Cyber attack on an American city

[mfyahya]

http://perens.com/works/articles/MorganHill/

Just after midnight on Thursday, April 9, unidentified attackers climbed down four manholes serving the Northern California city of Morgan Hill and cut eight fiber cables in what appears to have been an organized attack on the electronic infrastructure of an American city. Its implications, though startling, have gone almost un-reported.
That attack demonstrated a severe fault in American infrastructure: its centralization. The city of Morgan Hill and parts of three counties lost 911 service, cellular mobile telephone communications, land-line telephone, DSL internet and private networks, central station fire and burglar alarms, ATMs, credit card terminals, and monitoring of critical utilities. In addition, resources that should not have failed, like the local hospital's internal computer network, proved to be dependent on external resources, leaving the hospital with a "paper system" for the day.
Commerce was disrupted in a 100-mile swath around the community, from San Jose to Gilroy and Monterey. Cash was king for the day as ATMs and credit card systems were down, and many found they didn't have sufficient cash on hand. Services employees dependent on communication were sent home. The many businesses providing just-in-time operations to agriculture could not communicate.
In technical terms, the area was partitioned from the surrounding internet. What was the attackers goal? Nothing has been revealed. Robbery? With wires cut, silent alarms were useless. Manipulation of the stock market? Companies, brokerages, and investors in the very wealthy community were cut off. Mayhem, murder, terrorism? But nothing like that seems to have happened. Some theorize unhappy communications workers, given the apparent knowledge of the community's infrastructure necessary for this attack. Or did the attackers simply want to teach us a lesson?

[goadam1]

Re: Cyber attack on an American city

I smell money being spent on "upgrades" shortly. So many boogey men, so much air time to fill.

[flintlock]

Re: Cyber attack on an American city

Sounds similar to this story I saw on Drudge today.
http://www.timesonline.co.uk/tol/new...cle6150447.ece

At an electricity substation on a bleak industrial estate north of Paris a masked union militant is preparing to deprive a neighbourhood of power.

Fun times ahead.

[don]

Re: Cyber attack on an American city

This 'attack' needed someone with the experience to know the locations, know how to get into and out of manhole covered street lines, and know what cables to cut while most-likely standing in a watery tunnel. This has disgruntled employee written all over it. The sad part is the possible 'terrorist charges' that have gotten air play here in Northern Cali. On the books criminal charges should suffice.

[flintlock]

Re: Cyber attack on an American city

Yeah, probably someone familiar with that stuff. Not just a kid with a sawzall.

[Slimprofits]

Re: Cyber attack on an American city

AT&T offering a $250,000 reward for information.

It doesn't sound as if they have much in the realm of leads.

http://www.morganhilltimes.com/news/...hone-saboteurs

[jwonks]

Re: Cyber attack on an American city

This is the major reason why I think Bush's and now Obama's plan to computerized health records is a nightmare, mostly to our privacy. By centralizing health records into an unified and linked computer network you open yourself up to all the nasties the computers have produced--worms, viruses, trojan horses and hacker attacks. And now infrastructure attacks. But allow me to go on a tangent and back to the issue of compromised privacy concerning electronic health records.

You save money by computerizing records; however; the offset is that your privacy is compromised and you make it easier for anyone to steal or snoop your records.

Picture hospital records in some room inside a filing cabinet stuffed in manilla folders. An attacker has to break into the hospital, break into the room, grab only a handful of records since there are so many and escape while dodging the watchful eye of nurses, doctors, patients and security guards. Not easy.

If the hospital does have records in an electronic format but in a network that is localized; that is, only accessible within the hospital, then the above scenario still mostly applies. The attack has to be physically present to attack the system.

Now think of a computer network with a bunch of patient records networked to the internet or interlinked to a central government network. No breaking into a building. No breaking into a room. No breaking into a filing cabinet. No physically moving the stolen records. No need to worry about the watchful eyes of security guards, patients, nurses and doctors. The attacker can attempt to hack and if successful gain access to the system from the comfort of his home.

When it comes to computers, the attacker basically can gain access in two ways--getting a hold of a password with the necessary clearance or by hacking the system with some sort of exploit to gain admin/root privileges.

Now do you guys really think that the people that brought you computerized voting machines and the department of motor vehicles are going to have a more secured computer network and more stringent controls on data and records accessibility than say a multibillion dollar bank holding company? Banks' computer networks are hacked all the time, even though they have the resources and the will to have the best computer security money can buy.

I hate that our government is so willing to compromise our privacy so readily nowadays.

[tree]

Re: Cyber attack on an American city

This is the major reason why I think Bush's and now Obama's plan to computerized health records is a nightmare, mostly to our privacy. By centralizing health records into an unified and linked computer network you open yourself up to all the nasties the computers have produced--worms, viruses, trojan horses and hacker attacks. And now infrastructure attacks. But allow me to go on a tangent and back to the issue of compromised privacy concerning electronic health records.

You save money by computerizing records; however; the offset is that your privacy is compromised and you make it easier for anyone to steal or snoop your records.

Picture hospital records in some room inside a filing cabinet stuffed in manilla folders. An attacker has to break into the hospital, break into the room, grab only a handful of records since there are so many and escape while dodging the watchful eye of nurses, doctors, patients and security guards. Not easy.

If the hospital does have records in an electronic format but in a network that is localized; that is, only accessible within the hospital, then the above scenario still mostly applies. The attack has to be physically present to attack the system.

Now think of a computer network with a bunch of patient records networked to the internet or interlinked to a central government network. No breaking into a building. No breaking into a room. No breaking into a filing cabinet. No physically moving the stolen records. No need to worry about the watchful eyes of security guards, patients, nurses and doctors. The attacker can attempt to hack and if successful gain access to the system from the comfort of his home.

When it comes to computers, the attacker basically can gain access in two ways--getting a hold of a password with the necessary clearance or by hacking the system with some sort of exploit to gain admin/root privileges.

Now do you guys really think that the people that brought you computerized voting machines and the department of motor vehicles are going to have a more secured computer network and more stringent controls on data and records accessibility than say a multibillion dollar bank holding company? Banks' computer networks are hacked all the time, even though they have the resources and the will to have the best computer security money can buy.

I hate that our government is so willing to compromise our privacy so readily nowadays.

Putting all that info on computers = new, desperately needed American "industry."

[flintlock]

Re: Cyber attack on an American city

While I do admit there is some potential security risk, I think computerized medical records will become an absolute necessity if we are to attempt to keep medical costs down. And anyone who has tried to shop for new health insurance can tell you how fun it is to try and gather all your medical history that they require.

Also, compared to your financial information, which is already mostly all computerized, what real security risk is there if some crook finds out about your gallbladder problem? I'd say that's way down the list of potential security risks we face these days.

More likely its the personal info like SS numbers in the medical records that poses the real risk to these falling into the wrong hands. Sorry, but the genie is already out of the bottle when it comes to centralized records in this country.