[HN Gopher] Inside the Transport for London cyberattack
       ___________________________________________________________________
        
       Inside the Transport for London cyberattack
        
       Author : alexbilbie
       Score  : 90 points
       Date   : 2024-10-27 17:24 UTC (5 hours ago)
        
 (HTM) web link (www.londoncentric.media)
 (TXT) w3m dump (www.londoncentric.media)
        
       | com wrote:
       | Lots of people who should have been establishing effective
       | security practices and monitoring and improving it were doing ...
       | something ... but not that.
       | 
       | Total failure of management and governance at TfL and the British
       | Library (which even had a "private sector security leader" on its
       | board of governors for a decade or more before their total
       | shitshow of a breach last year)
       | 
       | But as usual, there will be no consequences.
        
         | chrisjj wrote:
         | > no consequences.
         | 
         | I recommend "repercussions" ;)
        
         | jen20 wrote:
         | TFL are better than most public bodies but are likely hamstrung
         | on being able to pay anything like market rates for competent
         | security people.
        
           | com wrote:
           | Totally get it that budgets are tight. But making sure that
           | stuff happens isn't highly correlated to tech staff or
           | manager salaries.
           | 
           | Unless they're hiring inexperienced high-schoolers, it's a
           | failure of will and competence in management. And even that
           | would actually be a failure of managrnent.
           | 
           | I'm guessing - based on historic contacts with TfL - that
           | this failure of management is probably manifest in too many
           | meetings and intermediate products valorised over and above
           | culture, knowledge and tech improvements.
           | 
           | Avoidance of outcome-based monitoring and governance, and
           | instead a focus on "process execution" like reorgs,
           | agonisingly-slow checkbox actions and deckchair relocations
           | is pretty common in low-ambition, low-performance orgs.
           | Again, you don't get this because you're being cheap on
           | security people.
        
       | lol768 wrote:
       | > Earlier this month Andy Lord, the boss of Transport for London,
       | sat down at a scheduled board meeting and praised his
       | organisation's response to a "highly sophisticated" cyberattack,
       | which began with reports of "suspicious activity" on Sunday 1st
       | September.
       | 
       | > "The vast majority of Londoners would not know this attack has
       | happened," the TfL commissioner told board members including
       | mayor Sadiq Khan. Lord later added: "Because it's been so well-
       | managed people didn't understand the scale and impact."
       | 
       | Are these people completely delusional? They've taken away
       | passenger's visibility to see what they were being charged for;
       | they killed all of the open data feeds (though a few of these
       | have _just_ now been restored in the last couple of days). Back
       | in September, they disrupted all of their staff 's productivity
       | by locking everybody out and forcing them to try and do their
       | jobs without any access to technology. And.. there's still no end
       | in sight for a restore of the contactless portal.
       | 
       | The way they've managed the incident and the collateral damage
       | suggests there were not nearly enough security controls present
       | in the first place (in terms of containing the breach). How many
       | weeks on are we now without service restoration? For a
       | cyberattack perpetrated by one seventeen year old?
       | 
       | If it was an SME who didn't do anything technical and had been
       | caught completely unprepared, I might be more understanding.
        
         | avianlyric wrote:
         | I can believe, I live in London and depend on TfL all the time.
         | It's last 10 or so years, I've probably only bothered looking
         | up my travel data a dozen or so times. 99% of the time I'm
         | charged the right amount, and I don't have to think about it.
        
       | bastard_op wrote:
       | As soon as you read "outsourced their IT", one can always assume
       | the aftermath would be a shitshow, as it is always done in
       | response to the previous team not being able to run it, which
       | means it is a goddamn mess. Having worked enough state and city
       | government IT contracts in the past 25 years, you just assume the
       | worst about everything and are often not disappointed. It's not a
       | matter of if but when they'll be owned really, and most really
       | wouldn't know what to do if they were still today.
       | 
       | This is your relative tax dollars hard at work.
        
