26 ms·

Vulnerable industrial controls directly connected to Internet

145 points by wglb 9y ago

chaz6 9y ago
How do they know they aren't honeypots?
- paulie_a 9y ago
  Simple answer because they are not that clever
  - pmlnr 9y ago
    Speaking from experience, Siemens is the company where they ask you what is SQLite when you mention that a half-binary xml is not necessarily the best format these days.
    - CapacitorSet 9y ago
      That sounds weirdly familiar. (Hello S7 project files?)
      - pmlnr 9y ago
        Something related, still ACX.
- deleted 9y ago
  [deleted]
- michaelmcmillan 9y ago
  Never attribute to malice that which is adequately explained by stupidity.
donquichotte 9y ago
PLC manufacturers and the controls community in general is lagging behind technologically by twenty years. It is very frustrating for a security-minded, computer-literate controls engineer to work with decade old hardware and software. In a company I worked at, there were PLCs controlling sensitive processes, including heaters for welding plastic, connected to the company network via Modbus-over-TCP. A visitor with a guest access, nmap and pymodbus could read AND SET temperatures of any of the devices. A black hat could easily have started fires or leaked acid in our production floor.
- WillReplyfFood 9y ago
  <Rant> Worser still, they have even trouble adopting object orientation. The whole area is stagnant in a Win95 Programming kind of way. Its truly horrifying. Worser still, even the people producing the newer tools to allow for OO, do not really test these tools, so you develop in a environment where you are basically a beta tester on a budget (TC3 - looking at you). Nobody dares to move, to not break precious backwards compatability and devalue the experience of "experts" who for several generations simply did fall into every trap state-chart based design can provide. Means, every project runs into complexity walls at the end, there are no automatic proofers to check the state charts, there are no unit-tests (If i here the poor excuse -"But there is no hardware to test against" one more time). In my opinion, this industry is as ripe for disruption as it gets- if you can generate and update code from a high lvl object and process description here, and proof reliability and speed + allow for user-code - the industry would throw money at you. Half of the projects in this area are not ond budget and not on time. There is actually not even planning for that- just a factor, which usually is bigger then 2.0. Im so sick of the excuses. You cant compare conventional coding and PLC programming. Yeah, you cant, one moved forward and the other got stuck with the lowest common denominator - due to lots of non-software guys trying to get a food in. All these fb lego-players, with no clue what they do... </Rant>
  - rukenshia 9y ago
    Did you ever have the pleasure of working with Siemens' SCL? I found it very frustrating to use but overall a better experience than just using the lego blocks programming you usually see. Combined with your data blocks you could at least get some structure into your programs.
rukenshia 9y ago
It honestly doesn't surprise me that so many PLCs are exposed directly and are not up to date. Having worked in maintenance at a large factory where we directly worked with Siemens PLCs, nobody is really prepared to make their PLC secure. Most people handling and programming those PLCs do not have a deep understanding of "Internet of things" (in Germany, the term "Industrie 4.0" is used a lot) but management is happy to jump on that topic. You usually don't worry about anything other than the task your PLC is supposed to perform (we're in a factory after all and need to make money, so better do it quick). I don't think I can remember ever updating the firmware of any of our PLCs, most of them even rot in a storage room for a couple of years before even being put in use. Everything is connected to the local network for monitoring purposes and if it weren't for another department strictly managing our network I reckon there would be a lot more of them accessible directly from the internet.
sschueller 9y ago
That reminds me of VNC roulette. (http://5.230.225.107/ http://5.230.225.107/) It however appears to be offline but it isn't hard to create your own.
- jakecopp 9y ago
  I just read up on this, it's absolutely terrifying. So far the news stories seem to have shown unsecured x ray machines, farm equipment, cctv, maybe oil wells, bank computers, cashflow software, waste treatment plants, parking lot systems, petrol station storage tanks [1] and a Swiss water reservoir [1]. It shows everything wrong with the lack of incentives for security! [1]: https://securityledger.com/2016/03/vnc-roulette-feasts-on-insecure-industrial-control-systems/ https://securityledger.com/2016/03/vnc-roulette-feasts-on-in...
splike 9y ago
I wonder if this was in response to the top comment on this HN post from 3 days ago https://news.ycombinator.com/item?id=16237026 https://news.ycombinator.com/item?id=16237026
