4 ms·

Control systems are so ridiculously insecure given what they do. I was lucky enough to attend a DHS control systems security summit at INL way back in 2006 (or

by erentz 9y ago

Control systems are so ridiculously insecure given what they do. I was lucky enough to attend a DHS control systems security summit at INL way back in 2006 (or 2007 I can't remember). They had a huge lab full of various PLCs, etc, and a bunch of surprisingly smart folks working on pen-testing them. But still, it's a decade later and we don't seem to have made much progress.

abricot 9y ago
It's a decade later and the new secure versions still havent been installed in Ukrainian power stations...
- zfdrdg 9y ago
  Are you just assuming new secure versions exist that could be used? I work with industrial control but mainly Rockwell not siemens and I don't know of any PLC communication protocol that supports any kind of encryption but I want to hear about any options that do exist.
snerbles 9y ago
> But still, it's a decade later and we don't seem to have made much progress. Despite all the "IIoT" buzzwords their marketing may spout, industrial vendors operate a decade behind the software curve at best. Arcane proprietary stacks running atop XP, CE, ActiveX, and various flavors of DOS are still getting deployed in new industrial installations...often supported by vendors staffed by a hundred salescritters to every engineer, if they're lucky enough to have any staff remaining that wrote or understand the original product in the first place. It's filled with dozens of mini-Oracles, each with licensing more insane than the next because your typical integrator will either run for the hills at the first sign of anything that isn't ladder logic or spew forth spaghetti garbage that makes INTERCAL look like the most pretentiously elegant Lisp. When you're the lone programmer on the team that even knows what Git is, you start to realize why nobody ever got fired for just buying Rockwell.
- evdev 9y ago
  This is correct. The ActiveX is very, very real.
- jcranmer 9y ago
  Ahh, the painful memories of writing the SCADA control software. In VBScript. The old system was running on VMS. The new system could be accessed via ActiveX control in an IE page. At least the plant network was sufficiently airgapped.
  - noir_lord 9y ago
    > At least the plant network was sufficiently airgapped. The Iranians thought that as well.
rasz 9y ago
>bunch of surprisingly smart folks working on pen-testing them. of course, you need those to implement stuxnet. I recommend "Zero Days" (2016)
mr_overalls 9y ago
As the grugq has pointed out, incentives are not currently aligned properly to produce secure industrial systems: "Firstly, a lot of infrastructure and data is in civilian hands. The people and organizations responsible for securing things are not the ones responsible for retaliating against attacks. They can’t do it anyway because they lack the resources, capability, and legal authority to do so. As for investing in securing their systems, there is no regulatory requirement to do so. Indeed, for a board of directors, I’ve seen it suggested that they have a fiduciary duty to shareholders not to bear the cost burden of securing critical national infrastructure. It’s not their business to directly bear the costs of defending the nation, that’s what the nation state is for in the first place!" https://medium.com/@thegrugq/idle-thoughts-on-cyber-82170b2b7280 https://medium.com/@thegrugq/idle-thoughts-on-cyber-82170b2b...

by erentz 9y ago

abricot 9y ago

It's a decade later and the new secure versions still havent been installed in Ukrainian power stations...

zfdrdg 9y ago
Are you just assuming new secure versions exist that could be used? I work with industrial control but mainly Rockwell not siemens and I don't know of any PLC communication protocol that supports any kind of encryption but I want to hear about any options that do exist.

snerbles 9y ago

> But still, it's a decade later and we don't seem to have made much progress. Despite all the "IIoT" buzzwords their marketing may spout, industrial vendors operate a decade behind the software curve at best. Arcane proprietary stacks running atop XP, CE, ActiveX, and various flavors of DOS are still getting deployed in new industrial installations...often supported by vendors staffed by a hundred salescritters to every engineer, if they're lucky enough to have any staff remaining that wrote or understand the original product in the first place. It's filled with dozens of mini-Oracles, each with licensing more insane than the next because your typical integrator will either run for the hills at the first sign of anything that isn't ladder logic or spew forth spaghetti garbage that makes INTERCAL look like the most pretentiously elegant Lisp. When you're the lone programmer on the team that even knows what Git is, you start to realize why nobody ever got fired for just buying Rockwell.

evdev 9y ago
This is correct. The ActiveX is very, very real.
jcranmer 9y ago
Ahh, the painful memories of writing the SCADA control software. In VBScript. The old system was running on VMS. The new system could be accessed via ActiveX control in an IE page. At least the plant network was sufficiently airgapped.
- noir_lord 9y ago
  > At least the plant network was sufficiently airgapped. The Iranians thought that as well.

rasz 9y ago

>bunch of surprisingly smart folks working on pen-testing them. of course, you need those to implement stuxnet. I recommend "Zero Days" (2016)

mr_overalls 9y ago

As the grugq has pointed out, incentives are not currently aligned properly to produce secure industrial systems: "Firstly, a lot of infrastructure and data is in civilian hands. The people and organizations responsible for securing things are not the ones responsible for retaliating against attacks. They can’t do it anyway because they lack the resources, capability, and legal authority to do so. As for investing in securing their systems, there is no regulatory requirement to do so. Indeed, for a board of directors, I’ve seen it suggested that they have a fiduciary duty to shareholders not to bear the cost burden of securing critical national infrastructure. It’s not their business to directly bear the costs of defending the nation, that’s what the nation state is for in the first place!" https://medium.com/@thegrugq/idle-thoughts-on-cyber-82170b2b7280 https://medium.com/@thegrugq/idle-thoughts-on-cyber-82170b2b...