         | avianlyric wrote:
         | Where does it say they outsourced their IT? The article
         | mentions city hall outsourcing their IT to TfL, but city hall
         | is sister organisation to TfL, they're both organs of London
         | regional government. The London Mayor is the chairman of TfL
         | and the head of London regional government.
         | 
         | It's not like they're outsourcing to some private organisation,
         | every single organisation is either a state organisation, or a
         | state owned company.
        
           | Groxx wrote:
           | I think they just read it backwards. Near the beginning in
           | the bulleted list is:
           | 
           | > _Sadiq Khan's office and the Greater London Authority
           | outsourced their IT services to TfL this summer, meaning they
           | were also badly impacted, paralysing services at the top of
           | the capital's devolved government._
           | 
           | Which means TfL is the one doing other people's IT in
           | addition to its own, not the reverse.
        
         | mellosouls wrote:
         | _always done in response to the previous team not being able to
         | run it, which means it is a goddamn mess.
         | 
         | :
         | 
         | This is your relative tax dollars hard at work._
         | 
         | I think you are underestimating the gross lack of realistic
         | investment and corresponding demoralization and qualitative
         | decline in some public services; which latter is then used by
         | the decision-makers who've created the situation as
         | justification for swashbuckling "transformation" projects -
         | advised by and given to overpriced consultants - they can put
         | on their CVs before hopping to the next gig.
         | 
         |  _That 's_ your tax dollars at work.
        
         | aiiotnoodle wrote:
         | I agree. Public sector IT becomes a huge sprawl of technologies
         | and cottage industry applications which makes administering
         | these often rarely touched interfaces difficult to do properly
         | when department budgets are tight and resources are busy fire
         | fighting the processes that failed the night before.
         | 
         | It is also difficult to hire because wages are generally low
         | compared to similar roles in private industry, yet they need
         | skilled staff to manage these complex environments. A lot of
         | services don't get the attention they need, not just patching
         | and upgrades but development, requirements capture and
         | usability all kept to a minimum cost to keep the sinking ship
         | afloat.
         | 
         | All these constraints also lean to a culture of poor security,
         | JFDI, rip and replace, insufficent hardware etc... just so the
         | business can operate on whatever computer on wheels in the
         | shipping depot or relatively expensive to replace electronic
         | gate system with intergration to their custom fleet management
         | software.
         | 
         | Government outsourcing to another related body has its cost
         | advantages but the many domain administrator users, the huge
         | flat VmWare estate and the hardware well beyond warranty
         | doesn't dissapear.
         | 
         | Designed to serve immediate needs but without long-term
         | maintenance or holistic design in mind. Outsourcing amplifies
         | the issue.
        
       | manojlds wrote:
       | Why is the Mayor not even talking about this?
        
         | avianlyric wrote:
         | What is there for the Mayor to say? The trains still run, the
         | busses still turn up, the traffic lights still go red, yellow,
         | green.
         | 
         | For the vast majority of people, there little to no impact day-
         | to-day. Sure the loss of live data is annoying, but trains
         | still turn up every 2 mins, and busses every 5-10mins during
         | the day. Even at night, busses still turn up every 15-20mins,
         | so checking live data doesn't give you that much of an edge.
        
         | surfingdino wrote:
         | Because there is no political gain for him in this story.
        
       | bdndndndbve wrote:
       | It's amazing how much bureaucracy they're willing to spend money
       | on to means-test a fundamental service. If you just made transit
       | free at the point of service you wouldn't have free cards for all
       | under 16, and some over 16, and all over 60, and discount fares
       | for people in poverty. Cities spend so much money outsourcing the
       | IT for fare collection, and the administration of budget
       | programs, and ultimately the experience is worse for the end
       | users. It's a real case of the politically connected hoovering up
       | tens of millions of dollars because suburban voters can't stomach
       | a poor person getting to ride the bus for free.
        
         | cdot2 wrote:
         | All of this IT infrastructure exists to ensure the exact
         | opposite of what you said. It ensures that rich people don't
         | get to ride the bus for free.
        
