lower cost, union free, engineer can be contracted to look over many subsystems from a great distance.
vs having local technical staff who need paying and pensions. Local staff over time may get to know their legal rights and fight for their wages - state and federal.
You also had heavy commercial lobby efforts to update State control systems to 'save' cash long term.
Products using industrial "solutions" created for secure site networks where spread over vast state or regional networks via the 'internet' or 'wireless'.
ie States trying to get rid of on site long term union staff and great sales reps moving around cities and states with networks to sell.
Re:InSANE -- why...?!!! (Score:5, Insightful)
you forgot "Based in Bangalor" in regards to the low cost engineer
Re: (Score:2)
No he's right. Busting unions is a greater benefit than exposing a security risk to Chinese crackers.
One is allowing a mind-virus to establish a foothold after glorious leader Reagan exposed them for the frauds they are and the other is a minor technical issue wich will be patched next Tuesday.
It's interesting, isn't it, that there exists people who actually think like this.
No not really... they don't drink tap water... that's for common foke and animals... Have you ever heard about...fluorination of water? Do you know what that does to a man??? Do you know where it comes from?
Re:InSANE -- why...?!!! (Score:4, Interesting)
Plants nowadays always have some kind of remote SCADA. The network between sites may be isolated, but somewhere along the line there is often an internet-connected computer that will also have a connection to the isolated network for client-side monitoring and control software.
All that it takes it to hack one of these. They pretty much always exist, even if they shouldn't. Someone will connect a cable so they can browse Facebook while monitoring sites.
Re: (Score:2)
Those computers should be set up to make sirens blare the moment they get a second network connection besides the internal LAN ... it should take intentional hacking to connect these computers to the internet or to connect a non-allowed computer to the internal network (normal computers aren't designed to be quiet on a network connection). It shouldn't be as easy as pulling a sticker off a USB/network port, or connecting your normal computer with internet into the internal network.
The problem isn't that "so
Why are critical systems on the 'net? (Score:5, Insightful)
In part, perhaps because 30 years ago the advantages of/needs for large scale efficiency and coordination weren't so great as today? Isolated systems may have higher operations costs and may not efficiently integrate into big systems, but they tend to have few or no remote attack vulnerabilities. Bottom line: economics favor connected systems, and anything on the net can be pwned.
Re: (Score:2)
It's understandable that those systems need to be connected to each other, but in that case they should have their own, completely isolated network to do so, preferably one that is utterly incapable of connecting to the Internet at large. The current setup is just begging for disaster, which is a 'when', not an 'if'.
Exposing these systems on the Internet is just lunacy.
Re:Why are critical systems on the 'net? (Score:5, Funny)
It's understandable that those systems need to be connected to each other, but in that case they should have their own, completely isolated network to do so, preferably one that is utterly incapable of connecting to the Internet at large.
But DUDE!, If we did this, we'd like, have to connect all those power grids with, like - wires! Where we gonna get that?
Re: (Score:2, Insightful)
More sensibly under law, all remote control system for essential infrastructure should be banned unless they can be guaranteed (as in you 'WILL' go to prison) secure. Can't secure it to that level, then don't do it because you do not have the right to privatise the minimal gain profits whilst socialising the huge cost of failure (including lives lost).
Quite simply this provides only two things. First, honey pots are really good at attracting a focusing attention and should be inserted on all high securit
Re: (Score:2)
Yep, the solution is that simple ... make them criminally liable and make shit roll uphill (ie. go after management). First suit behind bars is the first time they get serious about security.
Re:Why are critical systems on the 'net? (Score:5, Insightful)
So you would have the city leasing expensive lines between plants? I've not met too many people who complained their taxes and water rates were too low, and that they wanted the same service with more security and were willing to pay extra for it. I do, however, see a constant parade of talking heads on TV who bitch incessantly about how high taxes are, how they'll cut taxes when they get in office, or that government budgets should be cut by 10%. Well, their budgets were cut and so the cities cut their corners, and saved whatever money they could, and now their water system is in the hands of hackers. They got exactly what the taxpayers told them they were willing to pay for. We have the exact systems we deserve.
