Why Cut the Cable?

[ken_sylvania]

https://archive.ph/mT5d3

According to Bloomberg News, T-Mobile's Chief Information Officer claims that after he found out that one of his routers was compromised, he and some others went to the data center where the device was and physically cut the ethernet cable connecting it to the network. He also claims that when they reactivated the device in an isolated environment, the "intruders were gone."

Maybe somebody can help me understand:

Why is a communications router connected to the internet with just a single CAT5 or CAT6 cable? No redundancy? And why not fiber?

What value was there in cutting the cable instead of unplugging it?

Did the guy writing the article really think there were actual intruders inside of the router? He says by the time the router was turned back on the intruders were gone. Does he think they boogied out a backdoor? If he's talking about the access that the "Chinese" hackers had to the device - well, of course they didn't have any connection to it anymore after it was isolated from the internet.

Somehow this is the kind of thing I would expect to read on April 1st.

[JohnH]

Why is a communications router connected to the internet with just a single CAT5 or CAT6 cable? No redundancy? And why not fiber?

Fibre is expensive and has various problems like it's expensive and you can't have tight kinks or bends in it. Most data centres use old fashioned #23 copper wire. A fibre port also costs a lot more than a copper port.

What value was there in cutting the cable instead of unplugging it?

That's a good question. The only explanation I can come up with is cutting it prevented someone from mistakenly plugging it back in.

Did the guy writing the article really think there were actual intruders inside of the router? He says by the time the router was turned back on the intruders were gone. Does he think they boogied out a backdoor? If he's talking about the access that the "Chinese" hackers had to the device - well, of course they didn't have any connection to it anymore after it was isolated from the internet.

Well, sometimes an intruder sets up a permanent presence that would persist on a device even if it were offline for a while. So there would be a risk to plugging it back in - the "intruder" might have effectively left what we can think of as a secret agent behind.

I read a similar article and found it a bit surprising myself. With that said, when I was in a situation where I suspected a machine was compromised, I yanked out the battery as quickly as I could (it had Wi-Fi and no Wi-Fi disable switch so cutting a cord wouldn't help). On my present day Mac, the best I could do is hold down the power button which would actually take several seconds to make it stop...

[R7ehr]

In retrospect, Simon said, they could have turned off the router virtually but sometimes a low-tech security solution is faster and more certain.

“There’s nothing that replaces cutting the cord,” he said.