3 ms·

> It's the embedded folks, who tell that it is not made for this. Really? If so, this is just a small minority of the embedded folks. Think of the whole "Int

by vog 9y ago

> It's the embedded folks, who tell that it is not made for this. Really? If so, this is just a small minority of the embedded folks. Think of the whole "Internet of Things" security mess, combined with a large part of "Industry 4.0". That's tons of embedded devices explicitly built to be connected to the Internet. If it were really the developers of those embedded devices who didn't want them to have Internet connection, they would never have been in charge to build those in the first place.

phkahler 9y ago
Traditional embedded systems used micro controllers. Or for plants they used PLCs for automation. People have been warning for years that connecting factory automation (or power plant control) to the network gave it an interface to the whole world. IT insisted that it would be on a subnet or in some other way "safe". And besides, no hackers in the PC space knew anything about the hardware and software in these systems. The world is converging to point where everything is just an SoC capable of running a full OS and applications. IoT is just marketing taking advantage of the capability.
dsfyu404ed 9y ago
>explicitly built Just because a network interface is part of the hardware design does not make it "explicitly built" for use on the internet. On the software side 99.999% of these products are a security mess and only manage to dodge that reputation because the market is so fragmented that automated ways to bypass the security on these devices with no fine tuning involved does not yet exist.
pjmlp 9y ago
Best of all, they tend to have mini web servers exposing device APIs, completely written in straight C code.
- kogepathic 9y ago
  > Best of all, they tend to have mini web servers exposing device APIs, completely written in straight C code. Well of course, that's what the 10 year old vendor SDK uses, why do extra work? /s The state of industrial/embedded security in general is so poor I'm surprised there aren't more stories like this coming out. To give a concrete example, the industrial world was using modbus since the late 1970s and when Ethernet came around in the 1980s someone thought "well let's just encapsulate modbus data in TCP" and thus was born ModbusTCP. Not a single thought was given to security. There's millions if not billions of dollars of industrial equipment using ModbusTCP today that cannot be secured without being replaced completely. I've yet to see anyone pushing a secure protocol to replace ModbusTCP in industrial environments. When a utility is hacked (not if) and the attackers get into the SCADA network, it's going to cause a bloodbath of epic proportions.

by vog 9y ago

phkahler 9y ago

Traditional embedded systems used micro controllers. Or for plants they used PLCs for automation. People have been warning for years that connecting factory automation (or power plant control) to the network gave it an interface to the whole world. IT insisted that it would be on a subnet or in some other way "safe". And besides, no hackers in the PC space knew anything about the hardware and software in these systems. The world is converging to point where everything is just an SoC capable of running a full OS and applications. IoT is just marketing taking advantage of the capability.

dsfyu404ed 9y ago

>explicitly built Just because a network interface is part of the hardware design does not make it "explicitly built" for use on the internet. On the software side 99.999% of these products are a security mess and only manage to dodge that reputation because the market is so fragmented that automated ways to bypass the security on these devices with no fine tuning involved does not yet exist.

pjmlp 9y ago

Best of all, they tend to have mini web servers exposing device APIs, completely written in straight C code.

kogepathic 9y ago
> Best of all, they tend to have mini web servers exposing device APIs, completely written in straight C code. Well of course, that's what the 10 year old vendor SDK uses, why do extra work? /s The state of industrial/embedded security in general is so poor I'm surprised there aren't more stories like this coming out. To give a concrete example, the industrial world was using modbus since the late 1970s and when Ethernet came around in the 1980s someone thought "well let's just encapsulate modbus data in TCP" and thus was born ModbusTCP. Not a single thought was given to security. There's millions if not billions of dollars of industrial equipment using ModbusTCP today that cannot be secured without being replaced completely. I've yet to see anyone pushing a secure protocol to replace ModbusTCP in industrial environments. When a utility is hacked (not if) and the attackers get into the SCADA network, it's going to cause a bloodbath of epic proportions.