Could they and should they beef up their security? Of course. But does each water system owner even know if they have a problem? These guys are civil engineers in sleepy little towns, not security wonks. They probably didn't install the ICS themselves, they probably contracted all that out, and among the site survey forms they filled out was "choose your system password (minimum 6 characters)" and trusted the vendor to provide the rest of the security (back in 1993 when they installed it.) They might not even know they can change it, or how to change it. or that they need to do something different. Even if they did, the first rule of ICS configuration is "DON'T TOUCH IT!" So don't expect them to get all excited about the chance to make a change.
They would likely learn a lot more about these problems at their state's annual public works conference, if their city can afford to send them this year, and if their state can afford to hold one.
Re:Why are critical systems on the 'net? (Score:4, Insightful)
Re:Why are critical systems on the 'net? (Score:4, Insightful)
The PHB is often not a manager, but a clueless engineer who spends $10,000,000 to build a SCADA network air-gapped from the IT's LAN, then sets up a computer on the LAN and SCADA with remote login enabled, and AAA managed by local user accounts on an XP system. Then, when a problem happens, goes to the COO and complains that IT is not letting him do his job.
Don't laugh, I've seen it multiple times. Every time with oil drillers, one of which owned the Deepwater Horizon, the others in Alaska.
Re: (Score:2)
But to your second point, absolutely agree.
Re: (Score:2)
And why does everyone assume you can't run IPSec over private point to multipoint WANs?
Because the Internet is cheaper and more reliable. Sensible people run a dynamic multipoint VPN over the Internet if they are going to run full end-to-end encryption. So the only sensible assumption is that someone paying for a "private" circuit is not running encryption (aside from the US government, who leases dedicated circuits, and then encrypts everything over it).
Re: (Score:2)
Re: (Score:2)
Let me know when you deliver voice to a few THOUSAND registered voice endpoints over DMVPN on the Internet and tell me how it goes for you.
The largest DMVPN network is 20+ THOUSAND nodes. And if you are encrypting everything over MPLS, you have as many encrypted endpoints as the DMVPN solution. What are you using for your thousands of encrypted endpoints in your MPLS network?
Re: (Score:2)
I've never seen anything that can't be delivered over the Internet
Now you have [wikipedia.org].
What are you using for your thousands of encrypted endpoints in your MPLS network?
GET VPN on ISR G2 at branches. Voice endpoints behind those.
Re: (Score:2)
The Real-time Transport Protocol (RTP) defines a standardized packet format for delivering audio and video over IP networks
Your link proves you wrong. Perhaps you meant to include "with some arbitrary SLA I assign", but without such caveots, I will not add them for you.
GET VPN on ISR G2 at branches.
GET VPN *is* a dynamic multipoint VPN (And GET VPN and DMVPN are often combined, in practice). Both work fine over the Internet (and in fact, were both designed to do so). Note, I didn't say DMVPN, until addressing your comments on it. I spelled it out in lower case, including all dynamic multipoint VPNs, not just Cisco's proprietary DMVPN (tm).
As a security
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
MPLS exists to economically sell VLANs over shared networks.
Read this carefully: You. Have. No. Idea. What. You. Are. Talking. About.
Bye.
Re: (Score:2)
Ok, you're missing the point here so I'll spell it out: you cannot reliably deliver voice service over the public Internet in an enterprise environment
So you were lying when you said "The Internet can't carry RTP". Glad you cleared that up, but that doesn't make you right on any particular point.
Re: (Score:2)
You cannot deliver VoIP (RTP) to a geographically dispersed WAN over the Internet at scale. I've done it, you haven't.
It can't be done, but you've done it? And you've done it, but know for a fact I can't and haven't?
You aren't even bothering to remain consistent within the same sentence.
Read this carefully: You. Have. No. Idea. What. You. Are. Talking. About.
