4 ms·
I have the schneider unity PLC programming software and was able to connect to about 12 out of 16 of the PLCs I tried that were shown on censys. of the ones I c
by snowwindwaves 9y ago
I have the schneider unity PLC programming software and was able to connect to about 12 out of 16 of the PLCs I tried that were shown on censys. of the ones I could connect to, two had 'security' enabled so that I couldn't see the program, but still could have stopped it from running or downloaded an entirely new program. 6 PLCs didn't have the program stored in them, so same situation. 4 PLCs I was able to download the program. One was a hydro electric power plant, one was some kind of food factory that used barley, and two were some kind of pumping stations, one of which had a bunch of logic for controlling pH and chlorine. The last modified date for all the programs was in the last 3 years.
None of the programs had any contact information for the programmer or the company that owned the infrastructure.
It is hard to believe people are still putting their plants straight on the internet. Anyone can control any of the outputs which then control real equipment like 200 kV circuit breakers and disconnects, turbines, valves, conveyors, mixers, pumps, etc. If interlocks are implemented in the software as opposed to electrically or mechanically then they can be bypassed which could easily result in equipment damage, injury to personnel, or death.
- bowmessage 9y agoCan you do a WHOIS lookup on the IP or hostname or anything? Sounds like some people really need to be warned?
- snowwindwaves 9y agothe IP addresses are registered to telecommunications companies since the controllers are at some remote plant that just has cable, DSL, cellular modem so the IP address is owned by Telus, Shaw, Comcast, TW, Verizon, etc. If there'd been any contact information in the programs I definitely would have gotten in touch
- AdamJacobMuller 9y agoIf you just turn them off, you'll probably find out whose they are when the FBI shows up.
- jstanley 9y agoIf you reported it to the telecoms companies they would surely be capable of forwarding the information on. Whether they would actually bother is another matter, of course.
- technion 9y agoI don't find this surprising. I've consulted for things like hotel groups. Without fail, there are vendors selling this sort of thing, with instructions like "forward telnet port from the internet to our device". You can try to push back, and sometimes you will be successful, but you can't blame a hotel manager for saying "well this is what they do for a living.. they would know best".
- Cthulhu_ 9y agoThat's fine as long as it's on paper; that way, the hotel (for example) can sue them and not be held liable in case of trouble. In theory anyway.
- hodl 9y agoIs what you did a crime?
- jv22222 9y agoI hope the writers of Mr. Robot are paying attention to what you just wrote ;)
- buildbuildbuild 9y agoPLEASE report this to ICS-CERT immediately. If you want a direct DHS contact email me. This is not something to sit on, and you can do a great service to the cybersecurity of our critical infrastructure. ics-cert@hq.dhs.gov https://www.us-cert.gov/report https://www.us-cert.gov/report
- snowwindwaves 9y agoI'm not American. I do like to travel the united states, but the last thing I need is to be labelled as a hacker in my profile when I cross the border and am greeted by the homeland security officers. DHS can use the Censys search engine and find all the PLCs will open modbus ports just as easily as anyone else in the world!
- buildbuildbuild 9y agoReport it anonymously. Knowing of vulnerable systems and intentionally NOT reporting them is also quite a label.
- snowwindwaves 9y agoI have no incentive. US-CERT should offer rewards. I'm not worried about labels on HN but I am concerned about what shows up on officer Wendy's screen when I want to enter the USA.