daemin 9y ago
I guess there have not been any large scale or very public attacks against these computers because the people that would do this would be an enemy of every state that has manufacturing. The disruption may be temporary as things would recover quickly, and the perpetrators would be hunted down by law enforcement and thrown into jail for a long time.
gjvc 9y ago
As mentioned in the article https://www.shodan.io/ https://www.shodan.io/ is in my book, the go-to site for this kind of thing. Anyone aware of any similar sites?
- iancarroll 9y ago
  https://censys.io/ https://censys.io/ is also very cool.
9214 9y ago
My graduate project at university was about air-gap malware, soft TEMPEST and hacking on industrial PLCs (S7-300, Stuxnet and all that :P). What terrified me most is not only the state of ICS nowadays (it's pretty much fucked), but also the fact that cyber-security vendors try to make a profit from that by shoving their products down the throats of scared managers. And what @donquchotte says is pretty much true - on facility there I practiced, all PLC were connected via TeamViewer to company network, passwords were written on stickers and slapped on monitors. They used Modbus over TCP, plain-text packets easily viewable with Wireshark. On the first day I accidentally broke my S7 because of wrongly uploaded configuration, it took them 3 days to find some special Siemens laptop to connect to this PLC and reset it. Also tried to play around with Metasploit and follow the work of Beresford [1,2], but the most trivial attack of mine was just flood on PLC's IP with random junk - it stopped responding to any commands. [1]: https://www.youtube.com/watch?v=33kouEKm0zo https://www.youtube.com/watch?v=33kouEKm0zo [2]: https://github.com/moki-ics/s7-metasploit-modules https://github.com/moki-ics/s7-metasploit-modules
- lima 9y ago
  The first time I tried to automate the S7-1200 web UI, it crashed hard when I sent a POST requests with an empty body. These things do not belong anywhere near the internet, patched or not.
  - daemin 9y ago
    Pretty much built for someone that knows exactly what they are doing. Like they've read the manuals cover-to-cover and taken an exam.
    - blincoln 9y ago
      An industrial control system that crashes when it receives an unexpected network request isn't built for someone that knows exactly what they are doing. It was built by someone who wanted to expend the minimum effort possible and make contingency-handling someone else's problem. This isn't just about hacking. A device that crashes hard when it receives a POST with an empty body may do the same thing if there's a physical glitch with its connection, or if a cosmic ray flips a bit somewhere. Devices that control industrial machinery should be more reliable than that. If this were a hobbyist project, or a toy, that would be one thing, but these are specialized devices that cost a lot of money. They're fragile liabilities that don't belong anywhere near a shared network.
deleted 9y ago
[deleted]
kuon 9y ago
What is the opinion on IPv6 on this kind of problem? I mean, IPv4 being often behind a NAT, I guess a LOT of devices that would be exposed are protected by a NAT. But in an IPv6 world where NAT is no longer required, don't you fear that a lot of device might get exposed? I know it will be impossible to scan the whole address space, but I am sure other means of discovering IPs will arise.
- w8rbt 9y ago
  You can use DNS and NTP to discover IPv6 nodes.
  - e12e 9y ago
    How does NTP fit? You mean listening for packets, or some kind of announce/resource broadcast that I'm not aware of?
- skgoa 9y ago
  Yeah, that's one of the known issues with IPv6. You can still use a NAT or better yet a firewall that blocks all direct traffic between the internet and internal nodes. You can also do things like assigning nodes a new IPv6 adress every 24h.
- zAy0LfpBZLC8mAC 9y ago
  NAT does not prevent inbound connections. A stateful packet filter does. Stateful packet filters work with both IPv4 and IPv6.
  - kuon 9y ago
    I know, but I meant how NAT with IPv4 was deployed by ISP (at least in europe), which is a single IP with all inbound connection blocked. I guess it will depend on how ISP will deploy IPv6, but where I saw it deployed, the ISP did not provide NAT by default and all allocated IP were routable and inbound traffic was not blocked.
    - 9y ago
arca_vorago 9y ago
