HNNewShowAskJobs
Built with Tanstack Start
Poland's energy grid was targeted by never-before-seen wiper malware(arstechnica.com)
296 points by Bender 4 days ago | 157 comments
  • altern84 days ago

    If you're looking for what the damage was, it failed.

    Potential damage: "Most notable was one [attack] in Ukraine in December 2015. It left roughly 230,000 people without electricity for about six hours during one of the coldest months of the year."

    • 4 days ago |parent
      [deleted]
  • csomar3 days ago

    The Jaguar hack cost the UK $2.5Bn and dropped production to levels you'd normally only see during open warfare. Recovery took many months, and the financial damage persists today.

    We still operate with a primitive homunculi where a gunshot is considered aggressive, but sabotaging infrastructure that can kill hundreds from cold is being waved at.

    • cyanydeez3 days ago |parent

      The difference is the bureaucratic "doubt" about who did what.

      Which, with the current zeit geist, should really be minimized to almost zero

      • bethekidyouwant3 days ago |parent

        Blame everything on X group i don’t like is a bold move

        • cyanydeez3 days ago |parent

          We have two clear videos of federal USA employees executing citizens.

          What stopa the execution of legal system? The claim that we cant know 100% of the facts.

          In reality, theres little to dispute with the facts. Theres simply groups of true believers and those who think we need more clarity.

          Those two forces alloq the continuation of violations

          • bethekidyouwant3 days ago |parent

            I thought you were talking about Russian hacking

            • cyanydeez2 days ago |parent

              I am. Why arn't we doing more against "Russian" hacking, because:

              1. They outsource it

              2. It rarely has clear red flags, eg "Putin's IP showed up on our PC before the virus"

              So, I'm generalizing the argument about why direct action rarely occurs: It's because even if theres a great deal of evidence, the fuzzy logic required to say "this is statistically true" is rarely used.

    • ifwinterco3 days ago |parent

      But hey, at least they saved a few million a year in developer salaries by offshoring

  • TheDauthi4 days ago

    My first pass through the title was "Those windshield wipers shouldn't need to be internet-connected."

    Thankfully, the article did clear that up, but the fact that my brain didn't even think, "that's a stupid idea that no one would buy that" is a bit depressing.

    • askvictor3 days ago |parent

      But then how would you alert people that their wiper blades are wearing down, and automatically ship them new ones?

      • Propelloni3 days ago |parent

        Well, obviously, your car can count cycles on the electromotor moving the wipers. Then you apply statistical wear and tear, maybe even geofenced, and your car orders new wipers. Same with tires. Simple as pie ;)

        BTW, I would have zero interest in that feature.

        • cyanydeez3 days ago |parent

          I think the most important part would be preventing any third party wipers from effectively wiping by disabling them!

  • indubioprorubik3 days ago

    This war will likely clean some old electronics providers from the market. You are either very good at security (and that does not mean "airgap" all the things- if your plc needs a special laptop to connect to, the malware just needs to go for those laptops) or you are out of buisness in regions under threat permanently.

  • postepowanieadm3 days ago

    Poland has a high alertness status for like 5 years now. So there was time to be prepared.

    • yesturi3 days ago |parent

      There's some news about some psy-op or some damage every couple of days. We hear about "Russian trolls" and influencing the political discourse.

      I wonder if there is any symmetrical response to this happening. How about unleashing psy-ops and "Western trolls" in Runet? Is Europe in purely defensive mode?

      • theshrike79a day ago |parent

        It's the openness needed in western societies.

        The lack of political will to create and fund covert offensive operations over the internet.

        Russia has had this down for _years_, it's not illegal to hack non-Russian targets, so people do it. They have command and control systems where they can give out tasks like "find me vulnerabilities for Siemens XYZ hardware" and then a team will pick that up and do it.

        They also practice infiltration, exfiltration and coordination with their attacks. Every kiddie can get in with maximum noise, the truly skilled ones get OUT without leaving any definite traces.

        And I'm not talking out of my ass: https://youtu.be/jbIR7YVAYnc - I'm talking out of Marina Krotofil's ass, she's been investigating and dissecting this for a long time.

      • direwolf203 days ago |parent

        I think Europe hasn't developed this kind of political manipulation ability. Europe seems to operate in the mode where as long as the political institutions are still standing, everything is felt to be alright. US democrats also operate in this mode.

      • llbbdd3 days ago |parent

        Russia is perfectly capable of trashing itself without anyone helping.

      • marginalia_nu3 days ago |parent

        FWIW it seems Russia's trolling activities took a pretty significant hit after Prigozhin fell out of a window in 2023, as the "Internet Research Agency" was one of his ventures.

        • cyanydeez3 days ago |parent

          Probably just caused outsourcing to india and china.

          • weezing3 days ago |parent

            It did. There are loads of "Polish" patriots on X located in India.

      • u80803 days ago |parent

        EU-based troll farms are for long time in RUnet already (i.e. FRF) along with EU-aligned russian language media who spread certain narratives.

  • canada_dry3 days ago

    Assuming that Ukraine cyber attacks (novel/0-day) on the Russian energy grid must be happening, I don't often hear of this happening there.

    Why not?? Is Russia's grid infrastructure so old as to not be as vulnerable?

    • christophilus3 days ago |parent

      Might be. For highly sensitive messages, Russia still uses physical delivery of typewritten letters. This is because they (rightly) distrust digital security models.

    • theshrike79a day ago |parent

      There is no war in Ba Sing Se

      Since the start of the war, Russia will rather admit incompetence (a soldier was smoking next to an ammo depot) than admit Ukraine succeeded in a military objective.

  • United8574 days ago

    Curious to how these attacks work logistically. I assume these networks are air-gapped?

    • arter453 days ago |parent

      Another source says:

      > It "involved an attempt to disrupt communication between generating installations and grid operators across a large area of Poland".

      I doubt we will have all details, but I suspect this kind of communication occurred over the Internet (hopefully, at least a VPN).

