[HN Gopher] Inside the Transport for London cyberattack
___________________________________________________________________
Inside the Transport for London cyberattack
Author : alexbilbie
Score : 90 points
Date : 2024-10-27 17:24 UTC (5 hours ago)
(HTM) web link (www.londoncentric.media)
(TXT) w3m dump (www.londoncentric.media)
| com wrote:
| Lots of people who should have been establishing effective
| security practices and monitoring and improving it were doing ...
| something ... but not that.
|
| Total failure of management and governance at TfL and the British
| Library (which even had a "private sector security leader" on its
| board of governors for a decade or more before their total
| shitshow of a breach last year)
|
| But as usual, there will be no consequences.
| chrisjj wrote:
| > no consequences.
|
| I recommend "repercussions" ;)
| jen20 wrote:
| TFL are better than most public bodies but are likely hamstrung
| on being able to pay anything like market rates for competent
| security people.
| com wrote:
| Totally get it that budgets are tight. But making sure that
| stuff happens isn't highly correlated to tech staff or
| manager salaries.
|
| Unless they're hiring inexperienced high-schoolers, it's a
| failure of will and competence in management. And even that
| would actually be a failure of managrnent.
|
| I'm guessing - based on historic contacts with TfL - that
| this failure of management is probably manifest in too many
| meetings and intermediate products valorised over and above
| culture, knowledge and tech improvements.
|
| Avoidance of outcome-based monitoring and governance, and
| instead a focus on "process execution" like reorgs,
| agonisingly-slow checkbox actions and deckchair relocations
| is pretty common in low-ambition, low-performance orgs.
| Again, you don't get this because you're being cheap on
| security people.
| lol768 wrote:
| > Earlier this month Andy Lord, the boss of Transport for London,
| sat down at a scheduled board meeting and praised his
| organisation's response to a "highly sophisticated" cyberattack,
| which began with reports of "suspicious activity" on Sunday 1st
| September.
|
| > "The vast majority of Londoners would not know this attack has
| happened," the TfL commissioner told board members including
| mayor Sadiq Khan. Lord later added: "Because it's been so well-
| managed people didn't understand the scale and impact."
|
| Are these people completely delusional? They've taken away
| passenger's visibility to see what they were being charged for;
| they killed all of the open data feeds (though a few of these
| have _just_ now been restored in the last couple of days). Back
| in September, they disrupted all of their staff 's productivity
| by locking everybody out and forcing them to try and do their
| jobs without any access to technology. And.. there's still no end
| in sight for a restore of the contactless portal.
|
| The way they've managed the incident and the collateral damage
| suggests there were not nearly enough security controls present
| in the first place (in terms of containing the breach). How many
| weeks on are we now without service restoration? For a
| cyberattack perpetrated by one seventeen year old?
|
| If it was an SME who didn't do anything technical and had been
| caught completely unprepared, I might be more understanding.
| avianlyric wrote:
| I can believe, I live in London and depend on TfL all the time.
| It's last 10 or so years, I've probably only bothered looking
| up my travel data a dozen or so times. 99% of the time I'm
| charged the right amount, and I don't have to think about it.
| bastard_op wrote:
| As soon as you read "outsourced their IT", one can always assume
| the aftermath would be a shitshow, as it is always done in
| response to the previous team not being able to run it, which
| means it is a goddamn mess. Having worked enough state and city
| government IT contracts in the past 25 years, you just assume the
| worst about everything and are often not disappointed. It's not a
| matter of if but when they'll be owned really, and most really
| wouldn't know what to do if they were still today.
|
| This is your relative tax dollars hard at work.
| avianlyric wrote:
| Where does it say they outsourced their IT? The article
| mentions city hall outsourcing their IT to TfL, but city hall
| is sister organisation to TfL, they're both organs of London
| regional government. The London Mayor is the chairman of TfL
| and the head of London regional government.
|
| It's not like they're outsourcing to some private organisation,
| every single organisation is either a state organisation, or a
| state owned company.
| Groxx wrote:
| I think they just read it backwards. Near the beginning in
| the bulleted list is:
|
| > _Sadiq Khan's office and the Greater London Authority
| outsourced their IT services to TfL this summer, meaning they
| were also badly impacted, paralysing services at the top of
| the capital's devolved government._
|
| Which means TfL is the one doing other people's IT in
| addition to its own, not the reverse.
