11 ms·
German nuclear plant infected with computer viruses, operator says
- elcapitan 10y agoI found that part much more .. interesting: > As an example, Hypponen said he had recently spoken to a European aircraft maker that said it cleans the cockpits of its planes every week of malware designed for Android phones. The malware spread to the planes only because factory employees were charging their phones with the USB port in the cockpit.
- pm90 10y agoWhat....? Seriously, wtf? Is it really that hard to provide outlets to charge your phone?
- EliRivers 10y agoOr alternatively, how about WTF are you doing plugging your phone into this fucking cockpit? You're here to do your job and if you want to carry your phone around with you in the factory all day that's up to you, but plugging your phone into the fucking cockpit you're meant to be working on will result in demotions, suspensions and unemployment all round. More politely put, I see no obligation on employers to provide employees with the means to recharge their personal phones :)
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- dagw 10y agoI see no obligation on employers to provide employees with the means to recharge their personal phones What makes you so sure it isn't (also) their work phone? Lots of people I know don't have a personal phone and a work phone, they just have a phone.
- sgift 10y ago> More politely put, I see no obligation on employers to provide employees with the means to recharge their personal phones :) This is a classic "design a better human" problem - sure, you can try to 'persuade' people by threatening them with demotions, suspensions and unemployment. And then you can hope that this will work in every single instance. Or ... you can provide a few usb ports in a convenient location, so people use these instead of the usb port in your multi million dollar cockpit to charge their phones. Take your pick. For another example decide if it's easier to provide waste bins or to threaten people who litter streets.
- deleted 10y ago[deleted]
- EliRivers 10y agoThey were working in a cockpit factory. They had many other options for charging their phone in a USB socket, and they still chose to charge it by plugging it into the cockpit. Your solution, in this situation, already existed and people still plugged phones into the cockpit. Why would they NOT do this, under your system? If I can plug my phone in right where I am, in the cockpit, or somewhere less convenient for me, why would I not just do it where I am, in the cockpit? There are no penalties for it, so why wouldn't I do it?
- lmm 10y agoFollowing the what, 11 different plug standards commonly in use for power internationally? Or provide a USB port that every phone in the world can use, and is smaller and more efficient to boot. I know which I'd pick.
- tyingq 10y agoAnything installed in an aircraft is subject to a regulatory avalanche of paperwork, testing, and approvals.
- TillE 10y agoThe next sentence pretty much confirms my impression that this claim is almost certainly bullshit: > Because the plane runs a different operating system, nothing would befall it. But it would pass the virus on to other devices that plugged into the charger. That's just...not how computers work.
- elcapitan 10y agoIt's true that that scenario is not relevant, but the fact that there is a direct connection between the usb ports for charging stuff and the planes' computer is obviously a point of intrusion for attacks like Stuxnet.
- jessriedel 10y agoMight be the case that the USB ports are for interacting with the plane's computers, and the charging being done by the pilots is against the rules.
- MichaelBurge 10y agoI could maybe understand it if it was a USB hub, and the phones all had a defect that meant rogue USB signals could infect them. So if 2 people plugged into the same hub at the same time, it could spread. But if the claim is that the virus lie 'dormant' in the uninfectable plane OS, then I can't understand that.
- nitrogen 10y agoUSB devices cannot contact each other, only the master can communicate with the devices on the bus. It is a tree with one device at the root.
