Hacks 'Probably Compromised' UK Industry (bbc.com) 19
Some industrial software companies in the UK are "likely to have been compromised" by hackers, according to a document reportedly produced by British spy agency GCHQ. A copy of the document from the National Cyber Security Centre (NCSC) -- part of GCHQ -- was obtained by technology website Motherboard. From a report: A follow-up by the BBC indicated that the document was legitimate. There have been reports about similar cyber-attacks around the world lately. Modern, computer-based industrial control systems manage equipment in facilities such as power stations. And attacks attempting to compromise such systems had become more common recently, one security researcher said. The NCSC report specifically discusses the threat to the energy and manufacturing sectors. It also cites connections from multiple UK internet addresses to systems associated with "advanced state-sponsored hostile threat actors" as evidence of hackers targeting energy and manufacturing organisations.
Irresponsible Journalism the New Norm (Score:1)
>> a document reportedly produced by British spy agency
WHAT DOES THAT EVEN MEAN??
>>A follow-up by the BBC indicated that the document was legitimate
Who is following up on the BBC to see if *they're* legitimate, Or are we supposed to take this government media arm at face value now?
We have gone completely down the rabbit hole...
Re: (Score:1)
>> a document reportedly produced by British spy agency
WHAT DOES THAT EVEN MEAN??
I means that the document appears to be produced by a British spy agency, specifically GCHQ, but this cannot be verified with certainly.
>>A follow-up by the BBC indicated that the document was legitimate
Who is following up on the BBC to see if *they're* legitimate, Or are we supposed to take this government media arm at face value now?
Everyone needs to make their own assessment of the accuracy of news outlets. I see no reason to doubt the BBC on this claim i.e. that GCHQ didn't explicitly deny the document.
I'm not really sure what point you are making. Why would the BBC lie about this technical and, to my mind, plausible report?
Re: (Score:2)
Mr. RobotRunAmok is paranoid and distrusts government announcements that the sky is blue and water wet, especially when the government agency is citing another such agency as the source. This is despite the fact that there are so many weasel words in the announcement that it merely says that "hackers" exist and may not all be playing golf poorly.
The better question (Score:4, Interesting)
And one much harder to answer is 'who isn't compromised.
Given the low hanging fruit that is Internet connected industrial controls, I'd have to Wild Ass Guess that virtually all of the big companies have had their products peeled open by one or various disreputable groups (I'm looking at YOU ALL Five Eyes). Or maybe all of them.
What happens when it's back doors all the way down?
(Don't answer that, please.)
Re: (Score:1)
I consulted with a hospital who had default passwords on almost everything, connected everything from IV pumps to VOIP calls over their 802.11 without protection, had all sorts of confidential information on unsecured, open Windows file shares, did not have unique logins for users (so forget user access control or audit trails)... It was horrible. And they didn't care.
The last straw was when I found out their entire patient information database for their EHR was wide open, world-readable and writable on a g
Re: The better question (Score:3, Insightful)
Be careful. Depending on your jurisdiction you may be required to notify one or more agencies if you discover something this bad.
Re: (Score:2)
And one much harder to answer is 'who isn't compromised.
Companies that don't needlessly connect things to the internet (which is nobody). Companies that invest in real security instead of faux security (which is nobody).
It's almost as if MBAs running businesses think security is a pointless expense.
Re: (Score:2)
The UK followed the US down the wide open, unencrypted, plain text, network facing server path thanks to "contractors", public private partnerships, total out sourcing and supporting the private sector.
Every plain text, open server facing the internet issue that was big news in the USA years ago is now been repeated in the UK.
Is that coincidence? Incompetence? A total lack of computer crypto design understanding in the UK mil and gov?
Or policy?
The
Russia is a rouge nation (Score:1)
Seriously.
(sorry, just wanted to misspell rogue)