Yeah, I'm a top technical guy working on one of the largest MPLS networks on the planet, and *I'm* the one that doesn't know what it is...
You are wrong on every point, but getting so emotionally attached to your superiority that you've lsot it. Some frothing-at-the-mouth cave dweller mad because someone somewhere might be better at what
Re: (Score:2)
Re: (Score:2)
I mourn for your users.
Well, considering my network provides end-to-end delivery guarantees and you use the best-effort Internet, I think mine will be far better off. Oh right, you don't actually build networks. You're a "Security Expert".
Re: Why are critical systems on the 'net? (Score:2)
Then you are the most inexperienced of computer users.
You really mean to say you've never experienced lag? That alone is why VoIP sucks ass in every single instance I've ever seen.
Re: (Score:2)
Re: (Score:2)
Sorry, but your MPLS WAN is far LESS SECURE than a proper IPSec tunnel over the internet, while being vastly more expensive.
Re: (Score:2)
Re: (Score:2)
Yes, because if you are, then the high cost of MPLS is quite pointless for you. The end-points being on an MPLS network are harder to reach by the public, but you could pretty well accomplish the same thing with a good firewall dropping communications to/from your IPSec endpoint from every IP other than the single intended source/destination IP address. You could harden it to an extreme degree with a bridging/transparent firewall.
Re: (Score:2)
Re: (Score:2)
No, but you don't NEED a "guarantee". A great many people use VoIP successfully over the internet every day. There are extremely few companies where the quality of the calls are ultra-critical. A 911 emergency response center would be one, but even for high profile business activities, a rare packet delay or drop will barely be noticeable, and won't have any effects on business operations.
Re: (Score:2)
Having QoS on the routers, firewalls, or whatever endpoint at BOTH ends, will also allow you to prioritize voice traffic, and throttle all others.
Long gone are the days of congested backbones. The congestion is in the "last mile", and you can control that with QoS queue prioritize and throttling at both of your endpoints.
MPLS is a terribly expensive choice if all you need it for is allowing you to avoid doing proper QoS on your own network.
I want to touch on this in particular, because I think you're confused. It's not about QoS on MY network, it's about all the intermediary devices respecting the QoS values that I set on traffic, and that traffic is delivered to CPE with the correct priority. What you do at the edge of your network, towards the Internet, has absolutely
Re: (Score:2)
Actually, the problem is YOUR ignorance, here, so you're still failing to understand what I'm explaining to you.
I never said anything about DSCP. "Tagging" a packet is the
Re: (Score:2)
That's a SLA contract issue, NOT a technical one.
I'm talking about RTT latency guarantees. My provider guarantees a CONUS 65ms RTT. I'm not talking about outage response time. I realize you have clearly never worked with leased circuits so this is totally lost on you. I'm sure you're learning a lot today.
VoIP has been designed to handle a reasonable amount of packet loss. An occasional bit of jitter or packet loss will not ruin your conversation.
VoIP is delivered via RTP, a UDP protocol. A packet lost is an interruption in voice. You cannot redeliver it, because it would arrive out of order. The fact that you think "an occasional bit of jitter or packet loss will not ruin your conversation
Re: (Score:2)
ignorance + arrogance = idiocy
Factually inaccurate statements make me doubt your story about deploying VoIP on a large scale. UDP makes no difference, and your incorrect assertion that VoIP has ZERO forward error correction is something I wouldn't even expect from an entry level CCNA.
And for the record, you most certainly can throttle incoming connections, it's just not as finely controllable and beneficial as outgoing QoS, which is more common. But I made it clear the first time around I was talking abou
Re: (Score:2)
Factually inaccurate statements make me doubt your story about deploying VoIP on a large scale. UDP makes no difference, and your incorrect assertion that VoIP has ZERO forward error correction is something I wouldn't even expect from an entry level CCNA.
Will not solve the problems associated with running large VoIP deployments on the public Internet. Period. You have clearly never done this, you're just guessing because you used Skype once. You don't seem to understand how sensitive voice traffic is, so I'd suggest you do a little reading [voip-info.org].