I can speak first hand about this. You want to know what the real problem is? Cheap motherfucking executives and boards. Full stop. I was at one time a one man miracle show for a company that had 6 branch locations, and was supporting at any given time ~50 operational PLC's in the field, among other PLC's internally for other operations... Now, I've learned a lot about mistakes I've made, and I was never a perfect senior sysadmin, mostly because I wasn't playing the meeting room presentations/reports and politics game. So I'm not trying to make myself out to be perfect in any fashion. That said, when I requested a full time t2 person. Denied. Requested a full time t1 person. Denied. I literally had to poach some part timer who was sweeping floors and train them myself... which did nothing to alleviate my time crunch dealing with desktop users in order to tackle the substantial infrastructure security issues, which takes time and thought (did I mention it was an open office area, so good luck getting good thinking work done...) Requested contractor structured cabling job (just horizontal)... denied... Us sysadmins can secure this stuff, mostly through really good network policies and firewalls, etc, but if management is cost-cutting corners left and right and would rather hire some contractor-MSP type that does 1/4 the work at x3 the cost, while refusing to support internal IT teams with the tools and funding they need to get their job done properly, it's no fucking wonder insecure systems abound in the industrial world. This is managements problem, and until the public or others start punishing them for not seeing IT and security as an investment instead of just a janitorial cost-sink, it will continue to happen. That's the reason behind my last burnout. Now I'm happily on break pursuing my data science degree. I've been on the contractor side too, (dropped out of college after the Marine Corps to start an IT support company that is still alive today even after I left) so I've seen the inside of hundreds of companies, from fortune 500 oil to 20 man lawfirms, so I'm not just pulling this info from a couple of jobs. I saw it everywhere. A good CIO or CTO should be able to address many of the technical-political disconnects, but they hardly exist. Go try asking /r/sysadmin how many of them even get a real budget. Half the time they just have to "ask" and hope they were convincing enough that management approves. Usually to a CFO or CEO since the CTO/CIO doesn't exist. Oh, and of course they all want to immediately jump on the IoT bandwagon but still don't want to hire the people to get them out of their old technical debt, much less the new massive technical debt many IoT devices will bring! Don't even get me started on the "big data" issues IoT and many PLC type devices bring. edit: The key to the increase of this issue is the direct LTE connections on the PLC's, whereas you used to have a satcon to a router and everything was internal from there, that's less true these days. Even so, you still have issues with the security of that edge.
golergka 9y ago
> A 2013 attempt (attributed to Iranians) to "hack" a dam in upstate New York failed, largely because the dam's flood control systems had been broken for some time. This seems more like a satire than real world.
bluedino 9y ago
Put this crap all on a segregated network. It's how we did it 20 years ago, are people still making the same mistakes? Were firewalls not common even 30 years ago?
- pjc50 9y ago
  Segregated networks are hard, and usually end up punctured very quickly when someone wants remote access to the segregated system. Or builds a bridge using a system connected to both networks.
- snerbles 9y ago
  I'm an engineer for an industrial integrator. No matter how often we tell our customers to keep the industrial control networks separated, they'll still find ways to lazily screw their networks up. A couple years ago at a Fortune 100 company, I dealt with a WinCE panel that began randomly spewing millions of broadcast UPnP packets - enough to make Wireshark lag badly. Took us about fifteen minutes to find and unplug the offending item, and the recommended mitigation from Rockwell Automation was to just disable UPnP. No patch was available for a problem that's been known since about 2006 or so, on an HMI product that is still being sold today. Due to some terrible switch configurations on the part of the customer, the traffic made it out to the campus network and DoS'd most of their intranet servers. About 3,000 employees were sent home early for the day because none of them could read their email.
- snowwindwaves 9y ago
  How do the computers running the HMIs get security patches then? Only the most critical equipment would have a budget large enough to pay someone to put windows or linux updates on a USB and get all of the computers updated. I don't allow the HMI computers to access the internet, but then they remain unpatched. As an OEM I'm out of the picture once the plant is working.
upofadown 9y ago
It's hard to make money out of attacking stuff like this because you can't normally keep the system broken in a way that is easily fixable when the money shows up. Once you contact your victim they just fix whatever is broken and then ignore you. Industrial processes are unreliable enough that one extra outage might not make that much difference. It's kind of like making programs to run on Windows 95. You don't have to worry that much about making your program reliable because no one will notice a few extra crashes.
- hishnash 9y ago
  you could make indirect money by doing things like investing in some markets/betting on them to fail.
