6 ms·

So... what does this mean? I mean, if there are so many hydropower plans et al vulnerable for VNC, how come we didn't have some major catastrophe? Is it simply

So... what does this mean? I mean, if there are so many hydropower plans et al vulnerable for VNC, how come we didn't have some major catastrophe? Is it simply more common to have a "read only" VNC vulnerability? (which is still a huge problem). Is VNC by default not password protected for read only viewing (and requires password for taking control?) Obviously nothing should be password-less by default, and should not have a "changeit" password (I'm looking at you glassfish) but I really hope that even if VNC lets you be in "guest view only mode" without a password by just knowing an IP (who does that?!) then at least I hope they still require a password to also take control, right? please tell me they do. (otherwise I'll be surprised we are all still alive to be honest) I mean there are some controls there that I'm sure if the wrong person pushes that red button, something will go kaboom. And there is no shortage of people out there who would not think twice to blow things up. So yes, this is scary, but also makes me be very surprised that statistically we are probably not supposed to be alive by now if so many critical control systems have VNC exposed like that in a way that allows full control on the system and not just viewing. Perhaps it's just selection bias, if the world have ended by now then I would be able to type this. But still seriously, with all these screenshots, I assume this is not something new, so how come I didn't hear yet on a major real world damage due to a VNC vulnerability? Is this really most likely to be a read only privacy issue? (which is not to be taken lightly, but not the same as being able to press "shutdown" on some power plant controls)