      Also, even completely airgapped networks are not 100% secure, if you can install a device or convince someone to do it by accident (social engineering).

    • smallnix3 days ago |parent

      E.g. with stuxnet they got to the air-gapped machines by letting worms loose on the network of suppliers, targeting technicians laptops.

  • HPsquared4 days ago

    For what purpose? Cui bono?

    • general14654 days ago |parent

      Poland is a major logistical hub for everything going towards Ukraine. Thus targeting basic infrastructure like energy grid or railroad have to be expected.

      On the bright side, using these weapon grade malware is burning exploits and also showing current state and techniques of Russian cyberwarfare which defender can learn a lot from.

      • WhyNotHugo4 days ago |parent

        > On the bright side, using these weapon grade malware is burning exploits and also showing current state and techniques of Russian cyberwarfare which defender can learn a lot from.

        Or perhaps they used an already-known malware to measure defensive capabilities without showing any of their cards.

        • XorNot3 days ago |parent

          Cyber-defensive measures aren't very useful though. Once malware is known to exist, you don't "reveal a capability" by detecting it - it all boils down to basically signature analysis, or just good standard practice (air gaps, software supply chain accountability etc).

          This is vastly different to real world military systems, where there are a lot more variables and no guarantees - i.e. countries have limited numbers of air defense systems and missiles, the missiles have finite non-zero flight times, the physics of detection systems and sensors are not absolute etc.

          The real world is just more complicated, so the value of buzzing someone's airspace reveals a lot more information then "huh, guess they didn't click on that email".

        • mrtesthah3 days ago |parent

          You'd think it would've been done during the summer or some other time when that wouldn't matter then.

          • throw_a_grenade3 days ago |parent

            No, of course not. They want to also measure response in the physical aspects (like electricians thot would have to drive some time to arrive on site). They're testing end-to-end, so to say. There's no testing like testing in production.

      • JohnLeitch3 days ago |parent

        While there's some overlap in methodologies and back-and-forth with various escalations, so-called malware is distinct from software exploits. Malware can be delivered without an exploit and quite often is. Social engineering is highly effective.

      • msuniverse20263 days ago |parent

        Interesting that Russia still hasn't targeted the bridges going into Ukraine from Poland for some reason.

        • crowfunder3 days ago |parent

          There were cases of railway sabotage.

          https://www.bbc.com/news/articles/cp85g86x0zgo

        • pqtyw3 days ago |parent

          To be fair precision strikes on bridges are not that easy. Of course the Kerch bridge is especially resilient due to the way it was build but still actually hitting a 60-100 meter length bridge from 700-1000 km away is tricky.

          Not that it matter anyway at all... since there aren't any major rivers separating Poland and Ukraine to begin with.

        • wolvesechoes3 days ago |parent

          What bridges?

    • breve4 days ago |parent

      Russia is at war with Europe.

      • dijit4 days ago |parent

        before anyone jumps on the pedantry bandwagon, its worth noting that even though open war hasn’t been called: the attacks on infrastructure especially cyber warfare is extremely active and, crucially, direct.

        It is totally fair to say that in a digital context, Russia is absolutely at war with Europe.

        As far as I can tell, they don’t even try to hide it.

        • reactordev4 days ago |parent

          Not to mention the information war they have been waging globally since 2016

          • exoverito3 days ago |parent

            The US, UK, and Western powers have been waging information war for far longer than 2016. Look at Canadian PM Mark Carney's latest speech at Davos, he admits the 'Rules based international order' was a fiction, and the US has had a very long history of covert operations, 'enhanced interrogation', destabilization campaigns, funding of terrorists, propping up of dictators, bombing and invading of many countries...

            To be specific consider how many lies have been told by the American mainstream media around the narratives of Iraq, Afghanistan, Israel, Syria, Libya, etc. Israel has the most surveilled and well defended border in the world, the Mossad is sophisticated enough to launch pager attacks to decapitate Hezbollah leadership, yet somehow they got caught with their pants down and Hamas combatants could raid their country for 12 hours without a response. The US also had funded Osama bin Laden in the 1980s, knew Al Qaeda was plotting another attack on the WTC, and the Neocons in the Bush administration wanted a new Pearl Harbor as outlined in the Project for a New American Century.

            Russia is not uniquely or even particularly evil here, it's entirely rational for them to not want a major neighbor to join an enemy alliance. Look at how America has treated Cuba for decades. People should stop being so naive.

            • Throaway19823 days ago |parent

              Unfortunately its also entirely rational for Ukraine to want to join an alliance against Russia!

          • Avamander3 days ago |parent

            It has been ramping up a bit. Most recent case has been Russian (sock)puppet activity on Wikipedia, where they actively try to rewrite the language used, the narrative to be more suitable for them. It has even gotten news coverage.

            First link in English I found: https://balticsentinel.eu/8394326/wikipedia-s-baltic-battle-...

          • naryJane4 days ago |parent

            True, but they’ve certainly been doing it much longer than ten years. I’ll never forget this headline [0] that struck me as purely devilish, especially in the lead up to the 2016 presidential election. Combine that with the knowledge that Trump has been anti-NATO since the 1980s [1]. Who knows how long Russia has been nudging him along. Who knows how many avenues they traverse? Take for example the letter to Senator Tom Cotton about Greenland [2]. What an embarrassment. I can only hope we are equally successful in our own PsyOps.

            [0] https://www.rt.com/news/265399-putin-nato-europe-ukraine-ita...

            [1] https://www.buzzfeednews.com/article/ilanbenmeir/that-time-t...

            [2] https://monitoring.bbc.co.uk/product/c2018djo

            • 3 days ago |parent
              [deleted]
            • reactordev4 days ago |parent

              You don’t remember Trump Moscow? Ivanka? Trump and Russian connections go all the way back to Epstein’s early days.

