210
Hackers knocked out water systems in 7 states. The FBI points to Iran. Trump's response: "I don't think there was an Iranian cyberattack... you know who's behind it? Minnesota." (www.creativehives.co)
submitted 2 months ago by to c/antitrumpalliance@lemmy.world
24 comments fedilink hide all child comments
 

“you know who’s behind it? minnesota,” trump said. “because they’re grossly incompetent. i think the governor’s behind it. i don’t think there was an iranian cyberattack. i think minnesota ought to get its act together.”

he went further, dismissing the notion that iran had the capacity or interest to be involved at all: “they like to say, ‘oh, it was iran.’ iran should be so lucky. iran’s got bigger problems than worrying about minnesota.”

you are viewing a single comment's thread
view the rest of the comments
[–] 32 points 2 months ago* (8 children)

Bullshit. I personally worked on the incident that happened to St Paul municipal and water systems last year as the Incident Response Technical lead.

The threat actors were not Iranian then. They were Russian.

I personally rebuilt most of their networks, VMware hosts, storage, and servers. The majority of the VMware environments did not have config backups and were running 5 and 6 branches of VMware, only two had 7+.

I had my team compile a massive set of recommendations for them and I wrote the report. Water Systems specifically. They did not listen to us, apparently. The forensics team also did this.

They had FBI, national guard (fucking incompetent), and law enforcement (useless) in all meetings.

If they got into Water, they'll get back into city and municipal again. I guarantee it.

*I'll probably repost a comment similar to this if I see this come up in any cybersecurity comms.

  • permalink
  • fedilink
  • source
  • hideshow 8 child comments
    •
  • [–] 1 point 2 months ago (4 children)

    You think it was Iran, I presume?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 8 points 2 months ago* (3 children)

    I do not. If I were to bet, I would guess it's the same people or related groups to the last incident.

    Russian state policy is to allow any sort of hacking as long as it's not aimed at Russian assets. No penalty. These groups just want their bag.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 2 months ago (2 children)

    Ok good point. It’s possible also that Russia or China can collab with or act for Iran, or use it as cover as you suggest right.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 5 points 2 months ago

    I think they're implying that it's not actually a nation state threat actor, that Russian cyber criminals looking to exploit systems for money are able to act with impunity so long as they don't target Russians (hence "want their bag"). Most incidents are financially motivated.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 0 points 2 months ago (2 children)

    ... thats... not reassuring.

    ... wonderful.

    Yeah, from the outside... Russians makes the most sense. I don't think China would be this bold, Iran? Probably not skilled enough.

    I... guess it could be possible the Russians are essentially doing it on behalf of Iran, in some way, but... probably no real way to prove that either way.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 2 months ago* (1 child)

    China doesn't target low-value entities like this. They're going after bigger fish and using much more subversive methods. They deploy people on the ground. Look into the Chinese Police Stations that are all over the USA, Canada, and other countries. Illegal AF.

    China gets people to go work for large corps, government entities, and other places, and has them extract data that way.

    Also, what's with your use of ellipses? I don't understand.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 months ago* (last edited 2 months ago)

    I (over)use them to indicate pauses or hesitation.

    Stylistic flair.

    I didn't realize the Chinese used so many ... on the ground facilitators... that's a very aggressive tactic.

    That does make sense though, all you've said.

    I was aware that yes, they typically went for... basically extremely high value data... i would think that persistent presence, or, almost that, basically, in essentially many state municipal systems... would essentially be a strategic weapon/tool... didn't think they'd be so bold as to flip all that on, now. I'd have figured they'd wait for a more specific, opportune moment.

    But from what you're saying... sounds like they're mostly interested in acquisition, extraction.

  • permalink
  • fedilink
  • source
  • parent