8 ms·
State of Industrial Control Systems in Poland and Switzerland
- statictype 7y agoUgh. None of the industrial protocols like Bacnet or modbus have any built in security so this looks pretty bad
- nikomen 7y agoAgreed. These protocols are difficult to secure. However, it shouldn't be difficult to isolate devices from the internet. Isolation doesn't protect against inside attackers or an external use from causing trouble after getting into the network. It should be obvious these devices shouldn't have access to the internet.
- statictype 7y agoRight. Even internally they should ideally be on their own subnet.
- nikomen 7y agoOrganizations using ICS equipment could use this tool to find their own systems that are accessible to the internet. However, I would imagine that companies that are responsible enough to perform checks like these hopefully already have procedures in place to prevent issues like this. I wonder if there's room to use this software to provide direct feedback to the organizations and let them know without being prosecuted?
- deleted 7y ago[deleted]
- foxrob92 7y agoI know someone who works in cybersecurity for an oil company, he uses shodan to double check if they have exposed anything to the big scary internet.
- ryacko 7y agoIt depends on Polish law, and how likely they would attempt to prosecute you for a polite letter mailed to them.
- achillean 7y agoShodan actually has a service that will notify you when it discovers a public industrial control system: https://monitor.shodan.io https://monitor.shodan.io Shodan Monitor is to the Internet as Google Alerts is for the web. And the membership (one-time payment of $49 for a lifetime upgrade) lets you monitor up to 16 IPs. Disclaimer: I'm the founder of Shodan.
- nickpsecurity 7y agoHave you noticed any significant change as part of your work with Shodan? If you contact them, do the organizations even do fixes at a steady rate? What's the situation?
- achillean 7y agoWe've had great success working through other CERTs and enterprise customers that have existing relationships with affected customers. Reaching out ourselves has been a mixed bag. For us, we have more success directly working with vendors and trying to make sure that moving forward devices are properly configured. And to let them know who's impacted so they can follow-up as part of their regular support services.
- bavell 7y agoI love how humble/modest your profile is ^_^
- Creationer 7y agoIsn't it the role of State Security/Defense Services to conduct these sort of scans, and notify companies of their vulnerability?
- TheRealPomax 7y agoIt is not. What made you think it was?
- TeMPOraL 7y agoPeople keep saying here and elsewhere that this is what the NSA was supposed to be about in the US. In Poland, every couple months I see news that our government/military is supposedly creating some sort of "cyber force". If one day they actually create it, I hope this kind of stuff will be its focus.
- ajuc 7y ago> In Poland, every couple months I see news that our government/military is supposedly creating some sort of "cyber force". All talk, nothing's done.
- noir_lord 7y agoThe NSA has a dual role, break other people’s stuff and secure the US govs stuff (in theory). They can (and have) act in an advisory capacity but they have no regularity authority to force companies to secure their shit. Now whether such an organisation should exist that’s an interesting question I guess. Over here in the UK we have a similar body. https://en.m.wikipedia.org/wiki/National_Cyber_Security_Centre_(United_Kingdom) https://en.m.wikipedia.org/wiki/National_Cyber_Security_Cent... As someone in the UK tech industry I’m not sure what they actually do on the ground.
- YjSe2GMQ 7y agoOne thing those are good for is being a call center for white hat hackers. I.e. if you find some holes you can report to those agencies, and they'll take it from there. I know that's what people that speak about their findings on CCC do.
- runciblespoon 7y ago“Everyone knows how fragile these systems are” How about not connecting your ICSs directly to the Internet?
- achillean 7y agoThe number of ICS directly connected to the Internet has grown 10% every year since we started tracking them at Shodan (https://exposure.shodan.io https://exposure.shodan.io) so even worse this is an increasing problem. This is a known issue in the security industry and has been for a while but fixing it is a hard problem. The other thing we've noticed is that people are putting the ICS devices on non-standard ports in an attempt to hide them from Internet crawlers. This means that there are people that know this is a bad idea and instead of putting it behind a VPN or something more secure they just decide to change ports and leave it at that.
- zhte415 7y ago> This is a known issue in the security industry and has been for a while but fixing it is a hard problem. I've never heard of Shodan, it seems like a valuable service and seems like you care. I'm not in the 'industrial control systems space', but am in an industry which is 'sensitive'. The 'last line of defence' is often audit. Are you able to reach out to auditors (Big4) and regulators and educate them on this service (audit often have a financial background, CPA etc, and it's rare to find an auditor with a deep technology understanding, and MBA programs, which a lot of company heads might have taken, tend to lack anything very information technology technically - basically finance rooted)? I'm thinking this could be a business development route for a valuable service; make it a win-win for them too.
- Tharkun 7y agoThis is mind boggling. Who installs these systems? Who maintains them? Surely this is supposed to be done by someone with at least a certain amount of clue? Enough clue not to hook up your insecure gear to the internet? No? I don't even get how this happens. Surely these things are not just plugged in to a modem? There has got to be some kind of LAN involved. If there is, then there should at least be an edge firewall. Or even a simple garden variety gateway with NAT, which would already prevent all of those open ports from being accessible. So what gives? Are people deliberately hooking this gear up to the internet, deliberately exposing ports without taking security into consideration? That is patently insane.
