6 ms·

You're essentially you're willing to trade security of critical infrastructure (and potentially risk lives) for the convenience of being able to do your job fro

You're essentially you're willing to trade security of critical infrastructure (and potentially risk lives) for the convenience of being able to do your job from home.

rhodozelia 6y ago
The plant owners have made that call. Is a vpn secure? If Tesla can update the software in a fleet of vehicles remotely why can’t I update the software in a power plant?
- waste_monk 6y ago
  >The plant owners have made that call. Arguably it should not be up to the owner entity as to the security requirements they need to meet. At least down here in Australia we're in the process of legislative reforms that significantly expand both the scope of critical infrastructure (most of which is privately owned) and the responsibilities and requirements of critical infrastructure operators (in terms of risk management, security plans, mandatory reporting, etc.) >Is a vpn secure? Teamviewer (which I understand was the vector used in the water system breach) or a VPN that hasn't passed the extensive testing required of secure cryptographic devices is not acceptable. IF the industrial control systems were treated as a classified information system, were linked using an approved and properly managed [1] secure cryptographic device (on both sides e.g. back to a secure control centre, not to your house so you can work from bed), and generally had the rest of the protective elements (e.g. requiring personnel working on it to hold a SECRET or equivalent clearance proportionate with the value of the system) in place, that might be OK. But otherwise my position remains the same - it should not be remotely controllable via the internet. >If Tesla can update the software in a fleet of vehicles remotely why can’t I update the software in a power plant? That might brick some cars on-board computers or "only" kill perhaps a few dozen people before people caught on and it was recalled - still tragic, but small in the grand scheme of things. Critical infrastructure is called that because if it goes wrong it can harm or kill people on a vast scale, so it should be held to far higher standards. [1] e.g. keymat issued by whatever your equivalent to the NSA is e.g. our Australian Signals Directorate, and otherwise verified to be secure.
  - rhodozelia 6y ago
    I could imagine a malicious defect in Tesla firmware that would cause all Tesla vehicles on the road to make an aggressive manoeuvre that would most likely result in a crash at the same time. So I think the potential scale for death and injury With remotely updatable vehicle firmware is large. Can you recommend any VPNs that are up to the required standard for critical infrastructure? Although since the power plants I work on would struggle to kill even one person and damaging them would only cause financial hardship for the owner or an insignificant exceedanve of environmental regulations, so they must not be critical.
    - atoav 6y ago
      Wireguard is the thing I would use. The fact that non other than Linus Torvalds called wireguard "a piece of art" may or may not be a selling factor. It is small, lightweight, reliable and does what it is meant to do. It uses existing, trusted network tech in the right ways and due to the low complexity you reading the source code is an realistic option.
      - bennofs 6y ago
        Does wireguard support storing keys in a hardware device, so that the cannot easily be exfiltrated if the machine is compromised? You want that for security critical infrastructure.
        SXX 6y ago
        AFAIK implementation in Linux kernel not yet support any hardware-backed handshake, but it's mainly because WireGuard developers didn't consider code stable until March of 2020. But there are userspace implementations and I guess it's should be doable to make them talk to a hardware device.
    - waste_monk 6y ago