| mellosouls wrote:
| _always done in response to the previous team not being able to
| run it, which means it is a goddamn mess.
|
| :
|
| This is your relative tax dollars hard at work._
|
| I think you are underestimating the gross lack of realistic
| investment and corresponding demoralization and qualitative
| decline in some public services; which latter is then used by
| the decision-makers who've created the situation as
| justification for swashbuckling "transformation" projects -
| advised by and given to overpriced consultants - they can put
| on their CVs before hopping to the next gig.
|
| _That 's_ your tax dollars at work.
| aiiotnoodle wrote:
| I agree. Public sector IT becomes a huge sprawl of technologies
| and cottage industry applications which makes administering
| these often rarely touched interfaces difficult to do properly
| when department budgets are tight and resources are busy fire
| fighting the processes that failed the night before.
|
| It is also difficult to hire because wages are generally low
| compared to similar roles in private industry, yet they need
| skilled staff to manage these complex environments. A lot of
| services don't get the attention they need, not just patching
| and upgrades but development, requirements capture and
| usability all kept to a minimum cost to keep the sinking ship
| afloat.
|
| All these constraints also lean to a culture of poor security,
| JFDI, rip and replace, insufficent hardware etc... just so the
| business can operate on whatever computer on wheels in the
| shipping depot or relatively expensive to replace electronic
| gate system with intergration to their custom fleet management
| software.
|
| Government outsourcing to another related body has its cost
| advantages but the many domain administrator users, the huge
| flat VmWare estate and the hardware well beyond warranty
| doesn't dissapear.
|
| Designed to serve immediate needs but without long-term
| maintenance or holistic design in mind. Outsourcing amplifies
| the issue.
| manojlds wrote:
| Why is the Mayor not even talking about this?
| avianlyric wrote:
| What is there for the Mayor to say? The trains still run, the
| busses still turn up, the traffic lights still go red, yellow,
| green.
|
| For the vast majority of people, there little to no impact day-
| to-day. Sure the loss of live data is annoying, but trains
| still turn up every 2 mins, and busses every 5-10mins during
| the day. Even at night, busses still turn up every 15-20mins,
| so checking live data doesn't give you that much of an edge.
| surfingdino wrote:
| Because there is no political gain for him in this story.
| bdndndndbve wrote:
| It's amazing how much bureaucracy they're willing to spend money
| on to means-test a fundamental service. If you just made transit
| free at the point of service you wouldn't have free cards for all
| under 16, and some over 16, and all over 60, and discount fares
| for people in poverty. Cities spend so much money outsourcing the
| IT for fare collection, and the administration of budget
| programs, and ultimately the experience is worse for the end
| users. It's a real case of the politically connected hoovering up
| tens of millions of dollars because suburban voters can't stomach
| a poor person getting to ride the bus for free.
| cdot2 wrote:
| All of this IT infrastructure exists to ensure the exact
| opposite of what you said. It ensures that rich people don't
| get to ride the bus for free.
| whiplash451 wrote:
| Not the opposite, but the complementary, to be precise.
| truckerbill wrote:
| The point is it's easier to just tax wealth a bit more and
| let everyone get on the bloody train... It's mostly people
| just going to work/school, makes sense to be free
| KaiserPro wrote:
| > easier to just tax wealth a bit more and let everyone get
| on the bloody train
|
| I mean its not. If it was, they would have done it.
|
| Wealth taxes are really fucking hard to do equitably, at
| least at first.
|
| For example OAPs tend to live in very expensive hosues.
| take rotherhithe for example one could have bought a house
| in the 90s for shit all, and now its worth the best part of
| 1.4 million.
|
| so now you're levying a 5% tax on a pensioner, or worse
| still a young couple mortgaged to the fucker.
|
| Now, but what about the super asset rich I hear you say?
|
| Well, they'll transfer all they own into a corporation.
| They can't tax assets like that on business because it'll
| crash the economy super quick.
| bdndndndbve wrote:
| We need a housing policy reset, the OAPs shouldn't have
| the majority of their retirement assets tied up in a 1.4M
| illiquid house. They need an affordable off-ramp to
| downsize, and we need to build more affordable housing to
| deflate the market. This is wildly unpopular because lots
| of people are already over-leveraged trying to get onto
| the property ladder, but objectively it's the correct
| course to start to unfuck things.
|
| The purpose of a house or apartment should be shelter for
| a family, not a retirement plan or an investment for a
| corporation.