           | whiplash451 wrote:
           | Not the opposite, but the complementary, to be precise.
        
           | truckerbill wrote:
           | The point is it's easier to just tax wealth a bit more and
           | let everyone get on the bloody train... It's mostly people
           | just going to work/school, makes sense to be free
        
             | KaiserPro wrote:
             | > easier to just tax wealth a bit more and let everyone get
             | on the bloody train
             | 
             | I mean its not. If it was, they would have done it.
             | 
             | Wealth taxes are really fucking hard to do equitably, at
             | least at first.
             | 
             | For example OAPs tend to live in very expensive hosues.
             | take rotherhithe for example one could have bought a house
             | in the 90s for shit all, and now its worth the best part of
             | 1.4 million.
             | 
             | so now you're levying a 5% tax on a pensioner, or worse
             | still a young couple mortgaged to the fucker.
             | 
             | Now, but what about the super asset rich I hear you say?
             | 
             | Well, they'll transfer all they own into a corporation.
             | They can't tax assets like that on business because it'll
             | crash the economy super quick.
        
               | bdndndndbve wrote:
               | We need a housing policy reset, the OAPs shouldn't have
               | the majority of their retirement assets tied up in a 1.4M
               | illiquid house. They need an affordable off-ramp to
               | downsize, and we need to build more affordable housing to
               | deflate the market. This is wildly unpopular because lots
               | of people are already over-leveraged trying to get onto
               | the property ladder, but objectively it's the correct
               | course to start to unfuck things.
               | 
               | The purpose of a house or apartment should be shelter for
               | a family, not a retirement plan or an investment for a
               | corporation.
        
               | ghusto wrote:
               | Okay Mao.
        
               | fragmede wrote:
               | > This is wildly unpopular.
               | 
               | Case in point. No one's suggesting confiscating anything,
               | yet some people can't contain themselves at the
               | suggestion that maybe housing policy is broken.
        
               | KaiserPro wrote:
               | > more affordable housing to deflate the market
               | 
               | hard yes
               | 
               | > affordable off-ramp to downsize,
               | 
               | I mean yes, but the hidden cost is moving outside of your
               | support network. Downsizing is often very lucrative.
        
               | ghusto wrote:
               | > Well, they'll transfer all they own into a corporation.
               | They can't tax assets like that on business because it'll
               | crash the economy super quick
               | 
               | Thanks for that. I've always thought that wealth isn't
               | taxed heavily because it's the wealthy that make the
               | laws. That still may be part of it, but this surely is
               | too.
               | 
               | As a side note, I'm puzzled as to where this seemingly
               | prevalent (here, at least) sentiment of letting people
               | ride public transport for free has suddenly come from? It
               | makes absolutely no sense, but is being said as if it's
               | the most obvious thing in the world!
        
               | qeternity wrote:
               | Wealth isn't taxed because most wealth, unlike income or
               | other use taxes, are based on valuations that are
               | extremely fragile.
               | 
               | Let's say you open a corner bakery that does very well.
               | You are making $1m/year and paying the government
               | $200k/yr in corporation taxes. That leaves $800k/yr in
               | the biz. A perpetuity paying $800k/yr at 5% discount rate
               | is worth $16m (obviously this is a bad proxy for the
               | value of a risky business, but it's a starting point).
               | 
               | So the government comes along and says "ok you owe us X%
               | of this business per year". Where do you get the money
               | for this? You can't just give the government shares. But
               | it's a corner bakery...nobody wants to go through the
               | headache of buying 1% in a local business. And what
               | happens next year when business drops, and the value
               | drops, how do you prove to the govt what it's worth? It's
               | a minefield, and probably not legal.
               | 
               | I get it. People want to eat the rich. It's easier to
               | point to other people as the problem (even if they pay
               | 40x more proportionately in tax than someone else)
               | instead of saying "Christ, maybe we spend too much". But
               | the ideas to kick the can are really getting silly.
        
