10 ms·

DDoS attack halts heating in Finland amidst winter

115 points by pimeys 10y ago

akerro 10y ago
Will botnet build of smart kettles and smart ovens burn houses, neighbourhoods and cities?
- mtgx 10y ago
  At that point, the makers of such devices should be punished with a lot more than just a recall.
  - globalgobble 10y ago
    Why ? It's impossible to create a super secure device. In that case we could punish entire nations for screwing up the securities of airports, nuclear plants or whatever. Cuz you know it's relatively simple to trigger havoc. Fortunately the world is not full of lunatics.
- jpalomaki 10y ago
  If we had large amount of devices like heaters and boilers attached to remote control system it would be probably possible to cause major problems to the electrical network by just turning the devices on and off in synchronised fashion. And actually this is not so far fetched, since there are already discussions about making these devices smart and remotely controllable so that the utility company could balance the electricity need.
  - akerro 10y ago
    That's related: http://www.telegraph.co.uk/news/2016/10/03/no-more-electricity-surges-as-the-nation-switches-on-the-kettle/ http://www.telegraph.co.uk/news/2016/10/03/no-more-electrici...
    - adrianN 10y ago
      Yet another end-of-civilization scenario: Netflix crashes -> kettles get turned on -> the grid crashes -> looting, revolution etc etc
protomyth 10y ago
Perhaps, regardless of the convenience factor, we shouldn't hook critical infrastructure to the internet.
- oelmekki 10y ago
  <Insert battlestar galactica reference> :) [1] One thing is sure: we won't ever make 100% secure networks. For now, ransomware are few and only on a big scale, but they could indeed become a big problem with IoT. I'm not exactly sure why we need to connect those devices to the internet: sounds like a local network should be enough. And if we want to send usage data to some kind of aggregation service, devices still can issue POST requests to our connected desktop, or be bluetooth connected to our mobiles. [1] for those who didn't watch it, the battlestar galactica is one of the only human spaceships not destroyed by robots, thanks to the fact its captain always refused to connect the ship on the network
ge0rg 10y ago
That sounds like either clueless reporting or an attempt at blame shifting. The heating system of a building is not a typical DDoS target, and it's improbable that somebody living outside of that building had a take against the inhabitants, knew of the right IP(s) for that building, and the effect a DDoS would have. It's more plausible that the control system was designed so badly that exposing it to the Internet (and the accompanying background noise from port scanners, be it botnets, spammers or IoT malware) caused it to break down. Then, the operators saw the effect of the misconfiguration and proclaimed it was a DDoS, because you don't get fired for breaking down under a DDoS, as opposed to having miserable IT security in place. This is similar to getting hacked by "the Russians" (or other state-level evildoers) where it is widely accepted that you just can't prevent such incidents.
- na85 10y ago
  Perhaps. I wouldn't discount actual ddos, though. Sounds like exactly the sort of thing I'd have done in my youth (if I had had the skills) if I would've discovered lax security in my own building's systems and it pissed me off. IOT companies don't tend to have bug bounties et al, and shutting off the heat to some buildings seems like a mostly harmless way to get some publicity for the issue.
- zmb_ 10y ago
  It is bad reporting. The systems in question were used as a part of launching a DDoS attack, they were not the target of the attack. The high load then caused the systems to crash repeatedly.
  - ge0rg 10y ago
    Do you have a better source for that? In the article it rather reads like the control system was at the receiving end: The systems that were attacked tried to respond to the attack by rebooting the main control circuit.
    - sesqu 10y ago
      The service provider says it was a DDOS but the device manufacturer says it was probably an aftershock of the Mirai botnet that uses IoT to launch attacks.
ryanlol 10y ago
This was almost certainly a case of outgoing DoS, not incoming DDoS. Terrible reporting. Remote management hardware got infected with Mirai or the like.
- SixSigma 10y ago
  I'm calling: Local newspaper, written in English by Finnish speaking Finns who are not computer specialists.
  - nommon 10y ago
    You should meet some Finns. They generally speak excellent English.
    - SixSigma 10y ago
      Perkele !!
  - ryanlol 10y ago
    The Finnish original wasn't any better.
    - invid_regent 10y ago
      hello Finnish IoT ddos expert
cesarb 10y ago
In my experience, embedded systems tend to behave poorly when faced with large amounts of traffic (normal traffic to these systems is tiny). I have once been locked out of work due to an errant workstation flooding the network with broadcast DHCP packets, which overloaded the embedded system which validates the key cards and unlocks the door (later permanently solved by moving the embedded system to its own firewalled VLAN). As an aside: lovely Netscape favicon on that site.
mrweasel 10y ago
Regardless of the reason, deliberate targetting, accidental "drive by DDoS" or bad configuration, the question that remains is "Why is the heating dependent on being online?" It is completely reasonable if the heat system every so often "phones home", so report on usage, but it shouldn't actually stop working, if the network connection isn't available. You can blame, DDoS, hackers, network outages, the Russians, I don't care, it doesn't cover up the fact that your system has a stupid design.
- ComteDeLaFere 10y ago
  Not sure why this is controversial. Boilers have an on/off switch, and when your company manages a large number of buildings, you automate and centralize on/off for efficiency's sake, no?
  - ohyes 10y ago
    No, you generally have a a control device on site. You probably also have some backup/safeguards in place in case the controller fails. In essential systems you have to build for robustness over efficiency.
    - deleted 10y ago
      [deleted]
  - mrweasel 10y ago
    That fair enough, but in this case the heating system is directly attached to the internet. The correct way of designing something like this is having the heating system as one system and the management system as another. The management system can then receive information and MAYBE control some aspects of the heating system. If you remove or crash the management system, the heating system just reverts back to being a "dumb" heating system. My question is: Why in the name of all that is holy does the heating system stop working just because the remote management interface decides to reboot? This has to be design by the same idiots that believe that an in car infotainment system should be hooked up to the drive computer in a Jeep.
0xmohit 10y ago
[Appears that this was submitted several times on HN before being noticed.] It appears that it's been fixed. https://twitter.com/Symbiatch/status/796407575776526341 https://twitter.com/Symbiatch/status/796407575776526341 Also see https://twitter.com/internetofshit/status/796405149501706240 https://twitter.com/internetofshit/status/796405149501706240
Raed667 10y ago
In school we have studied a scenario that is exactly like this: "The effects of IoT security on utility and daily life functions" From hacking boilers to stop water delivery, to locking people outside their doors. The next few years will be very fun for "infoSec" people.
- Ftuuky 10y ago
  Something like this could happen too: https://twitter.com/ariellejjohnson/status/794708325300465664 https://twitter.com/ariellejjohnson/status/79470832530046566...
adaisadais 10y ago
And so it begins!
mmaunder 10y ago
It's not long now until we see the first death directly attributable to a cyber attack.
philfrasty 10y ago
There is a great book with this exact topic called „Blackout“ by Marc Elsberg. Highly recommend! Edit: Amazon link https://www.amazon.com/dp/B01FCQLSPC https://www.amazon.com/dp/B01FCQLSPC
- schlowmo 10y ago
  [little spoiler warning] I wouldn't call it "this exact topic", since the primary attack vector in the story are smart meters, but still can second your recommendation. The book is highly based on a study founded by the german government[0], analyzing the outcome of a great scale blackout. The study is also worth reading, unfortunately only a german version is available. [0] http://www.tab-beim-bundestag.de/de/untersuchungen/u137.html http://www.tab-beim-bundestag.de/de/untersuchungen/u137.html