| ghusto wrote:
| Okay Mao.
| fragmede wrote:
| > This is wildly unpopular.
|
| Case in point. No one's suggesting confiscating anything,
| yet some people can't contain themselves at the
| suggestion that maybe housing policy is broken.
| KaiserPro wrote:
| > more affordable housing to deflate the market
|
| hard yes
|
| > affordable off-ramp to downsize,
|
| I mean yes, but the hidden cost is moving outside of your
| support network. Downsizing is often very lucrative.
| ghusto wrote:
| > Well, they'll transfer all they own into a corporation.
| They can't tax assets like that on business because it'll
| crash the economy super quick
|
| Thanks for that. I've always thought that wealth isn't
| taxed heavily because it's the wealthy that make the
| laws. That still may be part of it, but this surely is
| too.
|
| As a side note, I'm puzzled as to where this seemingly
| prevalent (here, at least) sentiment of letting people
| ride public transport for free has suddenly come from? It
| makes absolutely no sense, but is being said as if it's
| the most obvious thing in the world!
| qeternity wrote:
| Wealth isn't taxed because most wealth, unlike income or
| other use taxes, are based on valuations that are
| extremely fragile.
|
| Let's say you open a corner bakery that does very well.
| You are making $1m/year and paying the government
| $200k/yr in corporation taxes. That leaves $800k/yr in
| the biz. A perpetuity paying $800k/yr at 5% discount rate
| is worth $16m (obviously this is a bad proxy for the
| value of a risky business, but it's a starting point).
|
| So the government comes along and says "ok you owe us X%
| of this business per year". Where do you get the money
| for this? You can't just give the government shares. But
| it's a corner bakery...nobody wants to go through the
| headache of buying 1% in a local business. And what
| happens next year when business drops, and the value
| drops, how do you prove to the govt what it's worth? It's
| a minefield, and probably not legal.
|
| I get it. People want to eat the rich. It's easier to
| point to other people as the problem (even if they pay
| 40x more proportionately in tax than someone else)
| instead of saying "Christ, maybe we spend too much". But
| the ideas to kick the can are really getting silly.
| toyg wrote:
| _> where this [...] sentiment of letting people ride
| public transport for free has suddenly come from?_
|
| It has been there since public transport has been a
| thing. Its popularity ebbs and flows with the years,
| because it's fundamentally very appealing: dealing with
| tickets and tariffs is a huge annoyance, and everyone
| resents it for one reason or another. "Surely there is a
| simpler way!"
|
| Alas, ticketing systems seem to be the less-worst thing,
| a bit like representative democracy as a system of
| government. Free-for-all attempts never survive an
| economic or budgetary crisis, and tickets are the closest
| thing to an objective method to raise funds for a
| service. Maybe technology (and politics) will eventually
| evolve enough to develop fairer means-tested systems.
| eertami wrote:
| What do you mean "can't", this is exactly what already
| happens in countries that already implement a wealth tax
| (eg, Switzerland). If you own a corporation that has
| assets worth millions, then the corporation is the asset
| that you're paying wealth taxes on (as part of your
| personal tax return).
|
| Doesn't matter if the company is based abroad either,
| you'll still need to supply the companies balance sheet
| as part of your personal tax return. Last time I checked,
| the Swiss economy (unsurprisingly) has not come crashing
| down.
| qeternity wrote:
| Tax dodging is the national sport of the Swiss. This is a
| horrendous example.
| bdndndndbve wrote:
| Ah yes all those billionaires trying to jump the turnstiles.
| Between that and trying to sleep under bridges they're a
| menace.
| eesmith wrote:
| Rich people get to use the library for free.
|
| Rich people get to visit Hyde Park for free.
|
| I've no problem letting them also ride the bus for free.
| paganel wrote:
| What's the problem with rich people riding the bus for free?
| All bus-riding should be as close to free as possible.
| avianlyric wrote:
| TfL has built most of its fare collection systems in-house,
| indeed it licenses its fare collect technologies to other
| cities like New York. Also it's not within TfLs or London
| Mayors gift to provide free transit, TfL is almost unique in
| that its costs are almost entirely covered by farebox
| collections, and they receive little to zero government
| subsidy.
