5 ms·

It really boggles my mind that we don't air-gap every single one of these types of critical systems. Can someone help me understand why this isn't more popular

It really boggles my mind that we don't air-gap every single one of these types of critical systems. Can someone help me understand why this isn't more popular? Is it because they requirement controls from outside resources? Or maybe there's central places that rely on telemetry? Another option: outgoing UDP packets only. Outgoing telemetry but nothing comes back in.

nickpsecurity 11y ago
Management wants it done, done cheaply, with cheap support, and sometimes plugging into their dashboards. Clive Robinson, who did SCADA, said those things combine to make security nonexistent to afterthought in most installations. I'll add a lesson from software world that it also pays to contract steady fixes over time instead of near-perfect the first time. That might partly be because people in such industries only make sacrifices after shit hits the fan publicly. See Target for example. ;)
- akira2501 11y ago
  Of course.. you /expect/ that to happen, which is why you establish an internal auditing process.
cpeterso 11y ago
In related news this week: http://www.nytimes.com/2016/03/26/nyregion/rye-brook-dam-caught-in-computer-hacking-case.html http://www.nytimes.com/2016/03/26/nyregion/rye-brook-dam-cau... "The Bowman Avenue Dam in this low-key suburban village in Westchester County is … about the width of a modest living room, and the 20-foot-tall dam itself essentially keeps a babbling creek, the Blind Brook, from flooding basements and ground floors in houses downstream. Yet, according to the authorities, it was the computer-guided controls of this dam that seven Iranian computer hackers chose to penetrate on behalf of that country’s Revolutionary Guards Corps, as part of a plot that also breached or paralyzed 46 of the nation’s largest financial institutions and blocked hundreds of thousands of customers from accessing their bank accounts online.
- 13thLetter 11y ago
  It's weird how the news that agents of a foreign government were attempting to sabotage American infrastructure, which is -- I realize this is an antiquated notion nowadays -- an act of war, is received with shrugs and yawns and no real action. Imagine the screaming worldwide if hackers working for the CIA were breaking into Iranian dams and financial institutions.
  - cperciva 11y ago
    Imagine the screaming worldwide if hackers working for the CIA were breaking into Iranian dams and financial institutions. They broke into the Iranian nuclear program without much condemnation, so...
    - 13thLetter 11y ago
      I recall a lot of wailing about how irresponsible they were deploying their sinister infrastructure-damaging war viruses, and such. But thinking about it more, I'll grant it depends on your perspective of the whole issue, so my point doesn't really stand. I still find it dismaying that we so casually accept this state of affairs. There is no meaningful difference between attacks like this and a foreign agent setting fire to the bank building or physically sabotaging the dam.
      - cperciva 11y ago
        There was some wailing from the computer security community, but nothing in the world of international diplomacy. And I'm sure that's why the USA isn't kicking up a fuss over this latest incident -- they want to avoid setting a precedent which would come back to haunt them the next time they're caught doing the same thing.
  - lordchair 11y ago
    The US's cyber attacks on foreign countries are certainly the most funded and advanced campaigns of their kind. For reference here are the wikipedia pages of two of the most public pieces of malware your tax dollars have produced: https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Flame_(malware) https://en.wikipedia.org/wiki/Flame_(malware) Both of these were directed primarily at Iran. And that second one, flame, has been described as "the most complex malware ever found."
achillean 11y ago
This is a long-standing issue that a lot of people are aware of but fixing it is difficult. I've written and presented on the topic a few times, see: https://blog.shodan.io/state-of-control-systems-in-the-usa-2015-05/ https://blog.shodan.io/state-of-control-systems-in-the-usa-2...
rsync 11y ago
"It really boggles my mind that we don't air-gap every single one of these types of critical systems." I would go even further. To air-gap something implies that you are breaking the physical link that it could interact on the network with. I would suggest that these systems should not have networking capabilities at all. The controllers for a dam, or power plant, or (insert critical infrastructure here) should not have networking hardware or even a networking stack.
- thaumasiotes 11y ago
  This implies that if you want to open or shut part of your dam, some guy with muscles has to go out and physically move the relevant parts. It won't work at all for heavy things, or things in inaccessible locations (dams are both of these, actually). If you want someone to be able to adjust the dam, without putting out the physical effort required to make the adjustment, you need to network the dam. That way, the person can send a signal (easy) and a machine that's able to do the work can receive the signal and do the work (hard). The most you can do is ensure that signals from the internet (or anywhere offsite) can't reach the dam. You need onsite signals.
  - deleted 11y ago
    [deleted]
  - gizmo686 11y ago
    There is still a question of how complex the network is. One could argue that an IP based network stack is unnecessarily complex, and we should use a simpler system to improve reliability and security. In concept, the "network" could be nothing more than dumb wires connected to DIO and PWM ports.
    - thaumasiotes 11y ago
      Oh, agreed.
  - rsync 11y ago
    "This implies that if you want to open or shut part of your dam, some guy with muscles has to go out and physically move the relevant parts. It won't work at all for heavy things, or things in inaccessible locations (dams are both of these, actually)." Yes, that is exactly what it implies. This brings with it two very important and extremely valuable effects: First, it means there is a human observing, on a regular basis, the behavior of the system - someone "has a feel" for how things work and can (with the intellect and perception of a human brain) "sense" when something is not right. Second, it means, in the Taleb sense, that someone has "skin in the game". In the same way that I would be very disturbed if a commercial airliner had remote pilots, I would be similarly disturbed if a dam or a power plant had remote operators. Finally, this human, locally present operator or operators probably shouldn't have Internet access - even on personal devices. There's no reason for it and it only adds risk and attack vectors. If you run the nuclear plant you can check twitter when you get home.
WaylonKenning 11y ago
I've worked in utilities before, and sometimes it's not possible to airgap those systems. After all, someone needs to login and update and performance maintenance on those SCADA systems. And it's pretty expensive to fly those people in, and sometimes not possible. But there are optical routers that guarantee one way only access to networks. My favorite method is a switch, with the power supply connected to a physical timer. Once the time's up, the power supply is cut, and that device no longer is accessible. Quite ingenious really.
- LoSboccacc 11y ago
  Wouldn't a signed update disk be cheaper to fly?

