This sad news item:

https://www.livescience.com/space/astronomy/hackers-attack-2-of-the-worlds-most-advanced-telescopes-forcing-shutdown

came to my attention.

John Savard

On 31/08/2023 13:49, Quadibloc wrote:
> This sad news item:
>
> https://www.livescience.com/space/astronomy/hackers-attack-2-of-the-worlds-most-advanced-telescopes-forcing-shutdown
>
> came to my attention.

It was ever thus from the moment that some big telescopes had remote
dialup access for filing observing plans over 1200/75 modem links. Once
there is external remote access there will be penetration attempts.

The thing that is unusual in this instance is that the external hackers
got past the honeypots and hacker traps without being detected.

--
Martin Brown

On Thu, 31 Aug 2023 16:55:27 +0100, Martin Brown
<'''newspam'''@nonad.co.uk> wrote:

>On 31/08/2023 13:49, Quadibloc wrote:
>> This sad news item:
>>
>> https://www.livescience.com/space/astronomy/hackers-attack-2-of-the-worlds-most-advanced-telescopes-forcing-shutdown
>>
>> came to my attention.
>
>It was ever thus from the moment that some big telescopes had remote
>dialup access for filing observing plans over 1200/75 modem links. Once
>there is external remote access there will be penetration attempts.
>
>The thing that is unusual in this instance is that the external hackers
>got past the honeypots and hacker traps without being detected.

I would think it should be perfectly possible to create an air gap
between the Internet and the telescope control systems, though.
Hackers could interfere with operations, but not put the hardware at
risk.

Indeed, a standalone command evaluation system (possibly AI-based)
might assess every potentially risky telescope operation before it is
actually passed to instrumentation hardware.

On 31/08/2023 17:05, Chris L Peterson wrote:
> On Thu, 31 Aug 2023 16:55:27 +0100, Martin Brown
> <'''newspam'''@nonad.co.uk> wrote:
>
>> On 31/08/2023 13:49, Quadibloc wrote:
>>> This sad news item:
>>>
>>> https://www.livescience.com/space/astronomy/hackers-attack-2-of-the-worlds-most-advanced-telescopes-forcing-shutdown
>>>
>>> came to my attention.
>>
>> It was ever thus from the moment that some big telescopes had remote
>> dialup access for filing observing plans over 1200/75 modem links. Once
>> there is external remote access there will be penetration attempts.
>>
>> The thing that is unusual in this instance is that the external hackers
>> got past the honeypots and hacker traps without being detected.
>
> I would think it should be perfectly possible to create an air gap
> between the Internet and the telescope control systems, though.
> Hackers could interfere with operations, but not put the hardware at
> risk.

That used to be the case in my day.

The control tapes were prepared on an entirely separate system Dec-10 in
the case of the VLA and then physically moved to the observing control
room to run. The realtime Modcomp telescope control was a very dedicated
computer system isolated completely from the rest of the world.

The AIPS offline data reduction software was another matter though - you
could in principle login remotely to use that on 1200/75 dialup or EPSS.

That is no longer the case today when remote internet observing on some
of these big instruments no longer requires a physical presence on site.

Further back in time (early 60's) there were telescopes that didn't have
a control computer and relied on paper tape based lookup tables to tell
them how to move! MRAO Half Mile Telescope was of that prehistoric sort.

> Indeed, a standalone command evaluation system (possibly AI-based)
> might assess every potentially risky telescope operation before it is
> actually passed to instrumentation hardware.

Most altaz mounted scopes have a sanity check to make sure the observing
programme doesn't go too close to the zenith. Few astrophysicists know
where on the sky their observing targets are actually located. Slew rate
and limits on the anti-twister mechanisms for umbilical cords are also
standard checks in the pre flight simulation of an observing run.

The base planning program makes some effort to minimise slew time and
maximise altitude of the object without going into the danger zone.
However, it was always policy to double check in the run simulation to
avoid breaking expensive hardware with a rogue control programme.

--
Martin Brown

On 01/09/2023 04:31, RichA wrote:
> On Thursday, 31 August 2023 at 08:49:59 UTC-4, Quadibloc wrote:
>> This sad news item:
>>
>> https://www.livescience.com/space/astronomy/hackers-attack-2-of-the-worlds-most-advanced-telescopes-forcing-shutdown
>>
>> came to my attention.
>>
>> John Savard
>
> Notice how hard it is the glean location information (hacker's location) from these stories? I wonder why?

Any half decent hacker will have covered their tracks.

--
Martin Brown

On Fri, 1 Sep 2023 09:22:16 +0100, Martin Brown
<'''newspam'''@nonad.co.uk> wrote:

>On 01/09/2023 04:31, RichA wrote:
>> On Thursday, 31 August 2023 at 08:49:59 UTC-4, Quadibloc wrote:
>>> This sad news item:
>>>
>>> https://www.livescience.com/space/astronomy/hackers-attack-2-of-the-worlds-most-advanced-telescopes-forcing-shutdown
>>>
>>> came to my attention.
>>>
>>> John Savard
>>
>> Notice how hard it is the glean location information (hacker's location) from these stories? I wonder why?
>
>Any half decent hacker will have covered their tracks.

And any half decent investigator will not release that kind of
information while the matter remains under investigation.