Pxtl 11y ago
I didn't even know read-only vnc was a thing, and I feel a lot less mortified about the various control panels with instrument status we're seeing. I dont give a crap if the wider Internet can see the temperature of the walk-in fridge at the lab.
- chippy 11y ago
  some are read only, some are full control access but the local user has to authorise, and some are full control with password.
TazeTSchnitzel 11y ago
I guess it's just luck that no mischief-maker has gone and tried to do as much damage as possible.
jcrawfordor 11y ago
It's important to understand that VNC is an open standard implemented by hundreds of different client and server packages. VNC does specify a password-authentication mechanism, but whether or not it's used, or how it's used, is entirely up to the implementation. Likewise with whether or not clients have control of the mouse and keyboard. Historically, open VNC servers have been relatively difficult to find. I don't really mean difficult, just that you had to put some concerted effort into it and very few people did. It's a reasonably modern phenomenon that things like Shodan and other large-scale network scans (including accidental ones, like Google sometimes) can be used to quickly find them, and it's quite recent that someone has nicely packaged it into a website. So this is a problem with very little visibility until today. And it still doesn't really have that much visibility in the right place, which is the somewhat insular ICS industry (and a couple dozen other industries to a lesser extent). SCADA HMIs and other ICS systems of that sort do often expose a VNC interface with no mouse and keyboard control - effectively a 'read-only' interface as you say. This is certainly less of a concern than allowing people on the internet control, but it is a significant and unnecessary security exposure. The kind of information revealed there can be very helpful to an adversary in finding a way to gain control. In most cases, access to change configuration is protected, although it's often not protected well. I expect common vandalism against internet-exposed ICS to become more and more common going forward. In most cases it doesn't really have the potential to cause permanent damage, only reduced productivity or mere irritation to the real operators. This is not always the case, though. Idaho National Laboratories conducted a notable demonstration of causing permanent and disabling damage to a diesel generator via unauthorized access to a SCADA interface (the Aurora demonstration).
- achillean 11y ago
  FYI: Websites like this have actually existed since late 2013 when Paul McMillan scanned the Internet for VNC images live during his talk and made the results available via a website in real-time. He did it again in 2014 at Defcon together with Dan Tentler and Rob Graham. Later that year people at CCC released a VNC roulette and they did the same again in 2015. And Shodan has been grabbing VNC images as well since 2014, made available at https://images.shodan.io https://images.shodan.io
achillean 11y ago
Yeah, the issue has existed for years and is widely documented in the security community. There are a few reasons why we haven't seen more widespread chaos: 1. Lack of network visibility by the owners of ICS 2. Availability > Forensics 3. VNC interfaces don't always provide full access And keep in mind that there aren't a huge number of these anonymous VNC instances to begin with. We're talking less than 10,000 instances of servers that don't have any authentication and only a fraction of them are ICS-related. I've written/ presented on the topic a few times, see: https://blog.shodan.io/taking-things-offline-is-hard/ https://blog.shodan.io/taking-things-offline-is-hard/ https://blog.shodan.io/why-control-systems-are-on-the-internet/ https://blog.shodan.io/why-control-systems-are-on-the-intern... https://blog.shodan.io/state-of-control-systems-in-the-usa-2015-05/ https://blog.shodan.io/state-of-control-systems-in-the-usa-2...
nitrogen 11y ago
And there is no shortage of people out there who would not think twice to blow things up. I think this may be the essential flaw in the logic that says we should be dead by now. Maybe there is a shortage of people who want to blow things up without thinking.
- jaredandrews 11y ago
  Hah! People always say this sort of stuff, and while I don't believe it, I could never come up with an answer simpler than "go read that Better Angels book." I never looked at it like that before. I am going to use this line now, I hope you don't mind!
- labster 11y ago
  And, if elected president, I will do something about this shortage.
- mdpopescu 11y ago
  Agreed. Given that airports have been closed because of an empty cardboard box with BOMB written in marker, if a lot of people wanted to mess up with everybody else they could have done so easily.
- marcoperaza 11y ago
  Judging by the continuous stream of people convicted for buying what they think are explosives from undercover FBI agents posing as jihadists, there are a lot of people that want to blow things up. Or take the 53,000 to 258,000 people that are estimated to be part of ISIS's military forces and allied groups. Thankfully, most of them are pretty stupid, but there are also plenty of highly educated terrorists and they tend to be engineers. The flaw in the argument is likely GP's inference that "there are some controls there that I'm sure if the wrong person pushes that red button, something will go kaboom." Critical infrastructure tends to be better engineered than that. Cybersecurity threats are newer, less widely understood, and inadequately guarded against, but human error is an age-old problem.
  - philsnow 11y ago
chvid 11y ago
I just browsed around a bit (with a VNC client) and while most are closed now maybe about one out of five-ten are still open. And they are not just read-only access. Some of them are demo systems though.
yoha 11y ago
> if there are so many hydropower plans et al vulnerable for VNC, how come we didn't have some major catastrophe? > And there is no shortage of people out there who would not think twice to blow things up. From my observation, those people tend to be those that care more about doing "flashy" things (i.e. be seen), rather than solving problems and bypassing protections. People that get access to important systems or acquire the skills to mess things up tend to be satisfied by having solved a puzzle and being able to mess things up.
- fapjacks 11y ago
  But surely some of ill intent have thought to put the two together in the same room?
  - yoha 11y ago
    Of course, some have. See Stuxnet (actually somewhat serious). The point is that this intersection is fairly small and only a fraction of compromised systems will actually get things messed up.
- deleted 11y ago
  [deleted]
- eranation 11y ago
  I hope I'm wrong but I feel that if a group like ISIS could do some major damage using a click of s button, then they would. And they are probably actively trying. They can kidnap / recruit hackers and force them / brainwash them into doing anything. They are not stupid and we saw they have no red lines. Instead of banning encryption the FBI and Interpol should force dangerous infrastructure to close their security gaps first.
- deleted 11y ago
  [deleted]
spydum 11y ago
http://arstechnica.com/security/2016/01/analysis-confirms-coordinated-hack-attack-caused-ukrainian-power-outage/ http://arstechnica.com/security/2016/01/analysis-confirms-co... Not saying VNC is to blame, but there are a number of folks very gravely concerned about the insecurity of most SCADA systems. When your infrastructure and operations are built on hardware and software expected to last 30+ years, it's hard to consider the security implications so far out.
- riskable 11y ago
  I think it is unreasonable to expect networked software to stay secure for that long. If it isn't networked in any way then sure, that might work but then again, 30 years is a long time. Adding remote software control to physical things like water treatment and electrical systems adds a lot of convenience, safety, and saves loads of money but perhaps some of that savings should be spent on more vigilance in regards to security.
pavel_lishin 11y ago
I just found a PracticeFusion machine at a pediatrics' office, with patient names, addresses and dates of birth. Not quite the same scale as taking down a dam, but I would surely be unhappy if my daughter's credit score tanked before her age hit single digits.
- deleted 11y ago
  [deleted]