115 points by pimeys 10y ago

akerro 10y ago

Will botnet build of smart kettles and smart ovens burn houses, neighbourhoods and cities?

mtgx 10y ago
At that point, the makers of such devices should be punished with a lot more than just a recall.
- globalgobble 10y ago
  Why ? It's impossible to create a super secure device. In that case we could punish entire nations for screwing up the securities of airports, nuclear plants or whatever. Cuz you know it's relatively simple to trigger havoc. Fortunately the world is not full of lunatics.
jpalomaki 10y ago
If we had large amount of devices like heaters and boilers attached to remote control system it would be probably possible to cause major problems to the electrical network by just turning the devices on and off in synchronised fashion. And actually this is not so far fetched, since there are already discussions about making these devices smart and remotely controllable so that the utility company could balance the electricity need.
- akerro 10y ago
  That's related: http://www.telegraph.co.uk/news/2016/10/03/no-more-electricity-surges-as-the-nation-switches-on-the-kettle/ http://www.telegraph.co.uk/news/2016/10/03/no-more-electrici...
  - adrianN 10y ago
    Yet another end-of-civilization scenario: Netflix crashes -> kettles get turned on -> the grid crashes -> looting, revolution etc etc

protomyth 10y ago

Perhaps, regardless of the convenience factor, we shouldn't hook critical infrastructure to the internet.

oelmekki 10y ago
<Insert battlestar galactica reference> :) [1] One thing is sure: we won't ever make 100% secure networks. For now, ransomware are few and only on a big scale, but they could indeed become a big problem with IoT. I'm not exactly sure why we need to connect those devices to the internet: sounds like a local network should be enough. And if we want to send usage data to some kind of aggregation service, devices still can issue POST requests to our connected desktop, or be bluetooth connected to our mobiles. [1] for those who didn't watch it, the battlestar galactica is one of the only human spaceships not destroyed by robots, thanks to the fact its captain always refused to connect the ship on the network

ge0rg 10y ago

That sounds like either clueless reporting or an attempt at blame shifting. The heating system of a building is not a typical DDoS target, and it's improbable that somebody living outside of that building had a take against the inhabitants, knew of the right IP(s) for that building, and the effect a DDoS would have. It's more plausible that the control system was designed so badly that exposing it to the Internet (and the accompanying background noise from port scanners, be it botnets, spammers or IoT malware) caused it to break down. Then, the operators saw the effect of the misconfiguration and proclaimed it was a DDoS, because you don't get fired for breaking down under a DDoS, as opposed to having miserable IT security in place. This is similar to getting hacked by "the Russians" (or other state-level evildoers) where it is widely accepted that you just can't prevent such incidents.