  - regularfry 9y ago
    "The market can stay irrational longer than you can stay solvent" is the traditional response to that.
- cryptonector 9y ago
  Making money is not the only possible motivation for exploiting vulnerable industrial systems, though of course as the other reply says, there are ways to make money indirectly anyways. First off, the damage to third parties might be extremely severe, especially in a targeted attack. Think of long-lasting power outages due to damaged equipment. Or think of environmental damage (e.g., suppose you got a nuclear power plant to vent radioactive gases, or worse, to have a meltdown). Second, the damage to the owners of the industrial facility might be severe even if not to third parties. Here the attacker might benefit if, e.g., they are a competitor or have shorted the victim's stock. The first case is of extreme interest to the public, don't you think? Let's not dismiss concerns about industrial security.
  - upofadown 9y ago
    Of course damage is bad but I was specifically addressing the apparent lack of interest from the criminal set. For your first case, you failed to provide a possible. motivation. I will assume "terrorism" as that seems to be brought up as a motivation for most everything these days. There is more than one problem with this. First, it is pretty much impossible to prove that an attack over the internet was actually carried out by any particular entity or even any entity at all. Things fail on their own. Second, it is usually easy to entirely prevent another attack. So no ongoing sense of vulnerability. For your second example, it has always been fairly easy to damage industrial infrastructure but there have been almost no attacks of this kind. Stock market movements are not that severe in the case of even serious catastrophe much less the sort of trivial problems you could cause by attacking industrial controllers on the net.
jboxee 9y ago
Is this related to this recent finding? https://news.ycombinator.com/item?id=16237026 https://news.ycombinator.com/item?id=16237026
snowwindwaves 9y ago
I would like to see some authentication and encryption in the communications protocols like modbus and ethernet IP. Could be as simple as entering the same phassphrase on the client and the server. If you don't have the passphrase your requests are dropped or you can't decrypt any packets you might get your hands on. I can't see why that wouldn't be achievable. Yes it would take some extra processing power on the PLCs and would generate a bit more heat. It would have to be implemented by Schneider and Rockwell, who have been pushing all responsibility for security to the network level. At least the latest schneider PLC, the m580, allows for requiring a password to connect using the programming software[0], and also some ability to restrict what client IPs can connect[1]. The m580 was released in the last two years, so everything prior to 2016 doesn't have those features and comes set up to allow anonymous upload of new firmware by TFTP. [0]: https://www.schneider-electric.ca/en/faqs/FA238215/ https://www.schneider-electric.ca/en/faqs/FA238215/ [1]: https://www.schneider-electric.com/en/faqs/FA282558/ https://www.schneider-electric.com/en/faqs/FA282558/
- jdblair 9y ago
  The problem with requiring a plaintext password is that it may slow down attacks when a device is simply connected to the open internet, but it is trivial to defeat in all other cases. Modbus RTU is broadcast, so you would just listen for the password. Modbus TCP can be defeated with ARP stuffing and man-in-the-middle attack (I've seen this automated for taking over SCADA systems). A better solution would be a shared symmetric key that is manually programmed into all devices. However, this complicates install and maintenance. Its a hard sell when your controls are installed by contractors paid by the hour. Pretty soon everyone is setting their 128-bit key to 0x12345678 so nobody forgets it during emergency maintenance.
  - snowwindwaves 9y ago
    Substitute passphrase in my post with shared symmetric key. It is still a string you have to enter on both ends. if the underlying mechanisms just work in every case except for key mismatch and give you a good error message in that case, requiring your contractors to enter the same string in two devices that they already have to program is going to be hard for them to justify as a great additional expense.
m3kw9 9y ago
I wouldn’t be surprised if there are some controllers work from home and use VNC to access controls!
scardine 9y ago
When I was younger I had this friend (cof, cof) who used to war-dial 0800 numbers (telephones beginning with 0800 are national toll free numbers in Brazil) looking for modem tones. The biggest share of toll free numbers with modem tones were fax machines and but many were 9600 baud terminal for some CLP. I guess these were remote maintenance accesses for isolated machinery - I wonder if people still do this (may be an updated version with 3G or 4G).