And for the record, you most certainly can throttle incoming connections, it's just not as finely controllable and beneficial as outgoing QoS, which is more common. But I made it clear the first time around I was talking about controlling both ends of the connection.
Not on the Internet. Let me explain this in a concrete example so you understand why you can't run QoS on the Internet.
1. User A starts a VoIP call over your Internet connection. For some reason you QoS outbound V
Re: (Score:3)
You don't get it dude. It's the Internet, a whole new paradigm. It' different this time. Now your workers can work from home 24/7 BYOD through a cloud enabled clustered virtual remote systems management tool.
Re:InSANE -- why...?!!! (Score:5, Funny)
I swear that last sentence was copied verbatim out of a PowerPoint slide our CIO sent around...
Re: (Score:3)
"Vent radioactive gas?" [types] Y E S.
"Sound alertness horn?" Y E S. [it sounds in the distance]
"Decalcify calcium ducts?" Well, give me a Y, give me a...Hey!
Re: (Score:2)
Homer is that you?
Re:InSANE -- why...?!!! (Score:5, Informative)
Re:InSANE -- why...?!!! (Score:5, Insightful)
Yeah! Fun! Saves money!
Here are the downsides: you're attacked at every IPv4 address about 100x a day by the bots, and much more densely if you look interesting. Without an air gap, you expose all your stuff to a bunch of hackers ranging from script-kiddies to those with power tools. None of them wants your PLC to run after they tweak a few knobs.
Multiple authentication and encryption methods (see the https attacks 'announced' at Black Hat) are becoming child's play. All of the incredible engineering that these things have gone through haven't had the funds needed/expended towards making them brutally difficult to crack. It's always an afterthought after the sales guy leaves.
It's also my biggest problem with the IEEE-- lots of wonderful protocols. Security is an afterthought, rather than being built from the onset into each platform. Look at the ludicrousness of WEP and WPA1. Tell me these guys were thinking. Sure, glorious and fast, and with security as paper-thin as can be.
Re: (Score:3)
Re: (Score:2)
I'm working IT in aerospace now. Not a day goes by that I don't mutter to myself, "and these guys build airplanes."
Re: (Score:2)
Re: (Score:2)
Yes, for the most part. And these guys just do cabin reconfigurations.
"I lost all my mapped drives and AutoCAD says my license is bad!"
"Yes, that's what happens when you connect the wifi to the Lowe's next door."
Re: (Score:3)
Re: (Score:2)
People with 'computer science' or equivalent education doing 'engineering' in their wicked ways have no fucking clue what the word engineering actually means,
"computer science" when I was at Texas A&M was an Electrical Engineering degree, bestowed by the Electrical Engineering department, and taught by Electrical Engineering faculty.
The difference is engineering (the real kind, I've done some work where the "engineer" was worse than the computer science you complain about), is about failure. Most people care whether something works. Engineers care whether something fails, and how. Trying to get someone to answer the "when you exceed operational guideline
and now the PHB saves big by remoteing it out (Score:2)
and now the PHB saves big by remoteing it out to one office.
Re: (Score:3)
Random guess?
TCP/IP is less expensive than developing your own network protocol. Using public data lines (the Internet) is less expensive than using your own private, leased lines. Using no encryption is less expensive than mediocre encryption, and a hell of a lot less expensive than serious encryption (you are either paying for developer time, or a library, or both).
Re: (Score:2)
Why are critical systems on the 'net? They functioned perfectly 30 years ago without the internet...
CAPTCHA = 'yourself'
Because these systems were not actually functioning perfectly 30 years ago. They are systems that are a bit newer than that, hence they didn't exist 30 years ago, thus they have the capability to be connected to the 'net. Networks reduced the cost of maintenance...
Look, just because the reasons aren't good reasons, doesn't mean they aren't reasons. I'm not disagreeing with you. You're the one asking "why?" In truth, I can't really tell you "why?" That's a religious question, and I'm a basement dwel
Re: (Score:3)
RIGHT! Having a dial-in modem on the PTSN was OH-SO-MUCH MORE SECURE!