               | toyg wrote:
               | _> where this [...] sentiment of letting people ride
               | public transport for free has suddenly come from?_
               | 
               | It has been there since public transport has been a
               | thing. Its popularity ebbs and flows with the years,
               | because it's fundamentally very appealing: dealing with
               | tickets and tariffs is a huge annoyance, and everyone
               | resents it for one reason or another. "Surely there is a
               | simpler way!"
               | 
               | Alas, ticketing systems seem to be the less-worst thing,
               | a bit like representative democracy as a system of
               | government. Free-for-all attempts never survive an
               | economic or budgetary crisis, and tickets are the closest
               | thing to an objective method to raise funds for a
               | service. Maybe technology (and politics) will eventually
               | evolve enough to develop fairer means-tested systems.
        
               | eertami wrote:
               | What do you mean "can't", this is exactly what already
               | happens in countries that already implement a wealth tax
               | (eg, Switzerland). If you own a corporation that has
               | assets worth millions, then the corporation is the asset
               | that you're paying wealth taxes on (as part of your
               | personal tax return).
               | 
               | Doesn't matter if the company is based abroad either,
               | you'll still need to supply the companies balance sheet
               | as part of your personal tax return. Last time I checked,
               | the Swiss economy (unsurprisingly) has not come crashing
               | down.
        
               | qeternity wrote:
               | Tax dodging is the national sport of the Swiss. This is a
               | horrendous example.
        
           | bdndndndbve wrote:
           | Ah yes all those billionaires trying to jump the turnstiles.
           | Between that and trying to sleep under bridges they're a
           | menace.
        
           | eesmith wrote:
           | Rich people get to use the library for free.
           | 
           | Rich people get to visit Hyde Park for free.
           | 
           | I've no problem letting them also ride the bus for free.
        
           | paganel wrote:
           | What's the problem with rich people riding the bus for free?
           | All bus-riding should be as close to free as possible.
        
         | avianlyric wrote:
         | TfL has built most of its fare collection systems in-house,
         | indeed it licenses its fare collect technologies to other
         | cities like New York. Also it's not within TfLs or London
         | Mayors gift to provide free transit, TfL is almost unique in
         | that its costs are almost entirely covered by farebox
         | collections, and they receive little to zero government
         | subsidy.
         | 
         | If London made transit free, they have to find an additional
         | PS7 billion a year to cover the operating costs (most of which
         | is mundane stuff like keeping the trains working). Total London
         | council tax (which is the only form of tax the London mayor can
         | control), raises about PS37 billion a year. So making transit
         | in the city free would involve increasing council tax by an
         | additional ~20%, and council tax is a notoriously regressive
         | tax that disproportionately impacts the poor more than anyone
         | else.
         | 
         | Additionally TfL is already extremely efficient, it was audited
         | by the previous government in an attempt to find further
         | ammunition to discredit the London Mayor, but it seems they
         | couldn't find any inefficiencies worth publishing. So there
         | isn't much wiggle room to reduce TfL operating costs.
         | 
         | Regardless of how you slice it, there isn't a practical way to
         | provide free transit in London, and certainly removing the cost
         | of the bureaucracy for means testing isn't going to move the
         | needle on the simple economic facts.
        
           | kiba wrote:
           | Tax cars further. They take up way more space than the
           | average pedestrian and required more infrastructure to
           | support and maintain.
        
             | avianlyric wrote:
             | Even that won't get close. Existing London car taxes only
             | raise around PS0.2 billion annually. Not a chance in hell
             | you can raise that by 3500% without either public unrest,
             | or such a dramatic change in behaviour that tax collection
             | amounts drop, instead of raise (although I would personally
             | love a car free London).
        
               | rahimnathwani wrote:
               | Are you counting fuel duties here, or only road tax?
        
               | fragmede wrote:
               | They could also be be referring to London's congestion
               | charge, that drivers pay for driving in inner London.
        