145 points by wglb 9y ago

chaz6 9y ago

How do they know they aren't honeypots?

paulie_a 9y ago
Simple answer because they are not that clever
- pmlnr 9y ago
  Speaking from experience, Siemens is the company where they ask you what is SQLite when you mention that a half-binary xml is not necessarily the best format these days.
  - CapacitorSet 9y ago
    That sounds weirdly familiar. (Hello S7 project files?)
    - pmlnr 9y ago
      Something related, still ACX.
deleted 9y ago
[deleted]
michaelmcmillan 9y ago
Never attribute to malice that which is adequately explained by stupidity.

donquichotte 9y ago

PLC manufacturers and the controls community in general is lagging behind technologically by twenty years. It is very frustrating for a security-minded, computer-literate controls engineer to work with decade old hardware and software. In a company I worked at, there were PLCs controlling sensitive processes, including heaters for welding plastic, connected to the company network via Modbus-over-TCP. A visitor with a guest access, nmap and pymodbus could read AND SET temperatures of any of the devices. A black hat could easily have started fires or leaked acid in our production floor.

WillReplyfFood 9y ago
<Rant> Worser still, they have even trouble adopting object orientation. The whole area is stagnant in a Win95 Programming kind of way. Its truly horrifying. Worser still, even the people producing the newer tools to allow for OO, do not really test these tools, so you develop in a environment where you are basically a beta tester on a budget (TC3 - looking at you). Nobody dares to move, to not break precious backwards compatability and devalue the experience of "experts" who for several generations simply did fall into every trap state-chart based design can provide. Means, every project runs into complexity walls at the end, there are no automatic proofers to check the state charts, there are no unit-tests (If i here the poor excuse -"But there is no hardware to test against" one more time). In my opinion, this industry is as ripe for disruption as it gets- if you can generate and update code from a high lvl object and process description here, and proof reliability and speed + allow for user-code - the industry would throw money at you. Half of the projects in this area are not ond budget and not on time. There is actually not even planning for that- just a factor, which usually is bigger then 2.0. Im so sick of the excuses. You cant compare conventional coding and PLC programming. Yeah, you cant, one moved forward and the other got stuck with the lowest common denominator - due to lots of non-software guys trying to get a food in. All these fb lego-players, with no clue what they do... </Rant>
- rukenshia 9y ago
  Did you ever have the pleasure of working with Siemens' SCL? I found it very frustrating to use but overall a better experience than just using the lego blocks programming you usually see. Combined with your data blocks you could at least get some structure into your programs.

rukenshia 9y ago

It honestly doesn't surprise me that so many PLCs are exposed directly and are not up to date. Having worked in maintenance at a large factory where we directly worked with Siemens PLCs, nobody is really prepared to make their PLC secure. Most people handling and programming those PLCs do not have a deep understanding of "Internet of things" (in Germany, the term "Industrie 4.0" is used a lot) but management is happy to jump on that topic. You usually don't worry about anything other than the task your PLC is supposed to perform (we're in a factory after all and need to make money, so better do it quick). I don't think I can remember ever updating the firmware of any of our PLCs, most of them even rot in a storage room for a couple of years before even being put in use. Everything is connected to the local network for monitoring purposes and if it weren't for another department strictly managing our network I reckon there would be a lot more of them accessible directly from the internet.

sschueller 9y ago

That reminds me of VNC roulette. (http://5.230.225.107/ http://5.230.225.107/) It however appears to be offline but it isn't hard to create your own.

jakecopp 9y ago
I just read up on this, it's absolutely terrifying. So far the news stories seem to have shown unsecured x ray machines, farm equipment, cctv, maybe oil wells, bank computers, cashflow software, waste treatment plants, parking lot systems, petrol station storage tanks [1] and a Swiss water reservoir [1]. It shows everything wrong with the lack of incentives for security! [1]: https://securityledger.com/2016/03/vnc-roulette-feasts-on-insecure-industrial-control-systems/ https://securityledger.com/2016/03/vnc-roulette-feasts-on-in...

splike 9y ago

I wonder if this was in response to the top comment on this HN post from 3 days ago https://news.ycombinator.com/item?id=16237026 https://news.ycombinator.com/item?id=16237026

daemin 9y ago

I guess there have not been any large scale or very public attacks against these computers because the people that would do this would be an enemy of every state that has manufacturing. The disruption may be temporary as things would recover quickly, and the perpetrators would be hunted down by law enforcement and thrown into jail for a long time.

gjvc 9y ago

As mentioned in the article https://www.shodan.io/ https://www.shodan.io/ is in my book, the go-to site for this kind of thing. Anyone aware of any similar sites?

iancarroll 9y ago
https://censys.io/ https://censys.io/ is also very cool.