Pxtl 11y ago

I didn't even know read-only vnc was a thing, and I feel a lot less mortified about the various control panels with instrument status we're seeing. I dont give a crap if the wider Internet can see the temperature of the walk-in fridge at the lab.

chippy 11y ago
some are read only, some are full control access but the local user has to authorise, and some are full control with password.

TazeTSchnitzel 11y ago

I guess it's just luck that no mischief-maker has gone and tried to do as much damage as possible.

jcrawfordor 11y ago

It's important to understand that VNC is an open standard implemented by hundreds of different client and server packages. VNC does specify a password-authentication mechanism, but whether or not it's used, or how it's used, is entirely up to the implementation. Likewise with whether or not clients have control of the mouse and keyboard. Historically, open VNC servers have been relatively difficult to find. I don't really mean difficult, just that you had to put some concerted effort into it and very few people did. It's a reasonably modern phenomenon that things like Shodan and other large-scale network scans (including accidental ones, like Google sometimes) can be used to quickly find them, and it's quite recent that someone has nicely packaged it into a website. So this is a problem with very little visibility until today. And it still doesn't really have that much visibility in the right place, which is the somewhat insular ICS industry (and a couple dozen other industries to a lesser extent). SCADA HMIs and other ICS systems of that sort do often expose a VNC interface with no mouse and keyboard control - effectively a 'read-only' interface as you say. This is certainly less of a concern than allowing people on the internet control, but it is a significant and unnecessary security exposure. The kind of information revealed there can be very helpful to an adversary in finding a way to gain control. In most cases, access to change configuration is protected, although it's often not protected well. I expect common vandalism against internet-exposed ICS to become more and more common going forward. In most cases it doesn't really have the potential to cause permanent damage, only reduced productivity or mere irritation to the real operators. This is not always the case, though. Idaho National Laboratories conducted a notable demonstration of causing permanent and disabling damage to a diesel generator via unauthorized access to a SCADA interface (the Aurora demonstration).

achillean 11y ago
FYI: Websites like this have actually existed since late 2013 when Paul McMillan scanned the Internet for VNC images live during his talk and made the results available via a website in real-time. He did it again in 2014 at Defcon together with Dan Tentler and Rob Graham. Later that year people at CCC released a VNC roulette and they did the same again in 2015. And Shodan has been grabbing VNC images as well since 2014, made available at https://images.shodan.io https://images.shodan.io

achillean 11y ago

Yeah, the issue has existed for years and is widely documented in the security community. There are a few reasons why we haven't seen more widespread chaos: 1. Lack of network visibility by the owners of ICS 2. Availability > Forensics 3. VNC interfaces don't always provide full access And keep in mind that there aren't a huge number of these anonymous VNC instances to begin with. We're talking less than 10,000 instances of servers that don't have any authentication and only a fraction of them are ICS-related. I've written/ presented on the topic a few times, see: https://blog.shodan.io/taking-things-offline-is-hard/ https://blog.shodan.io/taking-things-offline-is-hard/ https://blog.shodan.io/why-control-systems-are-on-the-internet/ https://blog.shodan.io/why-control-systems-are-on-the-intern... https://blog.shodan.io/state-of-control-systems-in-the-usa-2015-05/ https://blog.shodan.io/state-of-control-systems-in-the-usa-2...