              • mrtesthah3 days ago |parent

                So much dirt.

                https://spookyconnections.com/2024/10/19/donald-trump/

              • Applejinx3 days ago |parent

                Yes, and it's successfully got to where his people are able to dismantle American infrastructure at scale, deliver IT systems to Russian hackers directly and coordinate death squads on the streets. I figure the primary reason we're not seeing 'little green men' in Minnesota, for instance, is that Russia cannot spare them. But the war here is arguably as important or MORE important to Russian war aims than the war in Ukraine.

                Certainly more successful here than in Ukraine, for what that's worth. I don't think it's a foregone conclusion but they've certainly succeeded here a lot more than in Ukraine.

        • cookiengineer4 days ago |parent

          Some could say that in the cyber realm, they are not petty, ya! Well, or something like that.

          Eversince notpetya and the colonial pipeline hack, the cyber strategy game changed a lot. Notpetya was genius as a deployment, because they abused the country's tax software deployment pipeline to cripple all (and I mean all, beyond 99%) businesses in one surgical strike.

          The same is gonna happen to other tax software providers, because the DATEV AG and similar companies are pretty much the definition of digital incompetence wherever you look.

          I could name other takedowns but the list would continue beyond a reasonable comment, especially with vendors like Hercules and Prophete that are now insolvent because they never prioritized cyber security at all, got hacked, didn't have backups, and ran out of money due to production plant costs.

        • brabel3 days ago |parent

          Europe is the main supplier of weapons to Ukraine which is in actual war with Russia. Of course Russia is at war with Europe, the only reason bombs are not falling in Poland and Germany is that Russia wouldn’t have the capability to defend itself against retaliation. Do people really believe their countries can openly take sides in a war and not be targeted??

          • pqtyw3 days ago |parent

            Well be the same definition Russia was at war with the US in Korea and Vietnam (or Afghanistan). To a much bigger extent to be fair since there were actual Russian pilotes deploying to both countries.

            I'm not sure whether Johnson or Nixon (during periods of sobriety of course) were considering directly attacking Russian territory because of that...

            • brabel3 days ago |parent

              The name of that is proxy war. They would attack each other directly only if they were prepared to escalate to open war, but when we’re talking about nuclear powers, luckily the chance of that happening seems to be very low. It’s the only reason Europe does not openly deploy troops to Ukraine, though there are definitely some under cover.

          • hardlianotion3 days ago |parent

            This has been going on from well before the Ukraine war. It has just intensified. The real question is: should the affected states develop some counter-capability to deter this opportunistic behaviour?

            • yetihehe3 days ago |parent

              Fortunately Russia in their benevolence tries to limit the damage, so that we don't feel the destruction all at once. This means some people will be annoyed for day or two and everyone is reminded to increase security pretty constantly. Just recently we got news about ONE furnace (from several in that heating plant) being probably hacked. The furnace shut down. Operator didn't notice, because the display on furnace was already malfunctioning and operator just restarted it. They checked everything only after our "cybersecurity" forces notified them.

              That was in local news this weekend. I know about it because I'm responsible for another city heating network, we take security pretty seriously. All devices are in vpn and if someone outside needs to login remotely, he is granted access only for the time needed, so window for actually worming the network through vendors is very small. All staff accessing the system has computer security training. But not every heat provider operates like this, some small ones (like the one affected) are a little more sloppy.

        • RobotToaster4 days ago |parent

          The cold war never ended

          • 1274 days ago |parent

            ...for Putin

        • throw3108224 days ago |parent

          [flagged]

          • pjc504 days ago |parent

            They started this long ago, with the first invasion of Ukraine in 2014 and a series of poisoning attacks all the way back to https://en.wikipedia.org/wiki/Poisoning_of_Alexander_Litvine...

          • bnjemian4 days ago |parent

            This completely ignores that: 1. Russia was the aggressor in Ukraine, 2. Putin has made clear his desire to pursue expansionist goals through military action targeting prior members of the Soviet Union, 3. Putin regular threatens nuclear war with Ukraine, 4. Russia has shown outward hostility towards Western democracies and sought to manipulate elections with information warfare to reach their goals (most notably, 2016 US Election and Brexit), 5. Russian regularly cuts cables connecting countries, and 6. Though completely unrelated, Putin has a history of assassinating political opponents. That's wolfish behavior if I've ever seen it.

          • Zagitta4 days ago |parent

            You're conveniently omitting these all happened in response to the full scale Russian invasion of Ukraine.

            But thanks for proving the point about Russia's disinformation war.

            • throw3108223 days ago |parent

              [flagged]

              • lucketone3 days ago |parent

                Chamberlain decided not to join the war, look what that resulted in.

                • pqtyw3 days ago |parent

                  Well he did... just a few years later.

                  To be fair in 1938 Britain hardly had a land army so France would have had to do all the fighting anyway. So whatever Chamberlain wanted to do didn't really matter that much.

              • RealityVoid3 days ago |parent

                Did you actually read all the posts pointing this and all the _other_ aggressive actions Russia is taking against the EU?

                Regardless, Russia is a bully and sticking your head in the sand won't make them go away.

                • brabel3 days ago |parent

                  [flagged]

                  • the_why_of_y3 days ago |parent

                    > for some reason announced in 2008 plans to expand to Georgia and Ukraine

                    This was a G. W. Bush idea, during his last year in office, and it was never going to actually happen.

                    At the dinner on Wednesday, the German and French position was supported by Italy, Hungary and the Benelux countries, a senior German official said. Mr. Bush was said to have accepted that his position was not going to prevail,

                    https://www.nytimes.com/2008/04/03/world/europe/03nato.html

                    > Was the EU and the USA friendly towards Russia ...

                    When Russia annexed Crimea in 2014, did Angela Merkel stop the Nord Stream 2 pipeline, as very sensibly demanded by much of Eastern Europe? No, of course not - if we just trade more with Russia, they will be interested in peace! Germany deservedly lost billions finishing the construction, and it never transmitted a single ccm of gas.

                    > You know the result of that, but still consider there was no provocation at all

                    I think a better question to ask is, why do countries that border on Russia try so hard to become NATO members?

                    • brabel3 days ago |parent

                      > it was never going to actually happen.