9214 9y ago

My graduate project at university was about air-gap malware, soft TEMPEST and hacking on industrial PLCs (S7-300, Stuxnet and all that :P). What terrified me most is not only the state of ICS nowadays (it's pretty much fucked), but also the fact that cyber-security vendors try to make a profit from that by shoving their products down the throats of scared managers. And what @donquchotte says is pretty much true - on facility there I practiced, all PLC were connected via TeamViewer to company network, passwords were written on stickers and slapped on monitors. They used Modbus over TCP, plain-text packets easily viewable with Wireshark. On the first day I accidentally broke my S7 because of wrongly uploaded configuration, it took them 3 days to find some special Siemens laptop to connect to this PLC and reset it. Also tried to play around with Metasploit and follow the work of Beresford [1,2], but the most trivial attack of mine was just flood on PLC's IP with random junk - it stopped responding to any commands. [1]: https://www.youtube.com/watch?v=33kouEKm0zo https://www.youtube.com/watch?v=33kouEKm0zo [2]: https://github.com/moki-ics/s7-metasploit-modules https://github.com/moki-ics/s7-metasploit-modules

lima 9y ago
The first time I tried to automate the S7-1200 web UI, it crashed hard when I sent a POST requests with an empty body. These things do not belong anywhere near the internet, patched or not.
- daemin 9y ago
  Pretty much built for someone that knows exactly what they are doing. Like they've read the manuals cover-to-cover and taken an exam.
  - blincoln 9y ago
    An industrial control system that crashes when it receives an unexpected network request isn't built for someone that knows exactly what they are doing. It was built by someone who wanted to expend the minimum effort possible and make contingency-handling someone else's problem. This isn't just about hacking. A device that crashes hard when it receives a POST with an empty body may do the same thing if there's a physical glitch with its connection, or if a cosmic ray flips a bit somewhere. Devices that control industrial machinery should be more reliable than that. If this were a hobbyist project, or a toy, that would be one thing, but these are specialized devices that cost a lot of money. They're fragile liabilities that don't belong anywhere near a shared network.

deleted 9y ago

[deleted]

kuon 9y ago

What is the opinion on IPv6 on this kind of problem? I mean, IPv4 being often behind a NAT, I guess a LOT of devices that would be exposed are protected by a NAT. But in an IPv6 world where NAT is no longer required, don't you fear that a lot of device might get exposed? I know it will be impossible to scan the whole address space, but I am sure other means of discovering IPs will arise.

w8rbt 9y ago
You can use DNS and NTP to discover IPv6 nodes.
- e12e 9y ago
  How does NTP fit? You mean listening for packets, or some kind of announce/resource broadcast that I'm not aware of?
skgoa 9y ago
Yeah, that's one of the known issues with IPv6. You can still use a NAT or better yet a firewall that blocks all direct traffic between the internet and internal nodes. You can also do things like assigning nodes a new IPv6 adress every 24h.
zAy0LfpBZLC8mAC 9y ago
NAT does not prevent inbound connections. A stateful packet filter does. Stateful packet filters work with both IPv4 and IPv6.
- kuon 9y ago
  I know, but I meant how NAT with IPv4 was deployed by ISP (at least in europe), which is a single IP with all inbound connection blocked. I guess it will depend on how ISP will deploy IPv6, but where I saw it deployed, the ISP did not provide NAT by default and all allocated IP were routable and inbound traffic was not blocked.
  - 9y ago

