It was a week of serious cybersecurity incidents and unimpressive responses. As Melanie Teplinsky reminds us, the U.S. government has been agitated for months about China's apparent strategic decision to hold U.S. infrastructure hostage to cyberattack in a crisis. Now the government has struck back at Volt Typhoon, the Chinese threat actor pursuing that strategy. It claimed recently to have disrupted a Volt Typhoon botnet by taking over a batch of compromised routers. Andrew Adams explains how the court-ordered takeover was managed. It was a lot of work, and there is reason to doubt the effectiveness of the effort. The compromised routers can be re-compromised if they are turned off and on again. And the only ones that were uncompromised by the U.S. seizure are those inside the U.S., leaving open the possibility of DDOS attacks from abroad. Finally, DDOS attacks on our critical infrastructure shouldn't exactly be an existential threat. All things considered, I argue that there's a serious disconnect between the government's hair-on-fire talk about Volt Typhoon and its business-as-usual response.
Speaking of cyberattacks we could be overestimating, Taiwan just had an election that China cared a lot about. According to one detailed report, the Chinese threw a lot of cyber at Taiwanese voters—and failed to make much of an impression. Richard Stiennon and I mix it up over whether the Chinese will do better trying to influence the 2024 outcome here.
While we're covering humdrum responses to cyberattacks, Melanie explains U.S. sanctions on Iranian military hackers for their hack of U.S. water systems that were more or less fish in a barrel.