                      That announcement is still on NATOs website to this day. To think it would never happen can only be seen as wishful thinking.

                      > try so hard to become NATO members?

                      If your intention is to align with the EU, it makes sense you want military protection against invasion in the future. Even Russia wanted at one point to join. The question is really why Russia should sit quietly while several countries around it join an alliance against it? Would the US be ok with Mexico and Canada doing that? Sounded ridiculous until a few months ago, now that is a sensible thing for them to seek. Look at how the US reacted to just a EV deal Canada made with China.

                  • lucketone3 days ago |parent

                    Does NATO actually threaten Russia?

                    It threatens mobsters racket profits, but it will not start any actual fight.

                    • brabel3 days ago |parent

                      [flagged]

                      • lucketone3 days ago |parent

                        Context matters a lot.

                        You insert subtle hints of USSR/Russia being benevolent or good. (“Left without blood”, “victorious at enormous cost”)

                        This context is not real. There was blood since ww2. And major part of that ww2 cost you mentioned, was actually paid by Ukraine itself.

                        Countries joining NATO, did so not because they want to conquer Russia. (Are you proposing that Estonia wants to conquer Russia?)

                        Up until recently, European defence budgets were laughable. If decisions would be done based on actual risk analysis, it would be clear that NATO was not threatning to attack.

                        > Even if you were right , is the risk you may be wrong acceptable when it comes to your national security?

                        Yes, for Russia it will always be beneficial that all its neighbours are weak puppet states.

                        I concede all events in history (incl. Ukraine invitation) do lead us to this moment. But this is a bit of nitpicking, everybody see who is the psycho and everybody must deal with it.

                  • dijit3 days ago |parent

                    Sort of.

                    It’s not a secret that Ukraine is vital for the ground defence of Russia, but the Ukrainian people are pro-EU, and not from propaganda. You might well remember that their government was essentially a puppet for Russia until they were ousted. So if Ukraine is radicalised it is odd to think that its because of European propaganda- more likely they got tired of their masters.

                    I fully accept that Putin thinks of NATO as a threat to Russia, and NATO is at the door.

                    Its also entirely true that the border countries (Estonia for example) have major anxiety regarding a Russian invasion, and actively seek NATO membership to avoid that.

                    However, flying aircraft into sovereign territory (as Russia often did and continues to do to Sweden) is not the behaviour of a threatened country, they are the ones making the threats, constantly testing.

                    Their expansions into territory under the guise of “going where there are native Russians” will necessarily conclude with border regions being even more hostile to any native Russians wanting to settle. Again, in Estonia, the city of Narva is almost entirely native Russian; but they don’t want to be under Putin. Putins actions make Estonians wary of this fact and makes the Estonian government wish to integrate these people more instead of letting them live their lives.

                    In the Ukraine this was true too, thats why there was such a push to get people speaking Ukrainian, but Putin saw that his claim to the territory gets weaker over time and decided to invade.

                    If you understand the incentives of all involved, it is plain to see that Putin is the architect of his own misery here.

                    • brabel3 days ago |parent

                      I can see that you understand some of the incentives. But how can you conclude that the West bears no responsibility? I am not biased either way since I am not natively from Europe or the US, but I do live in Europe. From my perspective, the west was pushing all buttons necessary to cause this tragedy, knowing too well what those buttons were from the Russians. Yes, I agree Putin had to shoot first for what happened next, but his alternative was to allow complete encroachment from hostile powers. Don’t tell me Europe and the US were not hostile before 2014. I talked to people back then, and always wondered why they couldn’t move on and stop openly calling for Russia to be excluded from deals, for nuclear weapons to be stationed near their borders, for their ships to not be allowed passage, and many many more things only a hostile nation would suggest. Now they feel vindicated and think they were right, failing to notice that perhaps if they hadn’t been so hostile, none of this would have happened in the first place!!

                      Now, Greenland, as an example, would be wise to seek protection from the US, if we use the same logic, since it’s clearly being threatened, more clearly than the Baltic countries ever were by Russia since they joined NATO , at least. Imagine how the US would react if China was asked to help! Now, imagine Greenland actually had ties to the US going back several hundred years and a large population of “ethnic” Americans (bear with me). Would the US quietly sit while China initiated the process of establishing military presence in Greenland, at Greenlanders own request? Do you think they should, even if the current administration obviously wouldn’t entertain that for a second? Quite honestly, I think it would be foolish for the Americans to allow a sovereign nation near its borders to do something like that , and the Bay of Pigs conundrum shows that the US is not dumb and this will simply never happen. Now, the situation between Ukraine and Russia is not exactly the same , but if anything the incentive Russia has to prevent NATO there is even stronger than in the imaginary scenario I outlined above, I think that is as clear as anything can be in geopolitics.

                  • trinix9123 days ago |parent

                    > Yet the West made absolutely no attempt to calm the Russians down and for some reason announced in 2008 plans to expand to Georgia and Ukraine, despite even Western experts warning about that being utterly provocative.

                    It is the right of any sovereign country to freely join any military alliance, including NATO. The fact that this upsets Putin says more about him than the alliance and its (potential) members.

                    • vixen993 days ago |parent

                      There is an interesting transcript of what Putin said to US President Bush in 2001.

                      "Let me return to NATO enlargement. .... Russia is European and multi-ethnic. I can imagine us becoming allies. Only dire need could make us allied with others. Bit we feel left out of NATO. IF Russia is not part of this of course it feels left out. Why is NATO enlargement needed? In 1954 Russia applied to join NATO. I have the document. [ Bush: "that's interesting" ] NATO gave a negative answer with four specific reasons. Lack of an Austrian settlement. The totalitarian grip on Eastern Europe. And the need for Russia to cooperate with the UN disarmament process. Now all these conditions have been met.Perhaps Russia could be an ally."

                    • brabel3 days ago |parent

                      The US needs to start showing they actually believe that first by letting Cuba, several countries in South America, including Venezuela, and now even Greenland, freely choose who they ally with. Otherwise you’re just the same as Putin.