      >I could imagine a malicious defect in Tesla firmware that would cause all Tesla vehicles on the road to make an aggressive manoeuvre that would most likely result in a crash at the same time. So I think the potential scale for death and injury With remotely updatable vehicle firmware is large. It's pretty low risk AFAIK, generally cars infotainment and CAN bus are isolated, and I understand Tesla vehicles can't update while driving. Who knows, I'm not familiar with their architecture, but I'm not too worried about it. There are attacks but IIRC they rely on GPS spoofing, or tricking machine vision to cause the vehicle to swerve or accelerate, you can't just drive someone off a cliff over 4G (at least without implanting hardware into the car). >Can you recommend any VPNs that are up to the required standard for critical infrastructure? Approved devices vary by country, but this list is a decent example: https://www.ia.nato.int/niapc/Category/IP-Encryption_25 https://www.ia.nato.int/niapc/Category/IP-Encryption_25 Unfortunately it's hard to provide info when these kinds of products are not generally available for purchase outside of the defence community, and the user manuals and related documentation are themselves restricted. But generally speaking if it's acceptable for use with classified info then it should be adequate protection for critical infrastructure. >Although since the power plants I work on would struggle to kill even one person and damaging them would only cause financial hardship for the owner or an insignificant exceedanve of environmental regulations, so they must not be critical. They might be relatively harmless in isolation, but it could be really harmful if an attacker could compromise a dozen of these small plants and disable or destroy them at the same time so there's less reserve capacity in the grid to pick up the slack when you launch your main attack. You don't even need to have that big of an impact on industry or what have you, just causing a blackout on a hot day and killing a bunch of elderly people via heatstroke would whip people into a panic. Or perhaps an attacker would compromise one plant and use it as a vector to attack someone like you next time you connect, gain a pivot point via your workstation to set up a persistent backdoor and steal confidential documents and email so they know your schedules and organisational weaknesses, steal your VPN credentials and attack multiple power plants at once when it suits them, etc.
- TeMPOraL 6y ago
  > If Tesla can update the software in a fleet of vehicles remotely why can’t I update the software in a power plant? OTA updates to car firmware is widely considered to be a stupidly irresponsible idea. I don't think we should justify doing risky things by pointing at other people doing risky things, who only get away with that because of clout and regulatory wheels turning slowly.
  - HenryBemis 6y ago
    > OTA updates to car firmware is widely considered to be a stupidly irresponsible idea. On one hand, it opens the door to hacking, pushing a malicious update, etc (stuxnet much?). On the other hand, if it is never updated, then we will end up with a zombie network consisting of lightbulbs, fridges, and teapots (yes!) Edit: sorry I could not resist adding teapots (HTML error 418)
- Communitivity 6y ago
  I love the concept of an electric car. Self-driving not so much. OTA updates, and car security in general, is a joke it's so bad. Teslas are great cars in many ways, but cybersecurity is not one of those ways if you go by pentest reports. I stopped at listing five below, but there are quite a few more out there. https://www.forbes.com/sites/leemathews/2020/11/23/researchers-hacked-and-stole-a-tesla-model-x-in-just-minutes/?sh=fed6e1e5aa78 https://www.forbes.com/sites/leemathews/2020/11/23/researche... https://www.forbes.com/sites/daveywinder/2020/02/19/hackers-made-tesla-cars-autonomously-accelerate-up-to-85-in-a-35-zone/?sh=1fee92d17245 https://www.forbes.com/sites/daveywinder/2020/02/19/hackers-... https://electrek.co/2020/06/10/tesla-hacker-unlocks-performance-upgrade-acceleration-boost/ https://electrek.co/2020/06/10/tesla-hacker-unlocks-performa... https://www.zdnet.com/article/tesla-car-hacked-at-pwn2own-contest/ https://www.zdnet.com/article/tesla-car-hacked-at-pwn2own-co... https://insideevs.com/news/356769/video-tesla-model-3-hacked-spoofed/ https://insideevs.com/news/356769/video-tesla-model-3-hacked...
sellyme 6y ago
If there's an emergency at a power plant and you need the sysadmin to personally fix it, then that has the potential to be just as big of a safety issue as a malicious actor is. It's trading one form of security for another.
- vincnetas 6y ago
  I think this is even scarier, that there can de emergency where sysadmin should manualy fix it. There should be fallbacks and redundancies with muliple levels if this is realy a crytical system. These would should give enough time to transport whatever personnel you need on site to fix things.

