5 ms·
Why are systems like this connected to the internet? As far as I can see, any safety monitoring system should be air-gapped, or, if remote control is absolutel
by Hasz 9y ago
Why are systems like this connected to the internet?
As far as I can see, any safety monitoring system should be air-gapped, or, if remote control is absolutely needed, be connected via a robust physical interface, i.e a thick cable.
There is no good reason for any of these devices to have a public IP address. Physical access should be the only attack vector available when it comes to industrial sabotage.
- ggggtez 9y agoYou would think that wouldn't you. But for that to happen, the system designer would have had to plan it that way probably 20 years ago.
- abritinthebay 9y agoThis was predictable 20 years ago too though.
- icebraining 9y agoOn that note, the Christmas Tree EXEC is 30 years old this month! https://en.wikipedia.org/wiki/Christmas_Tree_EXEC https://en.wikipedia.org/wiki/Christmas_Tree_EXEC
- senectus1 9y agoyup, they should NOT be connecting them, but because everyone is going cloud and remote service support.... they got to let "people" in. Also the PLC administrators refuse to let proper network and systems admins go near their shit. They think their stuff is better left alone from the "geeks".
- PinguTS 9y agoIt's the IT folks who tell everybody you should connect everything to the Internet, because that makes everything so easy. It's the embedded folks, who tell that it is not made for this. It's the manager folks, who demand that it be connected, because the IT folks told that it's is easy and innovative while the embedded folks are so old school.
- vog 9y ago> It's the embedded folks, who tell that it is not made for this. Really? If so, this is just a small minority of the embedded folks. Think of the whole "Internet of Things" security mess, combined with a large part of "Industry 4.0". That's tons of embedded devices explicitly built to be connected to the Internet. If it were really the developers of those embedded devices who didn't want them to have Internet connection, they would never have been in charge to build those in the first place.
- phkahler 9y agoTraditional embedded systems used micro controllers. Or for plants they used PLCs for automation. People have been warning for years that connecting factory automation (or power plant control) to the network gave it an interface to the whole world. IT insisted that it would be on a subnet or in some other way "safe". And besides, no hackers in the PC space knew anything about the hardware and software in these systems. The world is converging to point where everything is just an SoC capable of running a full OS and applications. IoT is just marketing taking advantage of the capability.
- dsfyu404ed 9y ago>explicitly built Just because a network interface is part of the hardware design does not make it "explicitly built" for use on the internet. On the software side 99.999% of these products are a security mess and only manage to dodge that reputation because the market is so fragmented that automated ways to bypass the security on these devices with no fine tuning involved does not yet exist.
- pjmlp 9y agoBest of all, they tend to have mini web servers exposing device APIs, completely written in straight C code.
- kogepathic 9y ago> Best of all, they tend to have mini web servers exposing device APIs, completely written in straight C code. Well of course, that's what the 10 year old vendor SDK uses, why do extra work? /s The state of industrial/embedded security in general is so poor I'm surprised there aren't more stories like this coming out. To give a concrete example, the industrial world was using modbus since the late 1970s and when Ethernet came around in the 1980s someone thought "well let's just encapsulate modbus data in TCP" and thus was born ModbusTCP. Not a single thought was given to security. There's millions if not billions of dollars of industrial equipment using ModbusTCP today that cannot be secured without being replaced completely. I've yet to see anyone pushing a secure protocol to replace ModbusTCP in industrial environments. When a utility is hacked (not if) and the attackers get into the SCADA network, it's going to cause a bloodbath of epic proportions.
- adrianN 9y agoBecause all kinds of companies are pushing for the Industrial Internet of Things, since that enables new subscription-type business models for sectors that used to sell big expensive machines ~once per customer. https://en.wikipedia.org/wiki/Internet_of_things#Manufacturing https://en.wikipedia.org/wiki/Internet_of_things#Manufacturi...
- mschuster91 9y agoYeah but then expose to it at least with a VPN... doesn't even have to be a Cisco ASA, a simple box with OpenVPN on it is sufficient - hell, as long as you're not doing heavy traffic on it a $20 throwaway router can do this.