                      • trinix9123 days ago |parent

                        Greenland is a Danish territory, Denmark is already in NATO. Cuba is an ex-USSR ally, since USSR was sanctioned and that included allies, Cuba was sanctioned as well. Cuba is also sanctioned because of their own politics, similar to how Milosevic's Yugoslavia was.

                        Russia is threatening a direct military invasion to present-day and potential future NATO and EU members. When has the EU done the same to any of your listed countries/territories? When have the US said they will invade a country for simply allying with Russia or the BRICS?

              • trinix9123 days ago |parent

                Russia (or Putin, to be precise) has repeatedly threatened to invade EU members in the Baltics (rebuilding the SU/Russian Empire/etc), as well as threatened EU with stopping gas supply, which would've been a direct hit to the economy. These two are confirmed facts, there's also a lot more stuff speculated which you can freely find online.

        • tosapple4 days ago |parent

          What I am starting to appreciate about these digital infrastructure attacks is that they may be reversible and or temporary. It can be a nice feature.

          • arter453 days ago |parent

            Time matters.

            Imagine the power grid fails in an entire city for 48 hours. How many apartments or shops have backup power for 48 hours? What about hospitals or cellphone towers or traffic lights?

            How long before someone cannot make a 911 call or hits another car at night or dies in intensive care because the machines don’t work anymore? What about all the food in a refrigerator, or CCTV cameras, or POS payments or a thousand other things? And if sometimes physically fails, how long before a technician (who was himself relying on that power grid) is able to reach the place, carrying whatever spare part they have, and fix the thing?

            Or, take a dam. I’m no dam expert, but how long does it take before a flood happens? And when water starts flooding the streets, how long before people can’t get out of their homes, cars are swept away, and so on? How long before standing water starts carrying diseases?

          • matkoniecz3 days ago |parent

            Deaths resulting from such attack are not reversible.

          • jacquesm4 days ago |parent

            Then you're missing the point.

            If they succeed they may well not be reversible. The question is if this had succeeded would we have shrugged it off again or responded appropriately?

            • K0balt4 days ago |parent

              Can you give some examples of? I can imagine that under the right circumstances you might succeed in blowing up some transformers or even a turbine, but it seems like you’d be up to speed within a month or two on the outside? Or am I missing the gravity somehow?

              • 3eb7988a16634 days ago |parent

                Pardon? A month or two without power does not seem like an enormous crisis?

                Stuxnet destroyed centrifuges. It does not seem impossible that a sophisticated attack could shred some critical equipment. During the Texas 2021 outage -they were incredibly close to losing the entire grid and being in a blackstart scenario. Estimates were that it could take weeks to bring back power - all this without any physical equipment destroyed or malicious code within the network.

                Edit: Had to look it up, the Texas outage was "only" two weeks and scattershot in where it hit. The death toll is estimated at 246-702.

                https://en.wikipedia.org/wiki/2021_Texas_power_crisis

                • K0balt2 days ago |parent

                  A month or two of isolated outages should not be a crisis in a developed nation with resources and infrastructure.

                  The fact that the Texas outages killed anyone is a testament to the fact that the USA is, apparently, a developing nation, possibly going through a rough patch.

                  It’s not like there wasn’t enough generators or fuel in the nation to ameliorate that crisis. It was that, like all developing nations, resources are not available at the point of need despite their widespread availability.

              • jacquesm3 days ago |parent

                > Or am I missing the gravity somehow?

                Yes, there is the risk of cascading failures, some industrial processes are very hard to re-start once interrupted (or even impossible) and the lead time on 'some transformers' can be a year or more. These are nothing like the kind that you can buy at the corner hardware store. A couple of hundred tons or so for the really large ones.

                Grid infra is quite expensive, hard to replace and has very long lead times.

                The very worst you could do is induce oscillations.

              • XorNot3 days ago |parent

                Consider that if a cyberattack could destroy a major power grid transformer, for a marginal cost approaching zero, versus the low-end US$10 million a Kinzal ballistic missile would cost to do the same thing (presuming you only need 1 which is...unlikely), that that might be a significant military capability.

              • applied_heat4 days ago |parent

                Transformers and turbines of any significance are not off the shelf parts and can have lead times of years

                • sillywalk4 days ago |parent

                  > Transformers and turbines of any significance are not off the shelf parts and can have lead times of years

                  Bloomberg had a decent article[0] about transformers and their lead time. They're currently a bottleneck on building. It wasn't paywalled for me.

                  "The Covid-19 pandemic strained many supply chains, and most have recovered by now. The supply chain for transformers started experiencing troubles earlier — and it’s only worsened since. Instead of taking a few months to a year, the lead time for large transformer delivery is now three to five years. " [0]

                  [0] https://www.bloomberg.com/features/2025-bottlenecks-transfor...

                • esafak4 days ago |parent

                  How do they not have backups??

                  • 3eb7988a16634 days ago |parent

                    Enough for the entire grid? There are some amount of reserves on hand (eg drunk runs into a telephone pole), but nothing that could replace a targeted attack with the explicit goal of taking out the most vital infrastructure.

                    • jacquesm3 days ago |parent

                      And those pole mounted transformers are tiny. The big ones require special transports and can weigh a few hundred tons. Some are so large they are best transported via boat if possible.

              • thimkerbell3 days ago |parent

                I've seen less-than-credible software in an ATM and in a "ring up your own groceries" station. No idea who's behind it or who would care, though.

              • genocidicbunny4 days ago |parent

                It's middle of winter, and it gets pretty danged cold. Being without power in such weather might well end up being deadly, even with short durations.

            • tosapple4 days ago |parent

              I wasn't commenting on any particular case. I was stating that flipping a switch is less costly to reverse than blowing up a dam.

              • jacquesm4 days ago |parent

                These attacks are not at the level of 'flipping a switch'. If they succeed they can destabilize the grid and that has the potential to destroy gear, and while not as costly as blowing up a dam it can still be quite costly.

                • tosapple4 days ago |parent

                  During WW2 both germany and the UK as example were carpet bombed to assail industry, does that help you to understand my position better?