nickpsecurity 11y ago

Management wants it done, done cheaply, with cheap support, and sometimes plugging into their dashboards. Clive Robinson, who did SCADA, said those things combine to make security nonexistent to afterthought in most installations. I'll add a lesson from software world that it also pays to contract steady fixes over time instead of near-perfect the first time. That might partly be because people in such industries only make sacrifices after shit hits the fan publicly. See Target for example. ;)

akira2501 11y ago
Of course.. you /expect/ that to happen, which is why you establish an internal auditing process.

cpeterso 11y ago

In related news this week: http://www.nytimes.com/2016/03/26/nyregion/rye-brook-dam-caught-in-computer-hacking-case.html http://www.nytimes.com/2016/03/26/nyregion/rye-brook-dam-cau... "The Bowman Avenue Dam in this low-key suburban village in Westchester County is … about the width of a modest living room, and the 20-foot-tall dam itself essentially keeps a babbling creek, the Blind Brook, from flooding basements and ground floors in houses downstream. Yet, according to the authorities, it was the computer-guided controls of this dam that seven Iranian computer hackers chose to penetrate on behalf of that country’s Revolutionary Guards Corps, as part of a plot that also breached or paralyzed 46 of the nation’s largest financial institutions and blocked hundreds of thousands of customers from accessing their bank accounts online.

