←back to thread

Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

(www.csoonline.com)
433 points zdw | 5 comments | 21 Oct 25 15:51 UTC | HN request time: 0.859s | source
Show context
reenorap ◴[21 Oct 25 17:16 UTC] No.45658455[source]▶
There needs to be a law that all nuclear and nuclear-adjacent facilities have no connection to the Internet. The fact it's allowed is unbelievable.
replies(16): >>45658869 #>>45658922 #>>45659008 #>>45659125 #>>45659155 #>>45659165 #>>45659210 #>>45659242 #>>45659399 #>>45659433 #>>45659476 #>>45659542 #>>45659733 #>>45660029 #>>45661258 #>>45666322 #
tcoff91 ◴[21 Oct 25 17:42 UTC] No.45658922[source]▶
Wasn't the internet literally created by the military for military comms? The decentralized routing was in part to ensure that comms could survive some areas being taken out by nuclear weapons.
replies(3): >>45659144 #>>45660633 #>>45662081 #
1. SoftTalker ◴[21 Oct 25 17:55 UTC] No.45659144[source]▶
As the effect of yesterday's AWS event demonstrates, the major Amazon, Microsoft, and Google data centers are surely top tier targets in every adversary's war plans.

The decentralized internet is less of a reality today than it was years ago.

replies(1): >>45659693 #
2. diggan ◴[21 Oct 25 18:31 UTC] No.45659693[source]▶
Don't we have more internet submarine cables and less single points of failure in our internet infrastructure today than years ago? If so, shouldn't that make it easier to route around failures?

The web though I agree isn't very decentralized.

replies(2): >>45659982 #>>45662699 #
3. SoftTalker ◴[21 Oct 25 18:51 UTC] No.45659982[source]▶
Maybe yes in that regard. But in the past, most organizations ran their own mail and web servers. Software supporting the business ran on-prem. Now they use Google or Azure or AWS. So business and civilian usage, at least, seem more vulnerable now.
replies(1): >>45661291 #
4. HippyTed ◴[21 Oct 25 20:31 UTC] No.45661291{3}[source]▶
We sacrificed resillience for effeciency. Now things are much more fragile and liable to exploitation.
5. Root_Denied ◴[21 Oct 25 22:47 UTC] No.45662699[source]▶
Considering that the AWS outage took out a lot of lines of communication (email, video, chat systems) for both commercial and government entities, I'd say that US-East-1 is a pretty big single point of failure. Even if it didn't result in infrastructure impact directly, if there was some kind of infrastructure issue and you had delayed or unavailable communications, how would you know? How quickly could a response be mounted? There's some parts of the infrastructure that could damage themselves irreparably in the time it would take to to fix the outage or get comms routed through a backup channel - like parts of the electrical grid or water treatment plants.

An attacker (read: nation-state actor) wouldn't even need to take down US-East-1, it could just take advantage of the outage.

I assume (hope?) there's some kind of backup comms plan or infra in place for critical events, but I don't actually know.