2 ms·

>Twice, Dehghantanha has seen hackers break into a farm system and threaten to kill livestock — chickens in one case, cattle in another. And in about a third of

by 1970-01-01 4y ago

>Twice, Dehghantanha has seen hackers break into a farm system and threaten to kill livestock — chickens in one case, cattle in another. And in about a third of the investigations his team as conducted over the past year, he has found evidence that state-sponsored hackers from Russia, China, North Korea and Iran have figured out how to quietly gain access to a control system inside a farm. ... >For example, a hacker could gain control of a thermostat and threaten to turn up the heat and kill an entire flock of chickens. More info needed. Are they actually hacking into the HVAC and bricking it, or is a website getting popped and then a scary message is displayed? Or both? These are always separate systems with separate creds. Maybe this is the way farmers realize you don't use the same password for your s3 bucket and "prod" chicken barn thermostat.

cameron_b 4y ago
Speculation warning, since no devices were directly referenced... These setups use PLCs to control water circulation, ventilation actuators, augers, and the like. I've even seen Honey Bee feeding set up with PLC interfaces just because they're common and easy. But if they're on the internet with a dashboard, they are likely the "soft belly" as we've seen in lots of industrial ransomware incidents. I've worked in similar ( not the same sector ) automation control environments where the programmers involved live in time-crunch "copy-pasta, change the labels" environments and security is relegated to network models. How many control systems have been impacted by scope creep and are now on the network when they weren't initially? How many of those are on the internet because someone wanted access from their iPad? I'm fairly bothered that the only hope I have in some of the equipment I've worked on is that if it is accessible from the internet one day, it has far too many indistinguishable peers to be a "particular" target and it would take a lot of research to determine any value.
BenjiWiebe 4y ago
I've a neighbor who is a chicken farmer. The thermostat can be controlled remotely, so I suppose it's possible to hack it.

cameron_b 4y ago

Speculation warning, since no devices were directly referenced... These setups use PLCs to control water circulation, ventilation actuators, augers, and the like. I've even seen Honey Bee feeding set up with PLC interfaces just because they're common and easy. But if they're on the internet with a dashboard, they are likely the "soft belly" as we've seen in lots of industrial ransomware incidents. I've worked in similar ( not the same sector ) automation control environments where the programmers involved live in time-crunch "copy-pasta, change the labels" environments and security is relegated to network models. How many control systems have been impacted by scope creep and are now on the network when they weren't initially? How many of those are on the internet because someone wanted access from their iPad? I'm fairly bothered that the only hope I have in some of the equipment I've worked on is that if it is accessible from the internet one day, it has far too many indistinguishable peers to be a "particular" target and it would take a lot of research to determine any value.

BenjiWiebe 4y ago

I've a neighbor who is a chicken farmer. The thermostat can be controlled remotely, so I suppose it's possible to hack it.