nitrogen 11y ago

And there is no shortage of people out there who would not think twice to blow things up. I think this may be the essential flaw in the logic that says we should be dead by now. Maybe there is a shortage of people who want to blow things up without thinking.

jaredandrews 11y ago
Hah! People always say this sort of stuff, and while I don't believe it, I could never come up with an answer simpler than "go read that Better Angels book." I never looked at it like that before. I am going to use this line now, I hope you don't mind!
labster 11y ago
And, if elected president, I will do something about this shortage.
mdpopescu 11y ago
Agreed. Given that airports have been closed because of an empty cardboard box with BOMB written in marker, if a lot of people wanted to mess up with everybody else they could have done so easily.
marcoperaza 11y ago
Judging by the continuous stream of people convicted for buying what they think are explosives from undercover FBI agents posing as jihadists, there are a lot of people that want to blow things up. Or take the 53,000 to 258,000 people that are estimated to be part of ISIS's military forces and allied groups. Thankfully, most of them are pretty stupid, but there are also plenty of highly educated terrorists and they tend to be engineers. The flaw in the argument is likely GP's inference that "there are some controls there that I'm sure if the wrong person pushes that red button, something will go kaboom." Critical infrastructure tends to be better engineered than that. Cybersecurity threats are newer, less widely understood, and inadequately guarded against, but human error is an age-old problem.
- philsnow 11y ago

chvid 11y ago

I just browsed around a bit (with a VNC client) and while most are closed now maybe about one out of five-ten are still open. And they are not just read-only access. Some of them are demo systems though.

yoha 11y ago

> if there are so many hydropower plans et al vulnerable for VNC, how come we didn't have some major catastrophe? > And there is no shortage of people out there who would not think twice to blow things up. From my observation, those people tend to be those that care more about doing "flashy" things (i.e. be seen), rather than solving problems and bypassing protections. People that get access to important systems or acquire the skills to mess things up tend to be satisfied by having solved a puzzle and being able to mess things up.

fapjacks 11y ago
But surely some of ill intent have thought to put the two together in the same room?
- yoha 11y ago
  Of course, some have. See Stuxnet (actually somewhat serious). The point is that this intersection is fairly small and only a fraction of compromised systems will actually get things messed up.
deleted 11y ago
[deleted]
eranation 11y ago
I hope I'm wrong but I feel that if a group like ISIS could do some major damage using a click of s button, then they would. And they are probably actively trying. They can kidnap / recruit hackers and force them / brainwash them into doing anything. They are not stupid and we saw they have no red lines. Instead of banning encryption the FBI and Interpol should force dangerous infrastructure to close their security gaps first.
deleted 11y ago
[deleted]

spydum 11y ago

http://arstechnica.com/security/2016/01/analysis-confirms-coordinated-hack-attack-caused-ukrainian-power-outage/ http://arstechnica.com/security/2016/01/analysis-confirms-co... Not saying VNC is to blame, but there are a number of folks very gravely concerned about the insecurity of most SCADA systems. When your infrastructure and operations are built on hardware and software expected to last 30+ years, it's hard to consider the security implications so far out.

riskable 11y ago
I think it is unreasonable to expect networked software to stay secure for that long. If it isn't networked in any way then sure, that might work but then again, 30 years is a long time. Adding remote software control to physical things like water treatment and electrical systems adds a lot of convenience, safety, and saves loads of money but perhaps some of that savings should be spent on more vigilance in regards to security.

pavel_lishin 11y ago

I just found a PracticeFusion machine at a pediatrics' office, with patient names, addresses and dates of birth. Not quite the same scale as taking down a dam, but I would surely be unhappy if my daughter's credit score tanked before her age hit single digits.

deleted 11y ago
[deleted]