             | bigstrat2003 wrote:
             | Let's say that happens, which is not at all a given. What
             | are you going to do when car usage goes down because people
             | are tired of being taxed excessively for them? "Just tax
             | this thing I don't like" is not a viable strategy to fund
             | the things you do like.
        
           | paganel wrote:
           | Take the 7 billion from the existing 37 billion and get rid
           | of some existing stuff which is non-housing related.
        
             | jen20 wrote:
             | Like what, exactly? Be specific.
        
         | carapace wrote:
         | > In Gavin Newsom's book Citizenville he talked about how,
         | after becoming [San Francisco] mayor, he discovered that fare
         | collection cost as much as the revenue generated from fares. He
         | started the process of making the bus free but was told by so
         | many advisors that the busses would become "dumpsters on
         | wheels," from a combination of homeless people using them for
         | shelter and people not respecting services that are free, that
         | the plan was scrapped.
         | 
         | ~ https://news.ycombinator.com/item?id=21808851
        
           | KaiserPro wrote:
           | YEs, but in london a large part of it's budget come from
           | ticket sales.
        
           | LexGray wrote:
           | I would guess that technology has already caught up with
           | that. Tie it all to a phone app to track abuse and give a
           | city services only data plan to anyone who asks. Give it a
           | basic three strikes where the driver logs complaints or you
           | need a remedial how to properly use city services class.
           | 
           | Given the license tracking already going on for bridge tolls
           | the infrastructure may already be there.
        
         | akira2501 wrote:
         | > can't stomach a poor person getting to ride the bus for free.
         | 
         | If you don't accurately measure ridership you can't accurately
         | serve that ridership. You'll waste money on useless services
         | and you'll waste peoples time by not creating necessary
         | services.
         | 
         | The system needs to exist.
         | 
         | It probably doesn't need to be outsourced. We're well past the
         | internet revolution and it's time for these core competencies
         | to be reabsorbed by government departments. Or it's time for
         | private companies to be held liable for their complete and
         | total failures to serve the public.
         | 
         | Ideally it should just be a system that lets you scan your
         | identification card or drivers license. If you're of the
         | correct age it should serve as a transportation pass. Simple.
         | Compliant. Captures useful data.
        
       | Doctor_Fegg wrote:
       | Slightly OT, but really good to see London Centric on the front
       | page of HN. Britain's local media has basically collapsed in
       | recent years - it's now owned by three conglomerates (Reach,
       | Gannett/Newsquest, National World) who are completely
       | uninterested in any form of journalism, only in the sort of
       | clickbait that would have embarrassed even Buzzfeed in its 2012
       | pomp.
       | 
       | The London Evening Standard was one of the last remnants of even
       | slightly decent local writing, and that too has now been shut
       | down in favour of a weekly lifestyle paper called "The Standard".
       | But there's a small number of indie publishers who are trying to
       | fill the gap: the Manchester Mill and Liverpool Post, Bristol
       | Cable, Oxford Clarion, and so on. London Centric is an attempt by
       | an ex-Guardian writer to do the same for London and I hope it
       | succeeds.
        
         | jll29 wrote:
         | Are people really no longer interested in what happens locally?
         | 
         | I would pay for local news, even about places that I no longer
         | live, but used to live and still have a passing interest in.
         | But perhaps I would want to receive it as XML feed.
         | 
         | Even events (concerts, readings, exhibitions, screenings etc.)
         | are typically scattered across many smaller lists or mailing
         | lists, depending on location. For example, there is way more
         | going on in London than what is listed by Time Out:
         | https://www.timeout.com/london/things-to-do/london-events-in...
         | Local communities may have their own sites or still rely on
         | paper flyers.
         | 
         | Some facts of communal interest are published in government
         | outlets that are still mandatated in some jurisdictions.
         | 
         | It would be wonderful if more of "what's going on" could be
         | made available in curated digital form, for us to use and
         | enjoy, and also to preserve it for future generations so that
         | they can see what was happening in our age.
        