                  Vietnam too.

                  • ben_w3 days ago |parent

                    The reason everyone used carpet bombing in WW2 was the inability to aim competently. This even persisted after WW2, leading to some tests of air-to-air nuclear weapons just to give the missiles a decent chance to actually disable the target they were fired at.

                    The counter-strategies that the British used to defend against German strikes included "switch off all the lights at night so they don't know where they are" and "order newspapers to lie about which part of the city was damaged in order that spies reading British newspapers and reporting back to HQ said missiles fell short/went too far, causing HQ to incorrectly compensate on the next strike". I don't know if the reverse was true, despite now living in Berlin.

                    Everyone's supply chains were also much shallower, and equipment much cruder and therefore easier to make (though also less efficient). Half of London or Berlin losing electricity makes a much smaller difference when far less was electrified in the first place, e.g. loss of electricity for a heat pump doesn't matter so much when the terraces and apartment blocks have internal fireplaces and regular coal deliveries.

                    Also re Vietnam, it took until 1997 to return to the per-person energy use it had in 1970: https://ourworldindata.org/profile/energy/vietnam

                    And until 1993 to reach the not-adjusted-for-population level.

                    And the electricity graphs don't even go back far enough to see what that war was like, that's all energy.

                  • shakna4 days ago |parent

                    Not really.

                    If you succeed in attacking the grid, you achieve the same widespread industry impact, without the cost of the munitions.

                    It can take decades to recover from a cyber attack like this, if it succeeds.

                    • tosapple4 days ago |parent

                      Again, not endoring any specific case just endorsing SPECIFICITY, COST, and "Collaterals".

                      • shakna4 days ago |parent

                        I was not speaking to just one case. Today's incident, is _the norm_.

                        These attacks are widespread, damaging, and the repercussions are felt for decades in their wake. We _are_ being carpet bombed, and the costs for the victims are ongoing and growing. The collateral damage is everywhere.

                        Do you really think there's no impact?

                        > Cyber units from at least one nation state routinely try to explore and exploit Australia’s critical infrastructure networks, almost certainly mapping systems so they can lay down malware or maintain access in the future.

                        > We recently discovered one of those units targeting critical networks in the United States. ASIO worked closely with our American counterpart to evict the hackers and shut down their global accesses, including nodes here in Australia.

                        > https://www.intelligence.gov.au/news/asio-annual-threat-asse...

                        • tosapple4 days ago |parent

                          [flagged]

                          • shakna3 days ago |parent

                            I guess I shouldn't be drawn by someone calling me an idiot...

                            But one last try.

                            You suggested that the cost of cyberattacks on industry, is not so great as when we were destroying it with bombs instead.

                            However, every time we have power outages, people die. Then we have the cost of securing the infrastructure. And the cost of everyone else affected, who has to increase their resilience.

                            Your bank is collateral damage, as is the people freezing to death in their homes. Entire industries are on the verge of collapse - getting a new turbine to help stabilise your grid has a lead time of _years_, not days or weeks. And if you hit weeks, people die.

                            Insurance responds to attacks, and that trickles out to everywhere that is touched. VISA and MasterCard have to prepare for eventualities, because of attacks not aimed at them, but at power infrastructure.

                            When power is hit... There is nothing unaffected.

                            Volt Typhoon hit the US power grid, and required a massive multinational effort to extract them, that took almost a year... And VT wasn't intended to do damage, just look for weak spots. So that next time, they can cause damage. As part of that survival process, various hardware partners were kicked to the curb, and the repercussions are still in the process of being felt. Half the industry may have issues surviving because of it.

                            Industroyer is one of the reasons that Kyiv got as bad as it did. Malware is not some hand-wave and fix thing. Half the city's relays were permanently damaged.

                            Then of course, there was Stuxnet. Which blew up centrifuges, and the research centres hit are still trying to recover from where they were, then.

                            Cyberattacks are a weapon of war, people die, industries die, and there is no easy path to recovery following it.

                            An entire industry exists, just to defend against these kinds of attacks. The money spent on that, is counted, which means it has to be less than the cost of the attack succeeding. Trillions are spent, because there is absolute weight behind surviving these attacks.

                            If things were easier, it'd be an industry solely focused on backups and flipping a switch. But it's not.

                            • 3 days ago |parent
                              [deleted]
                          • idiotsecant4 days ago |parent

                            'I appreciate that these scammers are just stealing old people's money online instead of killing them and taking it'!

      • rdtsc4 days ago |parent

        Does Europe overall feel and act like that’s the case though?

        It seems as if the European war has been pushed to the background recently, and most people kind of forgot about it. If you walk down the streets of Paris or Berlin does it look like it’s wartime, do people talk about it much, do they share the latest front news and so on?

        • joe_mamba4 days ago |parent

          >If you walk down the streets of Paris or Berlin does it look like it’s wartime,

          Like what exactly would you want them to do? Run around screaming all day because there's a war in another country 2000 km away from them?

          No, people just go on with their lives, doing their jobs, taking care of family and friends, paying their taxes, so that specialized workers in the ministry of defence can take care of the war stuff for them. That's how modern society works.

          It's even similar in Kiev, when you walk down the streets you see people living their lives. Gyms, bars, cafes, clubs are full and lively. People don't stop living and enjoying their daily lives just because there's shelling somewhere else in the country.

          • jsrcout4 days ago |parent

            > It's even similar in Kiev, when you walk down the streets you see people living their lives. Gyms, bars, cafes, clubs are full and lively. People don't stop living and enjoying their daily lives just because there's shelling somewhere else in the country.

            While it's true to a certain degree, you make it sound like Kyiv residents are having a grand old time right now. But in reality, the majority are trying very hard to keep from freezing to death as Russian attacks targeting their power and heating infrastructure have destroyed much of it.

            • joe_mamba3 days ago |parent

              >While it's true to a certain degree, you make it sound like Kyiv residents are having a grand old time right now.

              I am not. You choose to interpret it that way.

