critical infrastructure

Bilingual

Coordinated cyberattack disrupts water utilities in 30 Minnesota communities
2 months ago
- A coordinated cyberattack disrupted water and wastewater utilities in over 30 Minnesota communities over Sunday and Monday.
- Affected towns like Braham (population 1,700) and the Minneapolis suburb of Plymouth had to disconnect equipment to stop the attack; water quality remained safe.
- State and federal agencies, including CISA, EPA, and FBI, responded, sharing threat intelligence and helping utilities contain and remediate damages.
- The attack is suspected to involve Iranian hacking groups, such as CyberAv3ngers, which have been warned about targeting operational technology devices.
- Water utilities nationwide are highly vulnerable, with over 70% failing to comply with risk assessment requirements, and many small rural systems lack cybersecurity resources.
- Emerging AI models are enabling attackers to craft more sophisticated plans, and experts warn that attacks could severely impact hospitals that depend on water supplies.
Cyber Security: A Pre-War Reality Check - Bert Hubert's writings
2 months ago
- The speaker warns that Europe is in a 'pre-war era,' citing Donald Tusk's similar warnings about Russia, and emphasizes the need for a wartime mindset in cybersecurity.
- EU has introduced multiple new cybersecurity laws (post-Titanic regulatory environment) to address vulnerabilities, though implementation is still ongoing.
- Critical infrastructure (e.g., telecommunications, bridges) is overly complex and fragile, often failing without attacks; examples include the Botlek Bridge and the Dutch emergency communication network.
- Reliance on foreign maintenance (e.g., from China or India) for telecommunications and IT creates geopolitical risks, especially if those countries align with adversaries.
- The netherlands and Europe are losing technical expertise and ownership of their infrastructure, with non-technical decision-makers outsourcing to cloud providers like Microsoft, Google, and AWS.
- Simple security flaws (e.g., directory traversal, weak password resets) remain common in major software, undermining resilience against attacks.
- Ukraine's Kyivstar attack shows that preparedness and local expertise can enable rapid recovery, whereas Netherlands' similar systems could fail for months due to lack of in-house knowledge.
Dashboard totale Amerikaanse afhankelijkheden - Bert Hubert's writings
2 months ago
- A list of Dutch organizations totally dependent on US cloud services, where societal disruption would occur if they stopped working due to US sanctions (e.g., over Greenland).
- Government entities include the Dutch Parliament, RDW, IND, UWV, all municipalities and provinces, COA, tax office, KNMI, and the judiciary, all relying heavily on Microsoft Azure or M365.
- Media outlets like major newspapers (DPG, Telegraaf, NRC), radio/TV stations (NOS, RTL, BNR), and regional broadcasters depend on Google, Microsoft, or AWS.
- Banks and payment systems (all major banks, DNB, BKR) rely on US clouds; however, Geldmaat ATMs claim to function without AWS.
- Transport sectors: OVPay, GVB Amsterdam, Loodswezen (pilotage), ProRail, and NS are migrating critical systems to Azure or AWS.
- Healthcare heavily virtualized: hospitals, GP posts, patient records (Chipsoft HiX), VECOZO billing, NEDAP, Sanday, ZorgDomein run on US clouds; RIVM and Zivver also dependent.
- Energy grid operators show some resilience, but telecom and cyber security (Crowdstrike, Fortinet, etc.) pose risks due to US-based live updates.
- Other sectors: all notary offices, housing corporations, education, and 600,000 businesses using Exact Online (AWS) are fully dependent.
- A special note: 'sovereign clouds' would also stop working under sanctions, and the government has become 'analog incompetent' with no fallback.
- The list is incomplete; readers are invited to email additions to bert@hubertnet.nl.
When China Gets Its Own Mythos
2 months ago
- Anthropic and OpenAI have developed AI models (Mythos, GPT-5.5-Cyber) that can find and exploit software vulnerabilities faster and more effectively than most humans, even detecting flaws undetected for decades.
- These AI models are currently restricted to defensive cybersecurity work, but adversaries like China are racing to acquire similar capabilities through distillation, chip smuggling, and domestic development.
- The United States has a short window (9–12 months) to bolster critical infrastructure defenses against AI-powered cyberattacks, which could enable widespread, simultaneous disruption of water, power, and transit systems.
- China's open-weight model GLM-5.2 and its state-aligned labs pose a near-term threat, as Chinese actors can easily remove safeguards and deploy offensive capabilities.
- Policy recommendations include disrupting adversarial distillation and chip smuggling, creating a dedicated cyberdefense institution (e.g., Idaho National Laboratory), and redesigning infrastructure for resilience against physical attacks.
- The U.S. must also strengthen counterintelligence for AI labs and coordinate with international allies to secure critical infrastructure vendors.
SSH with default credentials found in CCS2 Chargers
2 months ago
- XCharge C6 EV chargers expose SSH and Telnet services on all network interfaces, including the CCS2 charging port, with default credentials root:root, allowing immediate root access to anyone who plugs in a malicious EV.
- The attack requires only $130 in hardware (CCS2-compatible device, PLC modem, Raspberry Pi) and physical access to the charging port, enabling energy theft, device manipulation, and potential pivot to the CPO's private network.
- The vulnerability pattern (services bound to 0.0.0.0, weak/default credentials, no authentication hardening) is common across the EV charging industry, and the exposed services on CCS2 could become a ticking time bomb if future CVEs eliminate the need for credentials.
- Recommendations for CPOs include immediate firmware updates, monitoring for abnormal SLAC/V2G communication, and network segmentation; vendors should generate unique credentials per device and bind administrative services only to management interfaces.

critical infrastructure

Coordinated cyberattack disrupts water utilities in 30 Minnesota communities

Cyber Security: A Pre-War Reality Check - Bert Hubert's writings

Dashboard totale Amerikaanse afhankelijkheden - Bert Hubert's writings

When China Gets Its Own Mythos

SSH with default credentials found in CCS2 Chargers