- adrianN 9y agoA VPN doesn't help very much if the computer you use to log in is compromised. If security were as simple as putting everything behind a VPN there would be far fewer problems.
- mschuster91 9y agoYeah but the stuff at least doesn't show up on Shodan for everyone to grab/hack. You'd have to compromise exactly the right computer, drastically increasing the attack difficulty.
- AnIdiotOnTheNet 9y agoWhy do you assume that this isn't what happened in this case?
- InclinedPlane 9y agoThe internet is becoming the de facto way to connect anything. There's increasing automation, communication, and so forth between all these systems, and the internet is the way that's coordinated. But unfortunately the people taking these systems online don't always do so with the proper eye toward security rigor that is deserved. Sometimes that's down to a lack of expertise. Sometimes it's due to lack of resources or spending. Sometimes it's just because management folks refuse to listen to the professionals they've hired. In any event, it's a common problem even at the best of places. At organizations that lack a deep bench of current era IT/software talent (which is actually most organizations) it's very easy to make these mistakes. If you want to see how to do it right, look at slot machines. There is a crazy amount of oversight on those devices. In comparison, voting machines and our industrial infrastructure is just a huge game of grab-ass. Whatever goes, goes, until something bad happens and then people slowly learn one lesson.
- Kurtz79 9y agoIf I'm not mistaken, there is no mention in the article that the system was actually connected to the Internet. The Stuxnet attack (which as another commenter said was the real "watershed" event) managed to infect the target system even if it was air-gapped, by infecting the PC of someone that eventually connected to the private network of the target onsite. https://en.wikipedia.org/wiki/Stuxnet#Windows_infection https://en.wikipedia.org/wiki/Stuxnet#Windows_infection
- mcgarnagle 9y agoOkay, then really the comment should be renamed to why is critical infrastructure allow to be tampered with. Say this infection was brought in via hardware or bluetooth exploitation or wifi exploitation. None of those attack vectors should ever be accessible. No human working there should ever be able to "by accident" infect the system.
- tueo23094 9y agoThat's nice in theory, but perhaps you have to change the logic of that SIS. Perhaps some parts need to be decommissioned, or added to. A security hot patch is needed or a backup taken. There are thousands of reasons someone may need to connect to a system
- PeterisP 9y agoWhy do you assume that none of those attack vectors should ever be accessible? It's reasonable to assume that the systems need to exchange data with external systems on a daily basis, possibly on a real-time basis. They most likely need remote monitoring and reporting, they can need data that needs to be periodically inserted from an outside system, they might even need remote real-time control. Any such accessibility is a possible attack vector, and "security at all costs" isn't reasonable - even if the operation is literally priceless, you still need to balance the security risks of malicious attacks versus the increased risks of downtime or faults caused by more difficult/slower monitoring and control due to the security measures you implement; a strict airgap might prevent an attack but be a contributing factor in a non-malicious accident that's just as disastrous.
- michaelt 9y agoWhy are systems like this connected to the internet? Because there are some things that need to be safe; some things that need to be connected to other things; and some things that need to be on the internet. Consider an automated warehouse: https://www.youtube.com/watch?v=dAXdeqcHBp4 https://www.youtube.com/watch?v=dAXdeqcHBp4 Internet <-> Website <-> Stock control system <-> Stock inbound station <-> Conveyor control system <-> Emergency stop monitoring system It's possible to make such a system safe, of course. But a company making a web browser has their defences tested and their security spending validated by unceasing attack. The same resources might be hard to get in an industrial automation company if the higher-ups think "there hasn't been an attack, and they already have a firewall, a VPN and a virus scanner, whatever those are"
- mcgarnagle 9y agoYou don't make an online purchase when you open your tap to get a drink of water or flip on a switch for the lights. Some systems need to be on the internet. cool story, but, why would critical infrastructure such as this need to be is still unaddressed by your comment.
- pjc50 9y agoWith a smart meter, effectively you do.
