4 ms·

Pipedream: ‘Swiss Army Knife’ for Hacking Industrial Control Systems

79 points by draugadrotten 5y ago

uuyi 5y ago
I’m still shocked at how much of this crap is connected to insecure networks. Last time I dealt with PLCs which were used on an test automation line was over 20 years ago. And they were airgapped and I actually had to fly to the customer site to update and qualify the software. Even the cross site stuff was tunnelled over private phone pairs. Surely even now that’s cheaper than connecting all the SCADA crap remotely and getting owned.
- goblinux 5y ago
  It’s not just the networks, it’s the devices themselves. There’s no concept of security with any of the older OT hardware. They’re basically appliances designed for a “trusted” network where all users are there to do the right thing. It’s almost a battlestar galactica kind of thing where we need these big systems but it’s really risky to have them fully networked and online
- LadyCailin 5y ago
  > Surely even now that’s cheaper Long term, definitely. However, we as a species seem to have lost (if we ever had) the ability to think about anything other than the next 3 months.
  - getrrriddooff 5y ago
    I agree, But: 'We as a species seem to have lost (if we ever had) the ability to think about anything other than the next 3 months of Netflix* [*Insert:'provided'.Onlineservice]", to speak for an average joe ^^ hint: > https://youtu.be/a1xmVjIHh1Y?t=193 https://youtu.be/a1xmVjIHh1Y?t=193 (-; weekendfeeling-regards
Karrot_Kream 5y ago
Zero trust networks can't come soon enough
- formerkrogemp 5y ago
  What exactly is a zero trust network supposed to do here?
  - goblinux 5y ago
    It would keep bad guys from being able to send commands to the ICS devices without authenticating to them first. Or if they’re trying to hijack the engineering workstations within the OT system it would prevent them from using th epic, the programming software to make the changes, or from communicating at all with the industrial endpoints
goblinux 5y ago
Fun fact - the original picture at the top of the article was the Allen-Bradley PLC-5/80, but the toolkit focused on Omron and Schneider and Codesys systems. https://web.archive.org/web/20220413195449/https://www.wired.com/story/pipedream-ics-malware/ https://web.archive.org/web/20220413195449/https://www.wired... I’ll bet someone at Wired got a phone call from AB’s lawyers This is going to be our reality for the next few decades as threat actors focus on new ways to wreak havoc or extract ransom from mid- and small-scale critical infrastructures (I.e., regional water plants, that one factory that keeps the whole town running, power grids, refineries, etc) This digital transformation/ IT-OT Convergence needs to happen, but it’ll be a bumpy ride Edit - I say mid and small scale users because the big ones will have the funding to properly secure themselves for the most part. Sure, we’ll see them get hit too but the smaller players I worry about most
- uuyi 5y ago
  The big guys have too many layers of staff between the security guys and reality from experience.
Sytten 5y ago
As a final year of university we built a system interacting with PLC and those systems are insecure by default. Usually the code is stored plaintext on the device if you can speak their protocol. Some of those devices are connected to the internet for remote management. We were tasked to build an IIoT (industrial iot) to interact more securely with them and package that in a UI for fleet management and real time data with grafana. You can interact with most of them using modbus (over ethernet for newer models) to read and write memory directy. On top of that they have a proprietary protocol that I actually started reverse engineering to do remote updates but never finished it. I am not aware of anything open source for it meaning people still need to use the vendor crappy windows only GUI tool to update firmware. i expect this APT implemented part of that protocol too to mess with the device.
- iancmceachern 5y ago
  Same with most medical devices
  - iancmceachern 5y ago
    And in fact many medical devices have these components in them (PLCs, OTS motion controllers, etc)
willis936 5y ago
I'm a big proponent of isolating control system networks. If someone has physical access to your facility then the game is already up. I also quite like the idea of control systems being entirely on FPGA. Don't let any part of your computer be the thing that can stop the state machine. That includes network connections and operating systems.
jimnotgym 5y ago
Side note. I have exceeded my monthly limit for Wired and before I bothered to work around that I thought I would see what a subscription would cost. $10 for year 1 apparently. I wondered if someone who subscribed can tell me if it is worth it in 2022
liketochill 5y ago
Where do I get this toolkit. Asking as someone with at least 100 Schneider PLCs, some dating back to the 90’s. Edit: it is only for codesys based plc, which for Schneider are small shitty ones not the big ones orchestrating the whole System. I wonder more about Schweitzer devices that use codesys

