this post was submitted on 30 Jan 2024
0 points (NaN% liked)
Technology
58009 readers
3065 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Tell me you know nothing about cybersecurity without telling me you know nothing about cybersecurity. Wtf is this drivel?
The author's grammar ~~rammar~~ isnt that great as well. Those typos can be should have been catched easily by the spellcheck.
Edit: Including me :p
Finally caught a *grammar cop doing a typo in the wild. Pure joy.
Simple solution: Don't connect it to the Internet. Hackers hate this one weird trick.
And said trick ends when an attacker manages to socially-engineer their way in. (But maybe they’ll drop floppies instead of flash drives around the block this time)
Sure, but how likely is this in this specific scenario. We're talking about a system that's not even directly controlling the train but just a display on it. The worst that can happen is that those displays won't work until the system is reinstalled. That's hardly a lucrative target for modern hackers. There's way easier target which are worth something.
You really think that infrastructure IT is dumb unless it can brush off a Stuxnet-like attack by the CIA and Mosad? Most RR traffic signals in the US are run with mechanical logic, physical switches connected to circuits closed by steel wheels on steel tracks. Do you really want a "move fast and break things" tech bro to update all this stuff for us?
All kinds of infrastructure uses ancient software because it's reliable. Updating it just to protect from hackers causing damage is likely to cause that damage unintentionally while doing little to protect from hackers anyhow.
It really depends if these systems (that appear to control arrival boards) are on a network or not. If they're not, then there is minimal risk to leave them the way they are. Somebody would need physical access to the devices to do harm. If they are on a network then that's a pretty big deal, but some attacks could be mitigated against by tunnelling and/or additional packet filtering to ensure the integrity of messages.
Continuing on a railway theme you should be FAR more worried all the devices that run up and down the side of railway lines - PLCs that talk with each other and operations centres to control things like lights, junctions, crossings etc. If they're more than 5 years old then chances are then all that traffic is in the clear, and because these things live in boxes by the railway line, it wouldn't take much to break into a network and potentially kill people by running two trains into each other.
the job was advertised as being remote.....
Well yes. You can code software remotely. That doesn't mean the end system is reachable through the network. Given it's DB, I bet these systems are still patched by floppy. Until very recently they've used floppy's to distribute train schedules to be displayed in the train.