- mcgarnagle 9y agono, you don't. When I activate a light switch and consume more power from the grid I am not directly adding more coal/fuel to the fire/generator. This is where the warehousing analogy breaks. Those numbers are looked at on aggregate to determine how much electricity needs to be produced to supply the population. They are directly tied into finance departments to generate your bill, sure, but that is an independent system from the production of electricity. In the case of water supply, same thing. Just because I turn on my tap doesn't mean I am directly affecting the water treatment plant to treat exactly 1 more cup of water today.
- 9y ago
- phkahler 9y ago>> Why are systems like this connected to the internet? For convenience. In business they call it "cost".
- AnIdiotOnTheNet 9y ago> There is no good reason for any of these devices to have a public IP address. That's a bold statement to make for someone who, I'm assuming, has absolutely no idea what these systems are or what the company wants to do with them. Security policy is super easy when you don't actually have to get anything done.
- deadmetheny 9y agoAs somebody who is responsible for security policy: there is no good reason for any of these devices to have a public IP address. Full stop. We did fine back when they weren't networked, we don't need to start now.
- AnIdiotOnTheNet 9y agoWhat do you know about these devices or the company's requirements? You're making a lot of assumptions because you're a know-it-all on the internet.
- deadmetheny 9y agoIf a safety system is on the Internet, it is no longer safe. I don't see why this is so hard for people to understand - if these things get hacked, best-case is a bunch of actual physical productivity is lost; worst-case is that people fucking die. You idiots don't stop to think about if you should do something, just because you can. Internal networks with an airgap are somewhat more acceptable, but the public Internet or accessible from a device that can be pivoted to is completely unacceptable.
- AnIdiotOnTheNet 9y agoAssumption made: the safety system mentioned had anything at all to do with the safety of human beings. For all we know, this is an entirely lights-out operation. From the article, it sounds more like these were systems designed to protect the equipment, which they did. A loss of productivity due to equipment failing or being destroyed has an associated cost. If that cost, factoring in the probability of that event, is less than the cost of not having these things remotely accessible (however that is determined), then the math is pretty clear about what choice you make. Even if humans are involved, that's just another cost to factor in. People get killed in work accidents all the time. This is the problem with "security people". Their only care in life is stopping attacks, so they don't give a damn what the cost is and how it relates to the rest of the organization. We take calculated risks every single day, and if we didn't, nothing would ever get done.
- tzs 9y ago> Why are systems like this connected to the internet? Probably a variety of reasons. Here's one. There was something I saw on my local PBS station that was about security and the electrical grid. They talked to some manager of a major power plant who had a phone app that could monitor that plant over the internet and pretty much completely control it. They talked about how this app came about. The manager decided it would be convenient so he could keep up on things when he was away at conferences and such. There were no security experts involved in writing this thing, or in analyzing what the risks were of adding outside internet access to the LANs that control systems were on. It was all as casual as you or I might make a phone app that can turn on our garage lights. The thought that there might be some danger in the control systems being directly accessible from the internet simply did not occur to anyone.
- ihsw2 9y agoAny network security authority worth their salt would tell this manager (and those like him) that "checking up on things" is a hopeless and useless endeavor. Like all log monitoring systems, only actionable items should be presented to end-users. Set thresholds on monitoring systems where the monitors trigger alarms when thresholds are outside of normal operating parameters. It's monitoring 101.
- pc86 9y agoThe saddest thing about this is that manager likely got a bonus, either directly (great initiative!) or indirectly (more hours micromanaging everything), when he should have gotten fired and found it impossible to get a job in the industry.
- nsnick 9y agoIt is usually a result of a fight between control system engineers and IT people. The IT people see an ethernet cable and think that they should control it and in order to do that they connect the two networks. There are ways to do it safely, like placing a database in a DMZ that the PLCs write to and have computers on the other side read from the database without ever connecting to the PLCs, but that requires expertise and a security mindset.
- r00fus 9y agoIs it wrong for me to want those IT folks reprimanded or reassigned? It's like they don't understand the first rule of Fight Club or something.