4 ms·

Does smart-grid tech work any better than smart-home tech? So far most 'smart' tech hasn't had a good track record on security or reliability, certainly not at

Does smart-grid tech work any better than smart-home tech? So far most 'smart' tech hasn't had a good track record on security or reliability, certainly not at the level you would trust your major infrastructure to it.

penagwin 7y ago
Keep in mind most "smart home" technology is marketed at consumers who have no idea what SSL/TLS is (nore do many care sadly even though they should), and are meant to be as cheap as possible. While I have no clue what the security or reliability looks like in industrial applications, I would hope they evaluate their solutions with reliability in mind.
- mlaretallack 7y ago
  Most industrial application also done know or care what ssl/TLS is (however this is starting to change). I have had industrial control systems reboot by just doing an nmap scan.
  - raverbashing 7y ago
    This It's barely better than iot stuff. And some "older" systems probably still need NT4 to run (I mean, if you're lucky)
- andrewnicolalde 7y ago
  Hah. My hope died with the 30 ICS-CERT emails I’m bombarded with each day.
- tw04 7y ago
  >While I have no clue what the security or reliability looks like in industrial applications, I would hope they evaluate their solutions with reliability in mind. Keep hoping... The number of industrial systems deployed that are connected to the internet with the default passwords unchanged or no passwords is nauseating. https://threatpost.com/exposing-scada-systems-shodan-110910/74644/ https://threatpost.com/exposing-scada-systems-shodan-110910/...
  - penagwin 7y ago
    Serious question. I've been hearing about industrial applications/medical etc. having default passwords exposed on the internet for years. How have they not been exploited/fixed already? Shodan's made it clear for years, of course anybody can use zmap/masscan.
    - tw04 7y ago
      People that know the passwords are generally ethical. Plus the risk reward isn't there. Say you have a hack for a pacemaker and you kill 1000 people. Then what? Literally every nation on Earth will be looking for you and you will either rot in prison for life or be put to death. And if the wrong country gets you first there will likely be a lot of torture along the way. Without having hacked a database of patient to device mappings, it's not like you can ask for ransom.
      - lallysingh 7y ago
        Frame someone you don't like, short the vendor's stock, or separately hack a hospital to get the patient records. You don't even have to kill them for that, just a recordable, scary event. Also, you may already want someone in particular dead and are just looking for a vector. This seems almost untraceable.
      - penagwin 7y ago
        I've seen several talks where they demoed showing access to hydroelectric dams, etc. I'm thankfully not this person, but at a basic level I could see some bored teen turning off a dam just for fun. Honestly the only reason I don't is because it would be "wrong" to do, but the internet is full of people, it's certainly not a stretch that somebody would want to.
      - JoeAltmaier 7y ago
        It can happen by accident. Some teen has a bot that scans around bricking devices with weak security; bricks critical infrastructure.
sephamorr 7y ago
For the utilities, absolutely. The utilities have hard requirements of delivering power to all customers while maintaining grid and frequency stability, so the ability to shape demand and supply quickly is at least one very valuable knob.
jhayward 7y ago
Yes. The modern sensors and controls being built in to US electric transmission and distribution systems have resulted in a far better run grid: more stable, more reliable, more efficient, fairer, and enabling things like real-time market making which enables rapid improvement using new technologies such as grid storage batteries, etc. It does come with some vulnerabilities. I'm not sure what the best way forward on those is; I suspect this bill's effects, if any, will not result in a more resilient or less vulnerable grid system. Attackers will just find different leverage points to attack.
- ahje 7y ago
  Somewhat related anecdote: I live in the Finnish countryside, and since much of the power grid out here is still ancient, there are power outages rather often. However, if the power goes out, there's always something that tries to power everything back on automatically after exactly 30, 60, 120 and 240 seconds. If something's still wrong, the power will simply flick on and then off within a few seconds. If an outage lasts more than four minutes, it usually takes much longer to get it running again (I assume it's because it then triggers an alert that will be handled by a human operator). I would assume there's a lot of similar stuff going on in the US power grid, considering it's immense size what I suspect is a somewhat similar mix of new and very old equipment. And yes, surge protectors are mandatory here.
  - cesarb 7y ago
    > there's always something that tries to power everything back on automatically after exactly 30, 60, 120 and 240 seconds Sounds like a recloser, which tries a number of times to restore power under the assumption that most faults are transient (for instance, a branch falling in the wires and then sliding to the ground). After a set number of retries, it gives up and stays open; at that point, a human has to locate the fault, clear it (for instance, poking the fallen branch with a stick until it falls to the ground), and then tell the recloser to close the connection again.
    - ahje 7y ago
xvilka 7y ago
It is just because ICS/IoT vendors do not care/know a thing about cybersecurity. If you push security development practices, it should really improve the situation. Just prevent an access to the market until they pass the red team audit. Would surely motivate them enough.