- SonicSoul 10y agonice catch. can't help but think of Independence Day when Jeff Goldblum and Will Smith infect alien mothership with a mac virus from a 3.5 floppy which specifically disabled its protective shield. "will give it a cold" Edit: corrected it's its
- SixSigma 10y agoCallback to 2008 : Boeing's new 787 Dreamliner passenger jet may have a serious security vulnerability in its onboard computer networks that could allow passengers to access the plane's control systems, according to the U.S. Federal Aviation Administration. The computer network in the Dreamliner's passenger compartment, designed to give passengers in-flight internet access, is connected to the plane's control, navigation and communication systems, an FAA report reveals. Boeing spokeswoman Lori Gunter wouldn't go into detail about how Boeing is tackling the issue but says it is employing a combination of solutions that involves some physical separation of the networks, known as "air gaps," and software firewalls. Gunter also mentioned other technical solutions, which she said are proprietary and didn't want to discuss in public. "There are places where the networks are not touching, and there are places where they are," she said. http://www.wired.com/2008/01/dreamliner-security/ http://www.wired.com/2008/01/dreamliner-security/ http://cryptome.info/faa010208.htm http://cryptome.info/faa010208.htm
- madaxe_again 10y agoIt'll be EADS - I've experienced their infosec first hand. Heavy on process and inquisatorial panels - yet they do stuff like emailing parts lists and schematics over the Internet, no protection.
- cm3 10y agoYeah, it's sad that so many people actually use USB ports at airports to charge their devices, without knowing what they are connecting their devices to. I don't expect them to know better, but all their data could be copied, stuff could be modified. Isn't there an adapter which limits the active lines to just what's needed to pass power, no data, or is charging without some data exchange impossible?
- gpvos 10y agoThe data lines are used for signalling which charging speed the device supports. You can cut them, but then you get the lowest denominator charging specs, which is quite slow.
- hga 10y agohttps://www.crowdsupply.com/xipiter/usbcondom https://www.crowdsupply.com/xipiter/usbcondom
- 05 10y agoNot a problem if you use iOS9: https://labsblog.f-secure.com/2015/09/09/apple-ios-9-security-features/ https://labsblog.f-secure.com/2015/09/09/apple-ios-9-securit... For Android, you can root it and disable USB host functions when locked.
- Aelinsaar 10y agoI wonder what scale of disaster will have to occur before information security is placed under the same legal and regulatory scrutiny as physical security?
- vanderZwan 10y agoI think it won't happen until everyone in society has good "computer literacy".
- delecti 10y agoThe number of people who have no idea how their car works, despite them being fairly ubiquitous for nearly 100 years makes be think that that will never happen. There will always be people who know only just enough about the technology around them to get by.
- cm3 10y agoThat's not a reasonable requirement, it's just that there is no consequence for people administrating (installing, maintaining) systems and the software writers. If fines were involved, how long do you guess would it take for people to stop writing in C or system integrator setting up random software. Critical systems may only use software written and certified years ago, not be constantly updated.
- this_user 10y agoEven if you did that, there is still more than enough room for human error or sheer negligence. See: http://www.bloomberg.com/news/articles/2016-04-08/entergy-agrees-to-review-fire-safety-at-reactors-after-probe http://www.bloomberg.com/news/articles/2016-04-08/entergy-ag...
- Aelinsaar 10y agoSo because your house might burn down, you leave your doors and windows unlocked?
- DasIch 10y ago
- phreeza 10y agoPossibly important to note the timing of this admission right on the heels of the announcement of our defense minister that she wants to build a 'cyber' division in the army with 13500 people working there. Thats almost 10% of our armed forces. I could only find decent reporting about this in german: http://www.tagesspiegel.de/politik/plaene-der-verteidigungsministerin-ursula-von-der-leyen-will-cyber-armee-mit-13-500-mitarbeitern/13503698.html http://www.tagesspiegel.de/politik/plaene-der-verteidigungsm...
- elcapitan 10y agoHere in Germany that only means that 13000 people print out reports for the minister, while 500 people look at screens. 10 of them program the stuff that happens on the screens.
- duncan_bayne 10y agoYou have that many Australians working in Germany?
- iamgopal 10y agoIt's same everywhere.
- majewsky 10y agoClassic joke: "Wow, that's a huge building. How many people work here?" - "Maybe half of them."
- deleted 10y ago
- rthomas6 10y agoIt's more alarming to me that, apparently, critical infrastructure in a nuclear plant is running old versions of Windows.