arca_vorago 9y ago

I can speak first hand about this. You want to know what the real problem is? Cheap motherfucking executives and boards. Full stop. I was at one time a one man miracle show for a company that had 6 branch locations, and was supporting at any given time ~50 operational PLC's in the field, among other PLC's internally for other operations... Now, I've learned a lot about mistakes I've made, and I was never a perfect senior sysadmin, mostly because I wasn't playing the meeting room presentations/reports and politics game. So I'm not trying to make myself out to be perfect in any fashion. That said, when I requested a full time t2 person. Denied. Requested a full time t1 person. Denied. I literally had to poach some part timer who was sweeping floors and train them myself... which did nothing to alleviate my time crunch dealing with desktop users in order to tackle the substantial infrastructure security issues, which takes time and thought (did I mention it was an open office area, so good luck getting good thinking work done...) Requested contractor structured cabling job (just horizontal)... denied... Us sysadmins can secure this stuff, mostly through really good network policies and firewalls, etc, but if management is cost-cutting corners left and right and would rather hire some contractor-MSP type that does 1/4 the work at x3 the cost, while refusing to support internal IT teams with the tools and funding they need to get their job done properly, it's no fucking wonder insecure systems abound in the industrial world. This is managements problem, and until the public or others start punishing them for not seeing IT and security as an investment instead of just a janitorial cost-sink, it will continue to happen. That's the reason behind my last burnout. Now I'm happily on break pursuing my data science degree. I've been on the contractor side too, (dropped out of college after the Marine Corps to start an IT support company that is still alive today even after I left) so I've seen the inside of hundreds of companies, from fortune 500 oil to 20 man lawfirms, so I'm not just pulling this info from a couple of jobs. I saw it everywhere. A good CIO or CTO should be able to address many of the technical-political disconnects, but they hardly exist. Go try asking /r/sysadmin how many of them even get a real budget. Half the time they just have to "ask" and hope they were convincing enough that management approves. Usually to a CFO or CEO since the CTO/CIO doesn't exist. Oh, and of course they all want to immediately jump on the IoT bandwagon but still don't want to hire the people to get them out of their old technical debt, much less the new massive technical debt many IoT devices will bring! Don't even get me started on the "big data" issues IoT and many PLC type devices bring. edit: The key to the increase of this issue is the direct LTE connections on the PLC's, whereas you used to have a satcon to a router and everything was internal from there, that's less true these days. Even so, you still have issues with the security of that edge.

golergka 9y ago

> A 2013 attempt (attributed to Iranians) to "hack" a dam in upstate New York failed, largely because the dam's flood control systems had been broken for some time. This seems more like a satire than real world.

bluedino 9y ago

Put this crap all on a segregated network. It's how we did it 20 years ago, are people still making the same mistakes? Were firewalls not common even 30 years ago?

pjc50 9y ago
Segregated networks are hard, and usually end up punctured very quickly when someone wants remote access to the segregated system. Or builds a bridge using a system connected to both networks.
snerbles 9y ago
I'm an engineer for an industrial integrator. No matter how often we tell our customers to keep the industrial control networks separated, they'll still find ways to lazily screw their networks up. A couple years ago at a Fortune 100 company, I dealt with a WinCE panel that began randomly spewing millions of broadcast UPnP packets - enough to make Wireshark lag badly. Took us about fifteen minutes to find and unplug the offending item, and the recommended mitigation from Rockwell Automation was to just disable UPnP. No patch was available for a problem that's been known since about 2006 or so, on an HMI product that is still being sold today. Due to some terrible switch configurations on the part of the customer, the traffic made it out to the campus network and DoS'd most of their intranet servers. About 3,000 employees were sent home early for the day because none of them could read their email.
snowwindwaves 9y ago
How do the computers running the HMIs get security patches then? Only the most critical equipment would have a budget large enough to pay someone to put windows or linux updates on a USB and get all of the computers updated. I don't allow the HMI computers to access the internet, but then they remain unpatched. As an OEM I'm out of the picture once the plant is working.

upofadown 9y ago

It's hard to make money out of attacking stuff like this because you can't normally keep the system broken in a way that is easily fixable when the money shows up. Once you contact your victim they just fix whatever is broken and then ignore you. Industrial processes are unreliable enough that one extra outage might not make that much difference. It's kind of like making programs to run on Windows 95. You don't have to worry that much about making your program reliable because no one will notice a few extra crashes.