- TeMPOraL 7y ago> Surely this is supposed to be done by someone with at least a certain amount of clue? Enough clue not to hook up your insecure gear to the internet? No? The way I understand it (and what my brief experience in writing software for industrial use confirms), it's the usual: the people making purchase decision have little to no clue, which - in absence of regulations - allows companies selling these products and services to not care, employ people without clue, and/or purposefully trade off quality for sales points (think of how many pseudo-features you can add to a PLC once you hook it up to the cloud).
- tonyarkles 7y agoMy (not vast) experience with this stuff is that it’ll often get plugged directly into an LTE-Ethernet modem. Or, depending on the vintage of the equipment, the chain looks more like LTE-Ethernet modem connected to a “serial port concentrator” with Ethernet on one side and a bunch of serial ports on the other side. Sometimes the installers will turn on IP Whitelisting on the inbound ports, but sometimes that gets skipped.
- janci 7y agoI don't know about ICS, but CCTV cameras, HVAC controls, parking gates are too often installed by technicians with little to no IT knowledge. They ask the local IT to open port (ie. port forwarding) for remote management or servicing without knowing the implications. When offered a VPN they often refuse - they do not want or know how to use it.
- jacquesm 7y agoSCADA and industrial stuff are absolutely terrible. Plenty of places where relays will happily change state when you send alternating packets of all 0's and 1's via UDP. Anything from heating / cooling, building lights, alarm systems and industrial processes are wide open. This is definitely not limited to certain countries.
- mmaunder 7y agoThis illustrates something I'm worried about. Cyber as a battle space, and the extreme vulnerability of some countries negates some of the traditional strategic advantages that superpowers have had. That will rebalance in time. But I worry that for an up and coming power with a kick-ass cyberwarfare operation, there is no better time to start a war than right now.
- jorblumesea 7y agoOne saving grace is that if a cyber attack was bad enough, it would likely result in retaliation in the physical space, provided attribution could be proven. Superpowers generally have armed forces far superior to asymmetric attackers and would be able to inflict punitive damages far beyond the cost of the initial cyber attack. There is some deterrence against some of the worst attacks eg: knocking out a power grid. If you look at the pattern of really nasty cyber attacks against infrastructure and industry, they usually are the other way around. Stuxnet was the US attacking Iran, Ukraine was attacked by Russia.
- kernelPan1c 7y agoIndustrial control systems are experiencing the growing pains of letting go of older technology that was designed prior to security being much of a concern. ICS networks are often designed to be 'air gapped'. All too often the air gap is broken via a vpn into the network so that someone can RDP to a windows scada machine (that doesn't receive updates because it can't reach the internet itself).
- Roark66 7y agoThis whole submission looks like an ad for Shodan. For those who don't know. Shodan is a basically a search engine on top of a DB created by mass port scanning. If it sounds shoddy as fuck to you, you would be right. They basically managed to find few ISPs that disregard hundreds or possibly thousands of abuse notifications they must be receiving and they are monetising their find. No doubt someone will reply "but port scanning is not illegal", well walking from car to car and trying door-handles to see if any are open in a supermarket car park is also not illegal, but don't be surprised if you get a security guy's baton treatment if you're spotted doing that. My point is, it is not illegal, but it is also not acceptable. Don't believe me? Try to do a mass port scan on any normal ISP's connection. You'll be getting a phone call or a letter in the post to stop it soon or they will disconnect you. Same with AWS, Azure, Rackspace and any other reputable cloud provider. "Oh, but we provide a much needed service to companies that need to be notified if any unsecured devices pop up on their network" - they'll say. My answer to this is that there are hundreds if not thousands of WhiteHat scanning companies that will happily provide you with a scanning service if you prove you own the range. It is only Shodan that will preemptively scan everyone and then let people search their DB. This is basically equivalent to a script kiddie running nmap on 0.0.0.0/0. Seriously, this is not OK. Some ISPs that should be named and shamed for allowing this to be going on: SingleHop - a US based cloud provider CariNet Inc from San Diego - another small cloud provider M247 Europe - a Colo provider in Romania The above have been found to be hosing one or more of the servers that do the actual Shodan scanning. Servers are named censusX.shodan.io where X is a single digit. I suggest that everyone annoyed with Shodan's activity emails those service providers and tells them what they think about it.
- iofiiiiiiiii 7y agoHiding our heads in the sand only means that the vulnerabilities will not be fixed and that only especially crafty attackers (i.e. the most dangerous ones) can exploit them. We need more openness, not security based on someone's feelings of morality.
- Roark66 7y agoHow does Shodan promote openness? Anyone who wants to scan their own network can already do so with paid for and free tools. What this service does is, it scans your network whether you want it or not, then allows others to search for vulnerable hosts. It is a script kiddie wet dream come true service. Continuing my "trying door handles on cars or houses" analogy imagine there is a service that has people walking from car to car and from house to house covering whole cities. Then once it compiled a database of which houses/flats/cars tend to be unlocked it made a business out of selling access to that DB. Would you have no moral reservations about that? Almost everyone is for openness in matters of vulnerabilities in software so companies are forced to fix them, but still most 0day researches give heads up to the companies and shortly later mailing lists about the vulnerabilities they discover before they openly publish all the details including an example exploit. Therefore openness has widely accepted limits. Making a business out of selling information about third parties that are vulnerable is way past those limits.