Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×

Comment Re:The math from TFS ... (Score 1) 263

I can't say about MI, but in NC, every pump I've ever seen has a mechanical flow counter... for tax purposes. I can't say the station is recording those numbers on any scale that would help here. (daily, hourly...) If you crash the control interface, the back-office systems won't have a count, but the tax man will!

The "at least 10" part most likely comes from an estimate of security footage.

Comment Re:Manual Shut Off? (Score 1) 263

We recently had a car in a neighbor's lot catch fire. (they didn't lock it, and some heroin idiots set it on fire) A fire truck was there in ~2min, they were actively dealing with it in under 5min. That car was right behind a gas station, so they were likely highly motivated to stop that explosion. Yes, it did take ~20min for a cop to show up to block off the street.

Comment Re:Manual Shut Off? (Score 1) 263

There have been times when I've called the police and it took hours for someone to finally respond. Non-emergencies are zero priority. (they had wrecks, burglaries, and drunks to deal with)

A malfunctioning gas pump that's giving away free gas isn't remotely an emergency. There are at least a dozen different ways to deal with the situation. From turning off the entire station (there's actually only one pump (per grade); the things from which you get the gas is a just a metered dispenser), to padlocking the pump, to parking other cars around that pump to keep others away from it.

Comment Re:Click-bait title? (Score 1) 67

There are plenty of ways to secure BGP, and routing in general. However, just like the locks on your house, they don't do you any good if you don't actually lock them. We have yet to see a BGP session be hijacked, or an external attacker inject a rogue route into an established BGP session. What we DO see all the time are flaming idiots accepting whatever the hell someone advertises.

Comment Re: Wait a minute (Score 1) 67

Done. And Done. They took over the address space for Amazon's DNS service (Route 53), so they ARE the DNS for many domains. That gives them 100% control of all DNS answers, including where the server is. That traffic now goes to a server they control. It's trivial to get a Let's Encrypt signed certificate under these conditions.

(Of course, these guys didn't even bother to do that.)

Comment Re: Wait a minute (Score 0) 67

Nope. The issue (ssl certificate) is still entirely a Big Giant Fail(tm) on Let's Encrypt's part. If I can take over your DNS, I can effectively become your server and *poof* now I can those fools to sign a certificate for my stolen domain. Now, these guys didn't actually do that, so there actions where immediately evident.

Yes, they used BGP to announce more specific routes to parts of Amazon's DNS infrastructure so that traffic came to them. They were then in effective control of many domains, but apparently chose to hijack some cryptocurrency site.

There are plenty of ways to secure BGP, and routing in general. However, just like the locks on your house, they don't do you any good if you don't actually lock them. We have yet to see a BGP session be hijacked, or an external attack inject a rogue route into an established BGP session. What we DO see all the time are flaming idiots accepting whatever the hell someone advertises.

Slashdot Top Deals

Living on Earth may be expensive, but it includes an annual free trip around the Sun.

Working...