13thLetter 11y ago
It's weird how the news that agents of a foreign government were attempting to sabotage American infrastructure, which is -- I realize this is an antiquated notion nowadays -- an act of war, is received with shrugs and yawns and no real action. Imagine the screaming worldwide if hackers working for the CIA were breaking into Iranian dams and financial institutions.
- cperciva 11y ago
  Imagine the screaming worldwide if hackers working for the CIA were breaking into Iranian dams and financial institutions. They broke into the Iranian nuclear program without much condemnation, so...
  - 13thLetter 11y ago
    I recall a lot of wailing about how irresponsible they were deploying their sinister infrastructure-damaging war viruses, and such. But thinking about it more, I'll grant it depends on your perspective of the whole issue, so my point doesn't really stand. I still find it dismaying that we so casually accept this state of affairs. There is no meaningful difference between attacks like this and a foreign agent setting fire to the bank building or physically sabotaging the dam.
    - cperciva 11y ago
      There was some wailing from the computer security community, but nothing in the world of international diplomacy. And I'm sure that's why the USA isn't kicking up a fuss over this latest incident -- they want to avoid setting a precedent which would come back to haunt them the next time they're caught doing the same thing.
- lordchair 11y ago
  The US's cyber attacks on foreign countries are certainly the most funded and advanced campaigns of their kind. For reference here are the wikipedia pages of two of the most public pieces of malware your tax dollars have produced: https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Flame_(malware) https://en.wikipedia.org/wiki/Flame_(malware) Both of these were directed primarily at Iran. And that second one, flame, has been described as "the most complex malware ever found."

achillean 11y ago

This is a long-standing issue that a lot of people are aware of but fixing it is difficult. I've written and presented on the topic a few times, see: https://blog.shodan.io/state-of-control-systems-in-the-usa-2015-05/ https://blog.shodan.io/state-of-control-systems-in-the-usa-2...

rsync 11y ago

"It really boggles my mind that we don't air-gap every single one of these types of critical systems." I would go even further. To air-gap something implies that you are breaking the physical link that it could interact on the network with. I would suggest that these systems should not have networking capabilities at all. The controllers for a dam, or power plant, or (insert critical infrastructure here) should not have networking hardware or even a networking stack.

thaumasiotes 11y ago
This implies that if you want to open or shut part of your dam, some guy with muscles has to go out and physically move the relevant parts. It won't work at all for heavy things, or things in inaccessible locations (dams are both of these, actually). If you want someone to be able to adjust the dam, without putting out the physical effort required to make the adjustment, you need to network the dam. That way, the person can send a signal (easy) and a machine that's able to do the work can receive the signal and do the work (hard). The most you can do is ensure that signals from the internet (or anywhere offsite) can't reach the dam. You need onsite signals.
- deleted 11y ago
  [deleted]
- gizmo686 11y ago
  There is still a question of how complex the network is. One could argue that an IP based network stack is unnecessarily complex, and we should use a simpler system to improve reliability and security. In concept, the "network" could be nothing more than dumb wires connected to DIO and PWM ports.
  - thaumasiotes 11y ago
    Oh, agreed.
- rsync 11y ago
  "This implies that if you want to open or shut part of your dam, some guy with muscles has to go out and physically move the relevant parts. It won't work at all for heavy things, or things in inaccessible locations (dams are both of these, actually)." Yes, that is exactly what it implies. This brings with it two very important and extremely valuable effects: First, it means there is a human observing, on a regular basis, the behavior of the system - someone "has a feel" for how things work and can (with the intellect and perception of a human brain) "sense" when something is not right. Second, it means, in the Taleb sense, that someone has "skin in the game". In the same way that I would be very disturbed if a commercial airliner had remote pilots, I would be similarly disturbed if a dam or a power plant had remote operators. Finally, this human, locally present operator or operators probably shouldn't have Internet access - even on personal devices. There's no reason for it and it only adds risk and attack vectors. If you run the nuclear plant you can check twitter when you get home.

WaylonKenning 11y ago

I've worked in utilities before, and sometimes it's not possible to airgap those systems. After all, someone needs to login and update and performance maintenance on those SCADA systems. And it's pretty expensive to fly those people in, and sometimes not possible. But there are optical routers that guarantee one way only access to networks. My favorite method is a switch, with the power supply connected to a physical timer. Once the time's up, the power supply is cut, and that device no longer is accessible. Quite ingenious really.

LoSboccacc 11y ago
Wouldn't a signed update disk be cheaper to fly?