|
| If London made transit free, they have to find an additional
| PS7 billion a year to cover the operating costs (most of which
| is mundane stuff like keeping the trains working). Total London
| council tax (which is the only form of tax the London mayor can
| control), raises about PS37 billion a year. So making transit
| in the city free would involve increasing council tax by an
| additional ~20%, and council tax is a notoriously regressive
| tax that disproportionately impacts the poor more than anyone
| else.
|
| Additionally TfL is already extremely efficient, it was audited
| by the previous government in an attempt to find further
| ammunition to discredit the London Mayor, but it seems they
| couldn't find any inefficiencies worth publishing. So there
| isn't much wiggle room to reduce TfL operating costs.
|
| Regardless of how you slice it, there isn't a practical way to
| provide free transit in London, and certainly removing the cost
| of the bureaucracy for means testing isn't going to move the
| needle on the simple economic facts.
| kiba wrote:
| Tax cars further. They take up way more space than the
| average pedestrian and required more infrastructure to
| support and maintain.
| avianlyric wrote:
| Even that won't get close. Existing London car taxes only
| raise around PS0.2 billion annually. Not a chance in hell
| you can raise that by 3500% without either public unrest,
| or such a dramatic change in behaviour that tax collection
| amounts drop, instead of raise (although I would personally
| love a car free London).
| rahimnathwani wrote:
| Are you counting fuel duties here, or only road tax?
| fragmede wrote:
| They could also be be referring to London's congestion
| charge, that drivers pay for driving in inner London.
| bigstrat2003 wrote:
| Let's say that happens, which is not at all a given. What
| are you going to do when car usage goes down because people
| are tired of being taxed excessively for them? "Just tax
| this thing I don't like" is not a viable strategy to fund
| the things you do like.
| paganel wrote:
| Take the 7 billion from the existing 37 billion and get rid
| of some existing stuff which is non-housing related.
| jen20 wrote:
| Like what, exactly? Be specific.
| carapace wrote:
| > In Gavin Newsom's book Citizenville he talked about how,
| after becoming [San Francisco] mayor, he discovered that fare
| collection cost as much as the revenue generated from fares. He
| started the process of making the bus free but was told by so
| many advisors that the busses would become "dumpsters on
| wheels," from a combination of homeless people using them for
| shelter and people not respecting services that are free, that
| the plan was scrapped.
|
| ~ https://news.ycombinator.com/item?id=21808851
| KaiserPro wrote:
| YEs, but in london a large part of it's budget come from
| ticket sales.
| LexGray wrote:
| I would guess that technology has already caught up with
| that. Tie it all to a phone app to track abuse and give a
| city services only data plan to anyone who asks. Give it a
| basic three strikes where the driver logs complaints or you
| need a remedial how to properly use city services class.
|
| Given the license tracking already going on for bridge tolls
| the infrastructure may already be there.
| akira2501 wrote:
| > can't stomach a poor person getting to ride the bus for free.
|
| If you don't accurately measure ridership you can't accurately
| serve that ridership. You'll waste money on useless services
| and you'll waste peoples time by not creating necessary
| services.
|
| The system needs to exist.
|
| It probably doesn't need to be outsourced. We're well past the
| internet revolution and it's time for these core competencies
| to be reabsorbed by government departments. Or it's time for
| private companies to be held liable for their complete and
| total failures to serve the public.
|
| Ideally it should just be a system that lets you scan your
| identification card or drivers license. If you're of the
| correct age it should serve as a transportation pass. Simple.
| Compliant. Captures useful data.
| Doctor_Fegg wrote:
| Slightly OT, but really good to see London Centric on the front
| page of HN. Britain's local media has basically collapsed in
| recent years - it's now owned by three conglomerates (Reach,
| Gannett/Newsquest, National World) who are completely
| uninterested in any form of journalism, only in the sort of
| clickbait that would have embarrassed even Buzzfeed in its 2012
| pomp.
|
| The London Evening Standard was one of the last remnants of even
| slightly decent local writing, and that too has now been shut
| down in favour of a weekly lifestyle paper called "The Standard".
| But there's a small number of indie publishers who are trying to
| fill the gap: the Manchester Mill and Liverpool Post, Bristol
| Cable, Oxford Clarion, and so on. London Centric is an attempt by
| an ex-Guardian writer to do the same for London and I hope it
| succeeds.
| jll29 wrote:
| Are people really no longer interested in what happens locally?
|
| I would pay for local news, even about places that I no longer
| live, but used to live and still have a passing interest in.