79 points by draugadrotten 5y ago

uuyi 5y ago

I’m still shocked at how much of this crap is connected to insecure networks. Last time I dealt with PLCs which were used on an test automation line was over 20 years ago. And they were airgapped and I actually had to fly to the customer site to update and qualify the software. Even the cross site stuff was tunnelled over private phone pairs. Surely even now that’s cheaper than connecting all the SCADA crap remotely and getting owned.

goblinux 5y ago
It’s not just the networks, it’s the devices themselves. There’s no concept of security with any of the older OT hardware. They’re basically appliances designed for a “trusted” network where all users are there to do the right thing. It’s almost a battlestar galactica kind of thing where we need these big systems but it’s really risky to have them fully networked and online
LadyCailin 5y ago
> Surely even now that’s cheaper Long term, definitely. However, we as a species seem to have lost (if we ever had) the ability to think about anything other than the next 3 months.
- getrrriddooff 5y ago
  I agree, But: 'We as a species seem to have lost (if we ever had) the ability to think about anything other than the next 3 months of Netflix* [*Insert:'provided'.Onlineservice]", to speak for an average joe ^^ hint: > https://youtu.be/a1xmVjIHh1Y?t=193 https://youtu.be/a1xmVjIHh1Y?t=193 (-; weekendfeeling-regards

Karrot_Kream 5y ago

Zero trust networks can't come soon enough

formerkrogemp 5y ago
What exactly is a zero trust network supposed to do here?
- goblinux 5y ago
  It would keep bad guys from being able to send commands to the ICS devices without authenticating to them first. Or if they’re trying to hijack the engineering workstations within the OT system it would prevent them from using th epic, the programming software to make the changes, or from communicating at all with the industrial endpoints

goblinux 5y ago

Fun fact - the original picture at the top of the article was the Allen-Bradley PLC-5/80, but the toolkit focused on Omron and Schneider and Codesys systems. https://web.archive.org/web/20220413195449/https://www.wired.com/story/pipedream-ics-malware/ https://web.archive.org/web/20220413195449/https://www.wired... I’ll bet someone at Wired got a phone call from AB’s lawyers This is going to be our reality for the next few decades as threat actors focus on new ways to wreak havoc or extract ransom from mid- and small-scale critical infrastructures (I.e., regional water plants, that one factory that keeps the whole town running, power grids, refineries, etc) This digital transformation/ IT-OT Convergence needs to happen, but it’ll be a bumpy ride Edit - I say mid and small scale users because the big ones will have the funding to properly secure themselves for the most part. Sure, we’ll see them get hit too but the smaller players I worry about most

uuyi 5y ago
The big guys have too many layers of staff between the security guys and reality from experience.

Sytten 5y ago

As a final year of university we built a system interacting with PLC and those systems are insecure by default. Usually the code is stored plaintext on the device if you can speak their protocol. Some of those devices are connected to the internet for remote management. We were tasked to build an IIoT (industrial iot) to interact more securely with them and package that in a UI for fleet management and real time data with grafana. You can interact with most of them using modbus (over ethernet for newer models) to read and write memory directy. On top of that they have a proprietary protocol that I actually started reverse engineering to do remote updates but never finished it. I am not aware of anything open source for it meaning people still need to use the vendor crappy windows only GUI tool to update firmware. i expect this APT implemented part of that protocol too to mess with the device.

iancmceachern 5y ago
Same with most medical devices
- iancmceachern 5y ago
  And in fact many medical devices have these components in them (PLCs, OTS motion controllers, etc)

willis936 5y ago

I'm a big proponent of isolating control system networks. If someone has physical access to your facility then the game is already up. I also quite like the idea of control systems being entirely on FPGA. Don't let any part of your computer be the thing that can stop the state machine. That includes network connections and operating systems.

jimnotgym 5y ago

Side note. I have exceeded my monthly limit for Wired and before I bothered to work around that I thought I would see what a subscription would cost. $10 for year 1 apparently. I wondered if someone who subscribed can tell me if it is worth it in 2022

liketochill 5y ago

Where do I get this toolkit. Asking as someone with at least 100 Schneider PLCs, some dating back to the 90’s. Edit: it is only for codesys based plc, which for Schneider are small shitty ones not the big ones orchestrating the whole System. I wonder more about Schweitzer devices that use codesys