Has absolutely NOBODY here ever seen the movie "War Games"?
Re: (Score:3)
Next time you think of posting a comment like that, could you please use a quill to write it on a piece of parchment and have it delivered by horse drawn mail carriage to the slashdot offices?
Re: (Score:3)
Nah. Just send in the drones. There have to be drones.
Re: (Score:2)
Next Steps (Score:5, Funny)
Spoof the interface to make the attackers believe they are attacking a foreign industrial plant.
In reality, they are attacking the utility plant located down street based on WiFi location.
The main purpose of the honeypot system is to obfuscate the true location of the target (the attackers own infrastructure).
Then watch hilarity ensue.
Defense systems would be great. You could get countries to nuke themselves using their own cyber ops team.
Re: (Score:2)
"Defense systems would be great. You could get countries to nuke themselves using their own cyber ops team."
most nuke plants are water cooled turning off a water plant would cause the nuke plants that depend on that cooling water to melt their cores if not safely shut down. so yeah there is nuclear concerns and even a coal or nat gas plant also requires cooling and most are not near much water, as they tend to push them out of sight of normal people. so this is pretty serious stuff.
Re: Next Steps (Score:2)
There may be a nuclear plant that relies on a public water system for cooling water, but I bet not. Most are located near reliable water sources such as rivers, oceans, you know...
Re: (Score:2)
Re: (Score:2)
I guarantee those evil socialist Chinese don't allow plants to be networked like ours are.
Re: (Score:2)
H@xx0n> Hey, look, I've hacked into the City of Endersgame! Watch me pwn their electric generator!
H@xx0n has left the channel.
Bull (Score:5, Insightful)
"The researcher behind the study says his results provide the first clear evidence that people actively seek to exploit the many security problems of industrial systems."
Uhhhhhh Stuxnet was an exploit of Siemen's industrial control systems which regulated the RPMs of centrifuges....
Re:Bull (Score:5, Insightful)
His point was that industry systems in the US (and outside of Iran) are also prone to attack, and that it's not just some security paranoia that the site manager could just brush off so he can get to the admin controls via Remote Desktop.
Lets see ... (Score:2)
Re: (Score:3)
How many people have been damaged by the acts of out of control politicians who answer to anyone that has the price to pay? When do the voters get their chance to be heard?
Why are critial systems hooked into the net? (Score:3)
Re: (Score:3)
These systems get their tech support and vendor updates via ... the internet (and most likely not encrypted). Oh, I agree. The air gap needs to be mandated.
Re:Why are critial systems hooked into the net? (Score:5, Interesting)
Because exchanging information with other systems is necessary.
Because people off-site want or need to monitor the status.
Because routinely plug a USB flash drive into a net-connected computer, and then into the air-gapped network (to update software or exchange other info/data) isn't actually much more secure.
Because there are varying degrees of "critical".
Because if it's really a "critical" system, you don't want to wait for tech support to arrive on-site to get problems fixed.
Because "the internet" itself happens to be a "critical" system.
Because the old days of connecting systems to the PSTN (eg. dial-in modems) wasn't actually any more secure than connecting them to the internet.
Because having an air-gapped network provides a false sense of security, that can fall apart in a big way.
Platitudes are oh-so-easy to spout off, no matter how ignorant you are of the issue, but don't offer any insight or solutions to the root cause of the problems.
Re: (Score:2)
READ BETTER
There aren't enough superlatives in the language to emphasize this point enough.
A paragraph from the very damn comment you're replying to:
"Because the old days of connecting systems to the PSTN (eg. dial-in modems) wasn't actually any more secure than connecting them to the internet."
Has nobody here seen the movie "War Games"? What's with all the completely mindless anti-Internet Ludditeism?
Laugh (Score:2)
"The researcher behind the study says his results provide the first clear evidence that people actively seek to exploit the many security problems of industrial systems."