- _pmf_ 10y ago> It's more alarming to me that, apparently, critical infrastructure in a nuclear plant is running old versions of Windows Don't worry, the most important parts are running on DOS or OS/2, so we're saved from doom!
- mtgx 10y ago"Nuclear is safe", they said. I'd rather have my local solar power plant infected with viruses or hit by cyberattacks.
- mabbo 10y agoModern nuclear reactor design is such that you cant cause a meltdown without violating the laws of physics.
- jobu 10y agoUnfortunately most nuclear reactors aren't modern.
- germanier 10y agoAs far as I know there isn't even a single one of those designs which was successfully built somewhere yet (as in: Is able to generate more power than it uses).
- DasIch 10y agoThe being able to generate more power than it uses is a problem for nuclear fusion reactors. The problem with modern nuclear reactor designs is that they're just that, designs. Great ideas people in comment sections love to mentally masturbate about. In reality almost all nuclear reactors are decades old. Politics alone ensure nuclear reactors with the exception of maybe fusion (which will be way too late for climate change) will never get off the ground. In the meantime renewables, solar especially, get cheaper and more efficient every day, not designs but actual installations.
- batmansmk 10y agoLet's just say it's not new. Operators mostly watch the plant during the weekend while the engineers are not there. It is a security job: check if something turns red and pick up the phone if it goes bonkers. The operator has a limited access to the core process. Boring, and they get busy by going to the Internet and downloading random stuff. And yes they do have access to the Internet...
- tkinom 10y agoRemember saw a job ads for PDP11 programmer to work on Nuclear power related project a few months ago. One thing for sure: you can't infect a PDP11 system with Windows or Dos Virus, nor can one plug in an USB.
- tyingq 10y agoI wonder if the new hire raises eyebrows constantly talking about "core memory", "dumping core", etc.
- MelmanGI 10y agoMandatory Simpsons quote: Homer: "NUC-U-LAR"! IT'S PRONOUNCED, "NUC-U-LAR." https://frinkiac.com/meme/S09E19/665197/m/Ik5VQy1VLUxBUiIhCklUJ1MgUFJPTk9VTkNFRCwgCiJOVUMtVS1MQVIuIg== https://frinkiac.com/meme/S09E19/665197/m/Ik5VQy1VLUxBUiIhCk...
- cm3 10y agoWe have to be more concerned about the things that are not reported. And why is it even technically possible to infect the control system of a power plant at all, or was this just a virus in some auxilliary sytem like, say, the machines only connected to another network, totally decoupled from the control system? Without details, this is just fear mongering on the heels of recent media outbreak regarding Belgian reactors.
- snowwindwaves 10y agoThe article said the virus was on "a computer system retrofitted in 2008 with data visualization software associated with equipment for moving nuclear fuel rods". Control systems generally have two components; the actual controllers that interface with the machine or equipment and then an HMI for the operator to interface with the controller (ignoring completely hard wired systems consisting of lights, buttons, chart recorders, etc). The majority of the HMI software runs on windows. Once an attacker is on the HMI system they can probably easily do anything the operator can do, and possibly have full access to the controller and make things happen that Should Never Happen.
- microcolonel 10y agoWhat am I even reading? A nuclear power plant has computers on its airgapped network infected with a computer virus from 8 years ago for an operating system which expired from support two years ago. At least the nuclear power plant near me runs on a PDP-11.
- known 10y agoThe head of the BND, the German equivalent of the American CIA, has been booted out of his job on the orders of chancellor Angela Merkel, two years before he was officially due to retire. No reason for the leadership change was disclosed http://qz.com/671383/germany-has-sacked-its-spy-chief-but-hasnt-said-why/ http://qz.com/671383/germany-has-sacked-its-spy-chief-but-ha...
- jamisteven 10y agoStuxnet coming to mind.
- onetimePete 10y agoVirus claims german nuclear power plant run down by underfunded operators. "Cant spread, if you are all on old breaking down hardware on outdated systems that nobody bothers to update." says virus.