na85 10y ago
Perhaps. I wouldn't discount actual ddos, though. Sounds like exactly the sort of thing I'd have done in my youth (if I had had the skills) if I would've discovered lax security in my own building's systems and it pissed me off. IOT companies don't tend to have bug bounties et al, and shutting off the heat to some buildings seems like a mostly harmless way to get some publicity for the issue.
zmb_ 10y ago
It is bad reporting. The systems in question were used as a part of launching a DDoS attack, they were not the target of the attack. The high load then caused the systems to crash repeatedly.
- ge0rg 10y ago
  Do you have a better source for that? In the article it rather reads like the control system was at the receiving end: The systems that were attacked tried to respond to the attack by rebooting the main control circuit.
  - sesqu 10y ago
    The service provider says it was a DDOS but the device manufacturer says it was probably an aftershock of the Mirai botnet that uses IoT to launch attacks.

ryanlol 10y ago

This was almost certainly a case of outgoing DoS, not incoming DDoS. Terrible reporting. Remote management hardware got infected with Mirai or the like.

SixSigma 10y ago
I'm calling: Local newspaper, written in English by Finnish speaking Finns who are not computer specialists.
- nommon 10y ago
  You should meet some Finns. They generally speak excellent English.
  - SixSigma 10y ago
    Perkele !!
- ryanlol 10y ago
  The Finnish original wasn't any better.
  - invid_regent 10y ago
    hello Finnish IoT ddos expert

cesarb 10y ago

In my experience, embedded systems tend to behave poorly when faced with large amounts of traffic (normal traffic to these systems is tiny). I have once been locked out of work due to an errant workstation flooding the network with broadcast DHCP packets, which overloaded the embedded system which validates the key cards and unlocks the door (later permanently solved by moving the embedded system to its own firewalled VLAN). As an aside: lovely Netscape favicon on that site.

mrweasel 10y ago

Regardless of the reason, deliberate targetting, accidental "drive by DDoS" or bad configuration, the question that remains is "Why is the heating dependent on being online?" It is completely reasonable if the heat system every so often "phones home", so report on usage, but it shouldn't actually stop working, if the network connection isn't available. You can blame, DDoS, hackers, network outages, the Russians, I don't care, it doesn't cover up the fact that your system has a stupid design.

ComteDeLaFere 10y ago
Not sure why this is controversial. Boilers have an on/off switch, and when your company manages a large number of buildings, you automate and centralize on/off for efficiency's sake, no?
- ohyes 10y ago
  No, you generally have a a control device on site. You probably also have some backup/safeguards in place in case the controller fails. In essential systems you have to build for robustness over efficiency.
  - deleted 10y ago
    [deleted]
- mrweasel 10y ago
  That fair enough, but in this case the heating system is directly attached to the internet. The correct way of designing something like this is having the heating system as one system and the management system as another. The management system can then receive information and MAYBE control some aspects of the heating system. If you remove or crash the management system, the heating system just reverts back to being a "dumb" heating system. My question is: Why in the name of all that is holy does the heating system stop working just because the remote management interface decides to reboot? This has to be design by the same idiots that believe that an in car infotainment system should be hooked up to the drive computer in a Jeep.

0xmohit 10y ago

[Appears that this was submitted several times on HN before being noticed.] It appears that it's been fixed. https://twitter.com/Symbiatch/status/796407575776526341 https://twitter.com/Symbiatch/status/796407575776526341 Also see https://twitter.com/internetofshit/status/796405149501706240 https://twitter.com/internetofshit/status/796405149501706240

Raed667 10y ago

In school we have studied a scenario that is exactly like this: "The effects of IoT security on utility and daily life functions" From hacking boilers to stop water delivery, to locking people outside their doors. The next few years will be very fun for "infoSec" people.

Ftuuky 10y ago
Something like this could happen too: https://twitter.com/ariellejjohnson/status/794708325300465664 https://twitter.com/ariellejjohnson/status/79470832530046566...

adaisadais 10y ago

And so it begins!

mmaunder 10y ago

It's not long now until we see the first death directly attributable to a cyber attack.

philfrasty 10y ago

There is a great book with this exact topic called „Blackout“ by Marc Elsberg. Highly recommend! Edit: Amazon link https://www.amazon.com/dp/B01FCQLSPC https://www.amazon.com/dp/B01FCQLSPC

schlowmo 10y ago
[little spoiler warning] I wouldn't call it "this exact topic", since the primary attack vector in the story are smart meters, but still can second your recommendation. The book is highly based on a study founded by the german government[0], analyzing the outcome of a great scale blackout. The study is also worth reading, unfortunately only a german version is available. [0] http://www.tab-beim-bundestag.de/de/untersuchungen/u137.html http://www.tab-beim-bundestag.de/de/untersuchungen/u137.html