           | fragmede wrote:
           | > I would pay for local news
           | 
           | Most of my local papers have moved to a subscription model,
           | often with paywalls so I currently pay for local news. Have
           | your local papers not?
        
           | refulgentis wrote:
           | No
        
         | klelatti wrote:
         | Agreed and interesting and good to see it has > 1k paying subs
         | (out of 7k total) after a little more than a month - probably
         | as a result of some great stories already. A promising start.
        
         | londoncentric wrote:
         | Hey, Jim here, author of that article and long term HN reader.
         | Never dreamed of seeing one of my pieces on the homepage!
         | 
         | Anyway, I've kinda bet the farm on making proper London
         | coverage work, so every subscriber makes a massive difference.
         | So please do give it a go, send any London tips you want
         | investigating (my personal WhatsApp is on the site), and if you
         | hate it... well please tell me why on the way out of the door.
        
           | kergonath wrote:
           | I just looked around your website and damn, I wish it was
           | around when I was in London. Congratulations on putting that
           | together, it's a bold move. I'm not in London anymore so I
           | can't really justify a subscription, but I hope you'll be
           | successful.
           | 
           | We loved to take the piss but the Evening Standard at least
           | existed and London deserves much more quality local
           | journalism.
        
       | walrus01 wrote:
       | It sure sounds like this "highly sophisticated" attack was a run
       | of the mill cryptolocker.
        
       | lbriner wrote:
       | I think lots of people who lack the experience have no idea quite
       | how large and difficult cybersecurity is for a massive
       | organisation whose systems span 20-30+ years or possibly even
       | longer. There is no standardised tooling and very little that can
       | be retrofitted to older systems. Firewalls are fine if the attack
       | is against a port you do not need to use but otherwise you are
       | left with a myriad of commercial offerings and a lot of "risk
       | analysis".
       | 
       | The one basic tool that does seem lacking, however, is just basic
       | network segmentation. I could understand a single system being
       | hacked, especially an old system that is massively complex to
       | replace but having to shutdown multiple systems including WiFi
       | and office networks just smells like lazy "just connect all the
       | wires together to make my IT life slightly easier". Having air
       | gaps with separate computers, separate networks (even vlans) etc.
       | is probably the most cost effective way to reduce your attack
       | surface.
        
       | paganel wrote:
       | > Hundreds of thousands of Londoners are being overcharged for
       | travel, while London Centric spoke to one teenager who is having
       | to skip meals because of cashflow issues brought on by the
       | cyberattack.
       | 
       | This is just crazy, why not make public transport as cheap as
       | peanuts to begin with? Why does everything have to be so damn
       | expensive? Why the heck does a monthly transport pass have to
       | cost, let me check, around 200 pounds?, what the fricking
       | fuck?!?! Why don't the common people in the West rise up against
       | this perverted shit? 2400 pounds per year just to have the
       | privilege to take the bus/metro?
        
         | HL33tibCe7 wrote:
         | I don't live in London, but most people I've talked to who do
         | don't have any monthly transport pass or anything like that.
         | They just tap in with contactless. The transport is cheap
         | enough that if you don't travel many times per day, there is
         | really no need. As one example - a bus journey is 1.75 GBP
         | regardless of the distance and number of individual buses
         | taken, as long as all initial tap-ins are within one hour.
         | 
         | Looking at the TfL website, people on benefits get 50% rate
         | discounts; students get 30% off; pensioners and children get
         | completely free travel. It's really quite a good system
         | actually.
        
       | HL33tibCe7 wrote:
       | > Cybersecurity experts claim TfL's software may have not been up
       | to scratch, with some public-facing systems coded to be
       | compatible with long-defunct browsers such as Internet Explorer
       | 6.
       | 
       | This is rubbish, public-facing websites being compatible with
       | defunct browsers is not indicative of any security issue
        
         | JSDevOps wrote:
         | No but also ...
         | https://www.newscientist.com/article/2197453-exclusive-thous...
        
       ___________________________________________________________________
       (page generated 2024-10-27 23:01 UTC)