The first eh? I guess he hasn't heard of the tools included in such common distros as Back Track, why do you suppose SCADA exploitation apps are in there?
Now how to prevent it? (Score:5, Interesting)
As somebody who left the network / sysadmin business before the attacks started from the inside (send enough malware to everybody inside a company and you will get lucky at a certain moment), how would you protect it best?
Airgap it (or properly firewall it), and people will complain about the costs of duplicate infrastructure, remote support from vendors will be a pain etc.
Monitor the network and spot anomalies, it's a hard task but could be the way to go. Except that you need skilled people there (not saying that there aren't, my experiences in a TAC shows that there aren't many).
Letting the attackers waste time in a honey-pot while your own network is isolated? At least you learn from it and you give them a false sense of victory.
What is wisdom, any thoughts?
Re: (Score:3)
Non-text attachment automatically scrubbed.
Non-intranet hyperlink automatically censored.
Text looking like a non-intranet hyperlink automatically censored.
^^^
Secure corporate intranet email client.
US Chamber of Commerce Supports Hackers (Score:5, Informative)
http://articles.latimes.com/2012/aug/03/nation/la-na-cyber-security-20120803 [latimes.com]
U.S. Chamber of Commerce leads defeat of cyber-security bill
Everyone war games everything (Score:2)
1 Every nation war games every scenario and as a part of securing the ability to realize those scenarios should they have to, they carry on things with potentially sinister applications. News at 11.
2 Just saying this so no one gets drummed up into the idea that "this means they're going to attack!" or "this is totally outrageous !!" It is outrageous, on PlanetNice where humans are banned. Back on Earth, where humans are what they are ...goto 1
Re:hacked by chinese (Score:5, Informative)
Re: (Score:2)
like you said (Score:2)
TFA indicates they rooted the attacking computers using holes in the browsers they were attacking with, and then used the visible wifi hotspots to locate the machines. It does not say that they checked to make sure the machine was not being remotely controlled, or itself a honeypot. Using this technique not all the sophisticated attacks came from China, some were U.S., Japan, France, etc. but over half were from China. Also not all the honeypots were in the U.S., so its not only the U.S. being targeted.
Re: (Score:2)
Re: (Score:2)
it is much more likely that this is a false flag operation to remind people of their fears.
The US State Dept. travel alert is more likely to be a false flag operation as that is something that significantly more people will understand and relate to than this relatively 'geeks only' topic which at best only will earn a few paragraphs in most media. At risk of placing myself in the tinfoil hat category I have to admit that my very first thought when I read about the alert were, "this is very conveniently timed with the XKeyscore leak a few days earlier ".
Re:Well color me shocked (Score:5, Funny)
Re: (Score:2)
Sounds like most pork barrel defense programs I've ever heard of.
Re: (Score:2, Interesting)
Lets explore this concept a bit.
Lets say that each unionized employee that would be on site cost the utility $150,000 a year and you need 3 of them at each site to achieve disconnection from the internet. That's only $450K a year per site and lets say it covers 20 sites per company or utility type (lets examine Columbus Ohio which charges a sewage fee based on water usage so the 20 sites would cover both aspects). That's about $900 million a year. A big amount or is it. This is taxes, benefits and all conne
Re: (Score:2)
I just grabbed an arbitrary high value that I thought would include not only the worker's pay, but the employment taxes, benefits packages, management costs, insurance, retirement, and so on. The actual employee may only be making 80K or less but the entire cost of the employee is what I was going for.
There are a ton of costs beside the employee's pay that are associated with employing a worker. The entire picture is what I was trying to capture and I was trying to be on the high side of the estimate..
Re: (Score:2)
I've never heard of anyone using city water for large scale crop irrigation. A greenhouse or two might use city water, but not a field of corn. Farmers will dip a pipe into a creek, river, pond, or lake, and pump the water to the fields. They will drill into the aquifer. They will hire trucks to haul in water. But they will not pay the city to pump the water. And the city probably wouldn't let them even if they wanted to, because they use so much water they'd drain their towers, leaving them nothing to