          • rdtsc3 days ago |parent

            Since we’re going with Kyiv equivalence, presumably there not air raid sirens, veterans coming back from war, mobilization vans grabbing people from the streets. I just don’t see how “Kyiv is the exact same way” is plausible.

            > Like what exactly would you want them to do? Run around screaming all day

            And I didn’t suggest they should “do something or other” I was wondering what the situation was since I am not there in person and figured enough HNers might be.

          • koiueo4 days ago |parent

            Kyiv.

            And "enjoying their daily lives" diminishes real tragedies of Ukrainians' daily lives.

            • joe_mamba4 days ago |parent

              I beg to differ. Calling going out to a gym, cafe, club or a bar during wartime, as anything other than enjoying life, diminishes the real tragedy of those who are fighting on the front line and don't enjoy such leisure activities. Some people are fortunate enough that they can still get to enjoy life even if their country is in a war, as just like in every war ever, not everyone is affected equally.

              • koiueo3 days ago |parent

                > not everyone is affected equally

                I agree. However if we talk about Kyiv, I'd like to remind you that electricity is available 2-4 hours per day, in some regions there has been no water nor heating for the last week. Everyone I know are extremely stressed, and if anyone visits their gym, it's not to enjoy life, but to not slip into total despair.

              • TheOtherHobbes3 days ago |parent

                I wasn't aware gym membership could bring 2,500 Ukrainian civilians back from the dead.

                • joe_mamba3 days ago |parent

                  You aren't aware, because you're making stupid analogies in bad faith that have nothing to do with what I'm saying.

          • pocksuppet4 days ago |parent

            [dead]

        • postepowanieadm3 days ago |parent

          Berlin recently had a blackdown caused by domestic terrorists.

          • rdtsc3 days ago |parent

            Is everyone talking about domestic terrorism or Putin and the war in Ukraine? Or are you thinking the domestic terrorism is not that domestic and it’s Putin doing it?

            • ben_w3 days ago |parent

              IMO both recent cuts were at minimum funded and encouraged by Russia. But the conversations I've seen here in Berlin that discuss the power cuts can be enumerated using only thumbs, and we've had quite a few severe weather warnings vs two power failure warnings.

              There's also occasional anti-NATO "stop the war" marches, and some longer-duration pro-Ukraine vigils above the Brandenburger Tor U-Bahn station.

        • 4 days ago |parent
          [deleted]
        • TacticalCoder4 days ago |parent

          [flagged]

          • RobotToaster4 days ago |parent

            It wasn't Iran that bombed Afghanistan, Libya, and Iraq[0]. Gadaffi warned that Libya was the only thing stopping most migrants reaching Europe.

            [0] at least recently

          • anonnon4 days ago |parent

            In fairness, a large chunk of those immigrants to France were "Pied Noirs" and other diaspora from its former colonial possessions, e.g., Indochina.

          • anotherbadday4 days ago |parent

            [flagged]

      • dopa423654 days ago |parent

        Thankfully we'll magically stop being at war with Russia once Ukraine gives up :P

        • kstenerud3 days ago |parent

          Haha yep :P

          Next is Moldova.

          Then Latvia and Lithuania.

          Then Estonia and Northern Finland/Norway.

          Then Romania and Bulgaria.

          Putin has already said many times that he intends to rebuild the Russian empire to its zenith.

      • wolvesechoes3 days ago |parent

        It is not, because Europe is not a political entity. Russia is at war with some European countries.

        • vaylian3 days ago |parent

          Russia considers all the European countries as lesser states that should be dominated. Even Hungary, which is politically friendly to Russia, is probably experiencing a lot of disinformation campaigns, because Russia wants to ensure that Putin's lapdog (i.e. Orban) stays in power and serves russian interests.

          • vixen993 days ago |parent

            It would be helpful if we could avoid this kind of language that assumes (in this case) 'everyone knows that Orban is Russia's lapdog with an implication that if you don't know that then you're ... whatever. No, I'm not supporting Orban. I simply don't know enough in detail to comment. Perhaps you don't either. Better to describe what actually transpires (facts on the ground) and leave the generalization which inevitably depends in too many cases on one's private predilections. Popular public discussion in general is replete with this. Better to be aware that many of us have a tendency try to shoehorn factual observations into a handy emotive category which happens to appeal.

            • vaylian3 days ago |parent

              If you want facts, then start at this overview article on Wikipedia: https://en.wikipedia.org/wiki/Russian_disinformation

      • redeeman4 days ago |parent

        have you seen the competence in those who manage the infrastructure? i'd say i would need significant proof before assuming anything. And IF russia is doing it, I would still say that we should put 99% blame on the absolute incompetents running the infrastructure, 1% russia.

        • jacquesm4 days ago |parent

          If you did then you'd be extremely gullible.

        • OKRainbowKid4 days ago |parent

          That seems like just victim blaming - "she was asking for it with the clothes she was wearing".

          • RobotToaster4 days ago |parent

            Software with vulnerabilities was defectively written.

            If someone makes tanks with paper for armour, because it cuts costs, they are to blame if those tanks catch fire.

            • nawgz3 days ago |parent

              A tank is designed for war. Infrastructure is designed to serve some other utility. Claiming it should also be hardened against (cyber) war is acknowledging that there is an aggressor performing an attack of war, not that the infrastructure is failing the utility it was designed for.

              It's fine to have this view that software should be defect free and hardened against sophisticated nation-state attackers, but it stretches the meaning of "defect" to me. A defect would be serving to fulfill that utility it had been designed for, not succumbing to malicious attackers.

              • redeeman3 days ago |parent

                okay, so you think just attaching PLCs to an rs485-to-ethernet adapter and connecting it straight unauthenticated to the internet, and then calling it a day is simply perfectly reasonable, since "well.. cant expect to harden against cyber warfare!! no defect!!!" ?

                because this is the kind of stuff infrastructure things do, along with MANY other things. Im sure not all infrastructure does it, but plenty do.

                This is not hardening, its BASIC security. any scriptkiddie from same country could find it and cause problems.

