←back to thread

Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

(www.csoonline.com)
433 points zdw | 2 comments | 21 Oct 25 15:51 UTC | HN request time: 0.41s | source
Show context
OutOfHere ◴[21 Oct 25 18:11 UTC] No.45659398[source]▶
Whoever puts a nuclear fission facility on the internet should be put behind bars.
replies(2): >>45660805 #>>45662938 #
GuB-42 ◴[21 Oct 25 23:10 UTC] No.45662938[source]▶
It is not a nuclear fission facility, it is "a plant that produces the vast majority of critical non-nuclear components for US nuclear weapons".

The also targeted the IT side, not the operational side, which, according to the article is likely to be airgapped. Even sensitive production facilities need some internet access, people work there and like everyone else, they need food, office supplies, toilet paper, etc... they can't be cut off the rest of the world completely.

replies(2): >>45663829 #>>45663844 #
OutOfHere ◴[22 Oct 25 01:11 UTC] No.45663844[source]▶
Something tells me they also use it to order operational side materials, including nuclear gear and materials, from the IT side. To expose this on the internet screams of idiocy.
replies(1): >>45666993 #
1. GuB-42 ◴[22 Oct 25 10:16 UTC] No.45666993[source]▶
How are they supposed to contact their suppliers without email? Even for phone calls, they are probably using some kind of VoIP. For sensitive communication, they most likely encrypt and sign their messages on the airgapped side before moving it to the internet facing side and sending it using regular email.

Not having internet access at all is like not having your building connected to public roads. That makes it harder (but not impossible) for bad guys to come, but it is so much of a hassle that almost no one does that. Instead, they use gates and checkpoints.

Same idea for internet access. They have internet access, but they have security systems, from traditional firewalls and VPNs to airgaps.

Security is about letting the good guys in while keeping the bad guys out, the latter is meaningless without the former. That's why security is hard, if is was just about blocking everything, it would be easy, but nothing would be done.

replies(1): >>45667514 #
2. OutOfHere ◴[22 Oct 25 11:31 UTC] No.45667514[source]▶
Thank you for your patience. The document portal and access to it probably should have remained airgapped.