You're essentially you're willing to trade security of critical infrastructure (and potentially risk lives) for the convenience of being able to do your job from home.

rhodozelia 6y ago

The plant owners have made that call. Is a vpn secure? If Tesla can update the software in a fleet of vehicles remotely why can’t I update the software in a power plant?

waste_monk 6y ago
>The plant owners have made that call. Arguably it should not be up to the owner entity as to the security requirements they need to meet. At least down here in Australia we're in the process of legislative reforms that significantly expand both the scope of critical infrastructure (most of which is privately owned) and the responsibilities and requirements of critical infrastructure operators (in terms of risk management, security plans, mandatory reporting, etc.) >Is a vpn secure? Teamviewer (which I understand was the vector used in the water system breach) or a VPN that hasn't passed the extensive testing required of secure cryptographic devices is not acceptable. IF the industrial control systems were treated as a classified information system, were linked using an approved and properly managed [1] secure cryptographic device (on both sides e.g. back to a secure control centre, not to your house so you can work from bed), and generally had the rest of the protective elements (e.g. requiring personnel working on it to hold a SECRET or equivalent clearance proportionate with the value of the system) in place, that might be OK. But otherwise my position remains the same - it should not be remotely controllable via the internet. >If Tesla can update the software in a fleet of vehicles remotely why can’t I update the software in a power plant? That might brick some cars on-board computers or "only" kill perhaps a few dozen people before people caught on and it was recalled - still tragic, but small in the grand scheme of things. Critical infrastructure is called that because if it goes wrong it can harm or kill people on a vast scale, so it should be held to far higher standards. [1] e.g. keymat issued by whatever your equivalent to the NSA is e.g. our Australian Signals Directorate, and otherwise verified to be secure.
- rhodozelia 6y ago
  I could imagine a malicious defect in Tesla firmware that would cause all Tesla vehicles on the road to make an aggressive manoeuvre that would most likely result in a crash at the same time. So I think the potential scale for death and injury With remotely updatable vehicle firmware is large. Can you recommend any VPNs that are up to the required standard for critical infrastructure? Although since the power plants I work on would struggle to kill even one person and damaging them would only cause financial hardship for the owner or an insignificant exceedanve of environmental regulations, so they must not be critical.
  - atoav 6y ago
    Wireguard is the thing I would use. The fact that non other than Linus Torvalds called wireguard "a piece of art" may or may not be a selling factor. It is small, lightweight, reliable and does what it is meant to do. It uses existing, trusted network tech in the right ways and due to the low complexity you reading the source code is an realistic option.
    - bennofs 6y ago
      Does wireguard support storing keys in a hardware device, so that the cannot easily be exfiltrated if the machine is compromised? You want that for security critical infrastructure.
      - SXX 6y ago
        AFAIK implementation in Linux kernel not yet support any hardware-backed handshake, but it's mainly because WireGuard developers didn't consider code stable until March of 2020. But there are userspace implementations and I guess it's should be doable to make them talk to a hardware device.
  - waste_monk 6y ago
    >I could imagine a malicious defect in Tesla firmware that would cause all Tesla vehicles on the road to make an aggressive manoeuvre that would most likely result in a crash at the same time. So I think the potential scale for death and injury With remotely updatable vehicle firmware is large. It's pretty low risk AFAIK, generally cars infotainment and CAN bus are isolated, and I understand Tesla vehicles can't update while driving. Who knows, I'm not familiar with their architecture, but I'm not too worried about it. There are attacks but IIRC they rely on GPS spoofing, or tricking machine vision to cause the vehicle to swerve or accelerate, you can't just drive someone off a cliff over 4G (at least without implanting hardware into the car). >Can you recommend any VPNs that are up to the required standard for critical infrastructure? Approved devices vary by country, but this list is a decent example: https://www.ia.nato.int/niapc/Category/IP-Encryption_25 https://www.ia.nato.int/niapc/Category/IP-Encryption_25 Unfortunately it's hard to provide info when these kinds of products are not generally available for purchase outside of the defence community, and the user manuals and related documentation are themselves restricted. But generally speaking if it's acceptable for use with classified info then it should be adequate protection for critical infrastructure. >Although since the power plants I work on would struggle to kill even one person and damaging them would only cause financial hardship for the owner or an insignificant exceedanve of environmental regulations, so they must not be critical. They might be relatively harmless in isolation, but it could be really harmful if an attacker could compromise a dozen of these small plants and disable or destroy them at the same time so there's less reserve capacity in the grid to pick up the slack when you launch your main attack. You don't even need to have that big of an impact on industry or what have you, just causing a blackout on a hot day and killing a bunch of elderly people via heatstroke would whip people into a panic. Or perhaps an attacker would compromise one plant and use it as a vector to attack someone like you next time you connect, gain a pivot point via your workstation to set up a persistent backdoor and steal confidential documents and email so they know your schedules and organisational weaknesses, steal your VPN credentials and attack multiple power plants at once when it suits them, etc.
TeMPOraL 6y ago
> If Tesla can update the software in a fleet of vehicles remotely why can’t I update the software in a power plant? OTA updates to car firmware is widely considered to be a stupidly irresponsible idea. I don't think we should justify doing risky things by pointing at other people doing risky things, who only get away with that because of clout and regulatory wheels turning slowly.
- HenryBemis 6y ago
  > OTA updates to car firmware is widely considered to be a stupidly irresponsible idea. On one hand, it opens the door to hacking, pushing a malicious update, etc (stuxnet much?). On the other hand, if it is never updated, then we will end up with a zombie network consisting of lightbulbs, fridges, and teapots (yes!) Edit: sorry I could not resist adding teapots (HTML error 418)
Communitivity 6y ago
I love the concept of an electric car. Self-driving not so much. OTA updates, and car security in general, is a joke it's so bad. Teslas are great cars in many ways, but cybersecurity is not one of those ways if you go by pentest reports. I stopped at listing five below, but there are quite a few more out there. https://www.forbes.com/sites/leemathews/2020/11/23/researchers-hacked-and-stole-a-tesla-model-x-in-just-minutes/?sh=fed6e1e5aa78 https://www.forbes.com/sites/leemathews/2020/11/23/researche... https://www.forbes.com/sites/daveywinder/2020/02/19/hackers-made-tesla-cars-autonomously-accelerate-up-to-85-in-a-35-zone/?sh=1fee92d17245 https://www.forbes.com/sites/daveywinder/2020/02/19/hackers-... https://electrek.co/2020/06/10/tesla-hacker-unlocks-performance-upgrade-acceleration-boost/ https://electrek.co/2020/06/10/tesla-hacker-unlocks-performa... https://www.zdnet.com/article/tesla-car-hacked-at-pwn2own-contest/ https://www.zdnet.com/article/tesla-car-hacked-at-pwn2own-co... https://insideevs.com/news/356769/video-tesla-model-3-hacked-spoofed/ https://insideevs.com/news/356769/video-tesla-model-3-hacked...

sellyme 6y ago

If there's an emergency at a power plant and you need the sysadmin to personally fix it, then that has the potential to be just as big of a safety issue as a malicious actor is. It's trading one form of security for another.

vincnetas 6y ago
I think this is even scarier, that there can de emergency where sysadmin should manualy fix it. There should be fallbacks and redundancies with muliple levels if this is realy a crytical system. These would should give enough time to transport whatever personnel you need on site to fix things.