                How far would you say they should go to stop domestic script kiddies from messing with it? and if script kiddies from other countries mess with it, is it now cyber warfare?

                • nawgz3 days ago |parent

                  Well, your unsourced assertions sound dramatically incompetent, but the linked article says the Russian cyberattack on Ukraine in 2015 was the first malware caused blackout, and the titular event of the article failed to cause harm, which kind of paints a different picture.

                  I’ll therefore decline to comment on your assertions. I will acknowledge it’s time to consider Russian interference as expected if you are designing an internet connected system, fine, but it looks like it’s non trivial to fatally compromise these systems already.

                  • redeeman2 days ago |parent

                    depends on what you mean by fatally compromise, much infrastructure across europe, and I would strongly think the US aswell(allthough here I am only familiar with 1 example), it is absolutely trivial to atleast temporarily disable and possibly bring some harm for anyone unauthenticatedly.

                    I am not saying whether russians are doing it or not, im just saying that its not just victim blaming, and that anyone operating with this level of security is grossly negligant and should be severely punished as criminals

          • redeeman3 days ago |parent

            no, thats not the same. If you for example leave your front door open, and the insurance finds out, do you think they will be doing "victim blaming" ?

            so lets turn this logic around on those megacorps that leaks personal data, suppose they run an open postgres or mongodb with ALL the customer data, no password or default password, on the open ipv6, is it victimblaming to go after them for this? after all, its the big bad criminals that stole the data?

            the truth of the matter is that yes, the ones that take the data are criminals, but so are the one that doesnt take proper pracautions.

            Have you actually seen how these infrastructure things operate? many of them have open scada systems directly coupled to the internet. Many of them have sms gateways that just accepts messages from _ANY_ phone number to issue shutdowns.

            I know because I have been brought in to look at some of those things as a consultant

    • theshrike79a day ago |parent

      https://en.wikipedia.org/wiki/New_generation_warfare

      It's the Russian doctrine

      Keep the population of hostile countries uneasy at all times, destabilise a bit here and there, help them argue about stupid identity politics instead of focusing on things that actually matter.

      When people become complacent about Russians poking around here and there, breaking in and not doing anything etc - then when they actually need to act, the defence will be lukewarm.

    • tokai4 days ago |parent

      Russia is currently focused at striking Ukrainian energy assets. Ukraine get energy imports from EU through Hungary and Poland. Hampering energy supply from Poland would but a huge strain on the already struggling Ukrainian network.

    • badpun3 days ago |parent

      Poland is frequently listed by Putin and his crew as one of Russia’s greatest enemies.

      • weezing3 days ago |parent

        Nihil novi. It's like that for centuries. They are still salty about losing Moscow.

    • IncreasePosts4 days ago |parent

      The most obvious answer is Russia(or one of their allies like China or Iran) did it because Poland is supporting Ukraine in the war (directly, and also indirectly by letting stuff from other countries be staged and move through Poland).

      • kstenerud3 days ago |parent

        That would be the most obvious answer, but Russia wants to keep Poland off-balance over the next 2 decades so that they won't intervene as Russia captures its neighbors. You'll see a lot more sabotage in France if Europe agrees to a new nuclear defense pact.

  • wtcactus3 days ago

    Will this be the time that EU grows a spine and comes together to oppose Russia?

    Naaa, better continue to have Germany and France continue to destroy the Union by looking only at their self interests while they pretend to talk tough on Trump and sabotage any real internal changes so that they can keep their crumbs.

    Just this week, France’s meddling halted a deal that was 30 years in the making: Mercosul while their president, in all his virtue signaling went on Davos to pretend to have the moral upper hand on the USA.

    We’re a union of hypocrites. And France and Germany are the worst of them.

    • rasz3 days ago |parent

      >France’s meddling halted a deal that was 30 years in the making: Mercosul

      Mercosur would actually be Polish complaint to the EU Court of Justice (CJEU)

      https://www.visahq.com/news/2026-01-22/pl/polish-meps-spearh...

      • weezing3 days ago |parent

        Poland as usual doing God's work.

    • v_iter3 days ago |parent

      Yes, but how could that be solved? To solve this issue you'd have to significantly reduce the sovereignty of the EU member states, which some, especially Poland will oppose fiercely. But on the other had, without some coherent cooperation and responses, Europe will be chewed up country at a time by Russia, and maybe in the future by China.

      • hkt3 days ago |parent

        https://eur-lex.europa.eu/EN/legal-content/glossary/mutual-d...

        Any actual EU members are in principle protected by this, even if they aren't NATO members. Whether or not EU countries being in NATO diminishes their ability to act without US consent is debatable and I lean towards saying NATO's joint command essentially sets article 42 cooperation up to fail.

        That's the difference between Ukraine and the other countries on Putin's list though: Ukraine wasn't in the EU or NATO, and for all intents and purposes had no allies.

        • v_iter3 days ago |parent

          Things like that don't protect countries. If a real threat arises, if there is no unified force, under the command of one central organ, they won't cooperate, it will always be inferior to the force that does have a single unified command center, like Russia for example or China. NATO or the EU cannot command, say Poland or Germany where to put their forces and what to do with them, but Russia and China can do that with their own. Although their military potential is on par (I mean NATO and Russia) My point is, although on paper NATO is great, it's still fragmented, and to some extent relies on who is in power politically, for example the tomorrow's president of an X country can say "Oh, we will leave NATO yata yata"

    • hardlianotion3 days ago |parent

      Which EU? The EU that continues to buy rebadged Russian oil and gas, the EU that sold them entire fleets of shadow tankers? Or the one that likes to pretend that states bordering Russia have suddenly acquired the exact same demand for expensive cars that Russia used to exhibit?

  • tartoran4 days ago

    Hybrid war on Europe.

  • NedF3 days ago

    [dead]

  • johanneskanybal4 days ago

    With all the other crazy world-destroying us bullshit, is this also you? 50% you, 50% russia. It's an new gameshow, is it Russian or us?