hishnash 9y ago
you could make indirect money by doing things like investing in some markets/betting on them to fail.
- regularfry 9y ago
  "The market can stay irrational longer than you can stay solvent" is the traditional response to that.
cryptonector 9y ago
Making money is not the only possible motivation for exploiting vulnerable industrial systems, though of course as the other reply says, there are ways to make money indirectly anyways. First off, the damage to third parties might be extremely severe, especially in a targeted attack. Think of long-lasting power outages due to damaged equipment. Or think of environmental damage (e.g., suppose you got a nuclear power plant to vent radioactive gases, or worse, to have a meltdown). Second, the damage to the owners of the industrial facility might be severe even if not to third parties. Here the attacker might benefit if, e.g., they are a competitor or have shorted the victim's stock. The first case is of extreme interest to the public, don't you think? Let's not dismiss concerns about industrial security.
- upofadown 9y ago
  Of course damage is bad but I was specifically addressing the apparent lack of interest from the criminal set. For your first case, you failed to provide a possible. motivation. I will assume "terrorism" as that seems to be brought up as a motivation for most everything these days. There is more than one problem with this. First, it is pretty much impossible to prove that an attack over the internet was actually carried out by any particular entity or even any entity at all. Things fail on their own. Second, it is usually easy to entirely prevent another attack. So no ongoing sense of vulnerability. For your second example, it has always been fairly easy to damage industrial infrastructure but there have been almost no attacks of this kind. Stock market movements are not that severe in the case of even serious catastrophe much less the sort of trivial problems you could cause by attacking industrial controllers on the net.

jboxee 9y ago

Is this related to this recent finding? https://news.ycombinator.com/item?id=16237026 https://news.ycombinator.com/item?id=16237026

snowwindwaves 9y ago

I would like to see some authentication and encryption in the communications protocols like modbus and ethernet IP. Could be as simple as entering the same phassphrase on the client and the server. If you don't have the passphrase your requests are dropped or you can't decrypt any packets you might get your hands on. I can't see why that wouldn't be achievable. Yes it would take some extra processing power on the PLCs and would generate a bit more heat. It would have to be implemented by Schneider and Rockwell, who have been pushing all responsibility for security to the network level. At least the latest schneider PLC, the m580, allows for requiring a password to connect using the programming software[0], and also some ability to restrict what client IPs can connect[1]. The m580 was released in the last two years, so everything prior to 2016 doesn't have those features and comes set up to allow anonymous upload of new firmware by TFTP. [0]: https://www.schneider-electric.ca/en/faqs/FA238215/ https://www.schneider-electric.ca/en/faqs/FA238215/ [1]: https://www.schneider-electric.com/en/faqs/FA282558/ https://www.schneider-electric.com/en/faqs/FA282558/

jdblair 9y ago
The problem with requiring a plaintext password is that it may slow down attacks when a device is simply connected to the open internet, but it is trivial to defeat in all other cases. Modbus RTU is broadcast, so you would just listen for the password. Modbus TCP can be defeated with ARP stuffing and man-in-the-middle attack (I've seen this automated for taking over SCADA systems). A better solution would be a shared symmetric key that is manually programmed into all devices. However, this complicates install and maintenance. Its a hard sell when your controls are installed by contractors paid by the hour. Pretty soon everyone is setting their 128-bit key to 0x12345678 so nobody forgets it during emergency maintenance.
- snowwindwaves 9y ago
  Substitute passphrase in my post with shared symmetric key. It is still a string you have to enter on both ends. if the underlying mechanisms just work in every case except for key mismatch and give you a good error message in that case, requiring your contractors to enter the same string in two devices that they already have to program is going to be hard for them to justify as a great additional expense.

m3kw9 9y ago

I wouldn’t be surprised if there are some controllers work from home and use VNC to access controls!

scardine 9y ago

When I was younger I had this friend (cof, cof) who used to war-dial 0800 numbers (telephones beginning with 0800 are national toll free numbers in Brazil) looking for modem tones. The biggest share of toll free numbers with modem tones were fax machines and but many were 9600 baud terminal for some CLP. I guess these were remote maintenance accesses for isolated machinery - I wonder if people still do this (may be an updated version with 3G or 4G).