| But perhaps I would want to receive it as XML feed.
|
| Even events (concerts, readings, exhibitions, screenings etc.)
| are typically scattered across many smaller lists or mailing
| lists, depending on location. For example, there is way more
| going on in London than what is listed by Time Out:
| https://www.timeout.com/london/things-to-do/london-events-in...
| Local communities may have their own sites or still rely on
| paper flyers.
|
| Some facts of communal interest are published in government
| outlets that are still mandatated in some jurisdictions.
|
| It would be wonderful if more of "what's going on" could be
| made available in curated digital form, for us to use and
| enjoy, and also to preserve it for future generations so that
| they can see what was happening in our age.
| fragmede wrote:
| > I would pay for local news
|
| Most of my local papers have moved to a subscription model,
| often with paywalls so I currently pay for local news. Have
| your local papers not?
| refulgentis wrote:
| No
| klelatti wrote:
| Agreed and interesting and good to see it has > 1k paying subs
| (out of 7k total) after a little more than a month - probably
| as a result of some great stories already. A promising start.
| londoncentric wrote:
| Hey, Jim here, author of that article and long term HN reader.
| Never dreamed of seeing one of my pieces on the homepage!
|
| Anyway, I've kinda bet the farm on making proper London
| coverage work, so every subscriber makes a massive difference.
| So please do give it a go, send any London tips you want
| investigating (my personal WhatsApp is on the site), and if you
| hate it... well please tell me why on the way out of the door.
| kergonath wrote:
| I just looked around your website and damn, I wish it was
| around when I was in London. Congratulations on putting that
| together, it's a bold move. I'm not in London anymore so I
| can't really justify a subscription, but I hope you'll be
| successful.
|
| We loved to take the piss but the Evening Standard at least
| existed and London deserves much more quality local
| journalism.
| walrus01 wrote:
| It sure sounds like this "highly sophisticated" attack was a run
| of the mill cryptolocker.
| lbriner wrote:
| I think lots of people who lack the experience have no idea quite
| how large and difficult cybersecurity is for a massive
| organisation whose systems span 20-30+ years or possibly even
| longer. There is no standardised tooling and very little that can
| be retrofitted to older systems. Firewalls are fine if the attack
| is against a port you do not need to use but otherwise you are
| left with a myriad of commercial offerings and a lot of "risk
| analysis".
|
| The one basic tool that does seem lacking, however, is just basic
| network segmentation. I could understand a single system being
| hacked, especially an old system that is massively complex to
| replace but having to shutdown multiple systems including WiFi
| and office networks just smells like lazy "just connect all the
| wires together to make my IT life slightly easier". Having air
| gaps with separate computers, separate networks (even vlans) etc.
| is probably the most cost effective way to reduce your attack
| surface.
| paganel wrote:
| > Hundreds of thousands of Londoners are being overcharged for
| travel, while London Centric spoke to one teenager who is having
| to skip meals because of cashflow issues brought on by the
| cyberattack.
|
| This is just crazy, why not make public transport as cheap as
| peanuts to begin with? Why does everything have to be so damn
| expensive? Why the heck does a monthly transport pass have to
| cost, let me check, around 200 pounds?, what the fricking
| fuck?!?! Why don't the common people in the West rise up against
| this perverted shit? 2400 pounds per year just to have the
| privilege to take the bus/metro?
| HL33tibCe7 wrote:
| I don't live in London, but most people I've talked to who do
| don't have any monthly transport pass or anything like that.
| They just tap in with contactless. The transport is cheap
| enough that if you don't travel many times per day, there is
| really no need. As one example - a bus journey is 1.75 GBP
| regardless of the distance and number of individual buses
| taken, as long as all initial tap-ins are within one hour.
|
| Looking at the TfL website, people on benefits get 50% rate
| discounts; students get 30% off; pensioners and children get
| completely free travel. It's really quite a good system
| actually.
| HL33tibCe7 wrote:
| > Cybersecurity experts claim TfL's software may have not been up
| to scratch, with some public-facing systems coded to be
| compatible with long-defunct browsers such as Internet Explorer
| 6.
|
| This is rubbish, public-facing websites being compatible with
| defunct browsers is not indicative of any security issue
| JSDevOps wrote:
| No but also ...
| https://www.newscientist.com/article/2197453-exclusive-thous...
___________________________________________________________________
(page generated 2024-10-27 23:01 UTC)