penagwin 7y ago

Keep in mind most "smart home" technology is marketed at consumers who have no idea what SSL/TLS is (nore do many care sadly even though they should), and are meant to be as cheap as possible. While I have no clue what the security or reliability looks like in industrial applications, I would hope they evaluate their solutions with reliability in mind.

mlaretallack 7y ago
Most industrial application also done know or care what ssl/TLS is (however this is starting to change). I have had industrial control systems reboot by just doing an nmap scan.
- raverbashing 7y ago
  This It's barely better than iot stuff. And some "older" systems probably still need NT4 to run (I mean, if you're lucky)
andrewnicolalde 7y ago
Hah. My hope died with the 30 ICS-CERT emails I’m bombarded with each day.
tw04 7y ago
>While I have no clue what the security or reliability looks like in industrial applications, I would hope they evaluate their solutions with reliability in mind. Keep hoping... The number of industrial systems deployed that are connected to the internet with the default passwords unchanged or no passwords is nauseating. https://threatpost.com/exposing-scada-systems-shodan-110910/74644/ https://threatpost.com/exposing-scada-systems-shodan-110910/...
- penagwin 7y ago
  Serious question. I've been hearing about industrial applications/medical etc. having default passwords exposed on the internet for years. How have they not been exploited/fixed already? Shodan's made it clear for years, of course anybody can use zmap/masscan.
  - tw04 7y ago
    People that know the passwords are generally ethical. Plus the risk reward isn't there. Say you have a hack for a pacemaker and you kill 1000 people. Then what? Literally every nation on Earth will be looking for you and you will either rot in prison for life or be put to death. And if the wrong country gets you first there will likely be a lot of torture along the way. Without having hacked a database of patient to device mappings, it's not like you can ask for ransom.
    - lallysingh 7y ago
      Frame someone you don't like, short the vendor's stock, or separately hack a hospital to get the patient records. You don't even have to kill them for that, just a recordable, scary event. Also, you may already want someone in particular dead and are just looking for a vector. This seems almost untraceable.
    - penagwin 7y ago
      I've seen several talks where they demoed showing access to hydroelectric dams, etc. I'm thankfully not this person, but at a basic level I could see some bored teen turning off a dam just for fun. Honestly the only reason I don't is because it would be "wrong" to do, but the internet is full of people, it's certainly not a stretch that somebody would want to.
    - JoeAltmaier 7y ago
      It can happen by accident. Some teen has a bot that scans around bricking devices with weak security; bricks critical infrastructure.

sephamorr 7y ago

For the utilities, absolutely. The utilities have hard requirements of delivering power to all customers while maintaining grid and frequency stability, so the ability to shape demand and supply quickly is at least one very valuable knob.

jhayward 7y ago

Yes. The modern sensors and controls being built in to US electric transmission and distribution systems have resulted in a far better run grid: more stable, more reliable, more efficient, fairer, and enabling things like real-time market making which enables rapid improvement using new technologies such as grid storage batteries, etc. It does come with some vulnerabilities. I'm not sure what the best way forward on those is; I suspect this bill's effects, if any, will not result in a more resilient or less vulnerable grid system. Attackers will just find different leverage points to attack.

ahje 7y ago
Somewhat related anecdote: I live in the Finnish countryside, and since much of the power grid out here is still ancient, there are power outages rather often. However, if the power goes out, there's always something that tries to power everything back on automatically after exactly 30, 60, 120 and 240 seconds. If something's still wrong, the power will simply flick on and then off within a few seconds. If an outage lasts more than four minutes, it usually takes much longer to get it running again (I assume it's because it then triggers an alert that will be handled by a human operator). I would assume there's a lot of similar stuff going on in the US power grid, considering it's immense size what I suspect is a somewhat similar mix of new and very old equipment. And yes, surge protectors are mandatory here.
- cesarb 7y ago
  > there's always something that tries to power everything back on automatically after exactly 30, 60, 120 and 240 seconds Sounds like a recloser, which tries a number of times to restore power under the assumption that most faults are transient (for instance, a branch falling in the wires and then sliding to the ground). After a set number of retries, it gives up and stays open; at that point, a human has to locate the fault, clear it (for instance, poking the fallen branch with a stick until it falls to the ground), and then tell the recloser to close the connection again.
  - ahje 7y ago

xvilka 7y ago

It is just because ICS/IoT vendors do not care/know a thing about cybersecurity. If you push security development practices, it should really improve the situation. Just prevent an access to the market until they pass the red team audit. Would surely motivate them enough.