8 ms·
Hackers can infect network-connected wrenches to install ransomware
- adrian_b 3y agoSuccessfully including no less than 23 CVEs in a wrench must have required a lot of hard work for the software team at Bosch :-)
- csours 3y agoOne of the most famous software defects - Therac 25 - happened because of a transfer of medium. The software was embodied in a machine with physical controls, then the software was embodied in a machine with software controls only. The assumptions in each medium were very different. I wonder if something similar happened here. I imagine the requirements document didn't say anything about the public internet.
- alias_neo 3y agoI don't know much about the margins and volumes of this sort of industrial equipment, but, are they so low that nobody can hire a skilled team of software engineers to write proper code for this stuff? The UX is always trash, the security is non-existent, the smart-components are always low-spec and low quality (displays?). Is adding £5, £10, £100 to the cost of a unit to do it right going to hurt _that_ much? Genuinely, I don't understand. Surely one of these things costs at least 5 figures and are bought in multiples of tens or hundreds?
- deleted 3y ago[deleted]
- csours 3y ago> The UX is always trash Split agency problem - the person who buys it is not the person who uses it. (I am not a fish - Seth Godin) > nobody can hire a skilled team of software engineers to write proper code for this stuff? You see a huge company from the outside. From the inside it's a small team[0] in a cost center[1] who are always overworked. 0. https://www.bitsaboutmoney.com/archive/the-long-shadow-of-checks/ https://www.bitsaboutmoney.com/archive/the-long-shadow-of-ch... 1. https://swizec.com/blog/the-3-budgets/ https://swizec.com/blog/the-3-budgets/ ; https://news.ycombinator.com/item?id=38851051 https://news.ycombinator.com/item?id=38851051
- AnimalMuppet 3y agoIt's a small team in a company that still thinks it's a wrench company, not a software company.
- csours 3y ago"Why is a wrench on the internet?!" Because we need to track critical bolt rundowns (generically called fasteners) and tool condition. That being said it doesn't need to be on the public internet, but it makes it a lot easier than setting up and managing a private network. I'm not defending putting this tool on the public internet, but its very normal to put all kinds of stuff on the network in a manufacturing plant.
- ToucanLoucan 3y ago> That being said it doesn't need to be on the public internet, but it makes it a lot easier than setting up and managing a private network. I'm sorry what? It's easier than setting up a portion of/separate LAN with no internet access? I mean, yes, in the strictest "lazy bastard" kind of way, sure. Can we not even ask that of businesses now? Sure Bosch should've secured these things, that's a given and they should be rightly held to the fire to fix them. But also like... wifi routers have been a household staple piece of equipment since like.. 2008? Depending where you live? And we still can't ask business operators to do even the most basic due diligence in setting up their environment, or at the least, hiring someone who can? This is like when you go to a restaurant and their access point is called Spectrum-Wifi-5G using WEP encryption with a password that's like, F8F023gX. Just well established that not a single fuck was given in doing this.
- csours 3y ago=) Have you ever worked in a manufacturing plant? Yes, the solution is TECHNICALLY very easy, but there's a bunch of gatekeepers that really slow things down. The solution to the problem in front of you is always technically very easy and clear, but there are always a tremendous number of problems to be solved in a production manufacturing environment.
- ToucanLoucan 3y agoI mean, sure. But clearly they weren't solved. And if problems like this can't be solved then that points to larger organizational issues involved.
- usrusr 3y agoOuch. Did Boeing shares already see an uptick? Because that's what it looks like when torque wrenches systematically misread...
- cjs_ac 3y ago> Bosch officials emailed a statement that included the usual lines about security being a top priority. This is my new benchmark for quality journalism: calling out half-arsed boilerplate press releases. This requires a journalist who genuinely understands the story, which is exceptionally rare outside of industry-specific journals.
- toss1 3y agoYES— THIS is so important! Cudos to article author Dan Goodin!
- uncletammy 3y agoI sat next to this guy at a security conference once and it took everything in me not to fanboy out and annoy the hell out of him with questions abput his work. This guy should be the standard for journalists.
- nohackeratall 3y agoBreaking: Hacked Internet-connected wrenches lead to loose parts in Boeing airliners
- ThrowawayIP 3y agoHonestly, that would be the much more dangerous attack to a company that must meet torque specs for safety. You can throw out a torque wrench, recalling already produced products on the other hand... "We've hacked your torque wrenches since adoption & changed the torque values to deceive your Quality Control on random random bolts on random aircraft. Pay us ransom to tell you which fasteners on which products were changed or recall them all." Re-torquing every bolt on an aircraft would be ungodly expensive.
- Xirgil 3y agoPretty sure in this scenario they'd have to recall them all anyways, because regulators and the public would not trust hackers to accurately log and report every bolt they messed with.
- usrusr 3y agoI could easily imagine an email arriving at some public contact address "I'm in your wrenches, changing your torques, send 123 BTC to 45678 or else!" and some first level person just dismissing it incredulously, "yeah, right...", to the trash folder. Then when nice things do start to burn... not sure that I'd have the guts to remember if I was that first level person? But when bit ignored that threat would be easy to deal with, just get some indicator beam type torque wrenches and occasionally check what the dial tells you about the point the trigger-type triggers.
- hoosieree 3y agoDid Cory Doctorow write this? It seems almost too on-the-nose.
- cs702 3y agoMy immediate thought was, this reads like the start of a South Park episode. Except it's real. In many "smart" devices, including industrial wrenches, security is an afterthought. I wonder if we would be better off making manufacturers legally liable for selling utterly insecure, accessible-in-the-open devices.
- fortran77 3y agoAnd therefore, bolts on door plugs may not be tightened with the proper torque.
- robertlagrant 3y agoYour security is useless against someone with a remote-controlled wrench.
- userbinator 3y agoTorque wrenches don't need a computer at all. More complexity, more chances for things to go wrong. Combine that with Murphy's Law and this is what you get.
- KineticLensman 3y agoHow about recording whether Boeing 737 door plug restraining bolts have been correctly torqued?
- CyberDildonics 3y agohttps://www.amazon.com/ACDelco-ARM601-3-Digital-ft-lbs-Notification/dp/B004VYUQI2 https://www.amazon.com/ACDelco-ARM601-3-Digital-ft-lbs-Notif...
- kube-system 3y agoThat one has a computer too, just a more rudimentary one. And rather than entering the number automatically into the relevant records, it relies on the memory of the technician, which also may be error prone.
- CyberDildonics 3y agoIt isn't connected to the internet. Also how does the internet connected torque wrench know what bolt it is being used on? If you have different bolts, it wouldn't know. If you have only a single bolt, you could just use a single setting.
- kube-system 3y agoAnd network-connected wrenches aren't necessarily internet connected either. Back when I worked on critical infrastructure, we had a lot of networked machines that we simply air-gapped from the internet. > Also how does the internet connected torque wrench know what bolt it is being used on? I don't think most of them do, although this has been a focus area of some augmented reality tools. In most cases now, this is a task the technician has to do, regardless of the wrench they are using.
- aaronmdjones 3y agoBosch officials emailed a statement that included the usual lines about security being a top priority It seems Ars Technica have made a typo; should read "lies".
- retrac 3y ago> precise torque levels that are critical for safety and reliability This is why the thing is networked. Easier, more reliable, to pull that data (and then verify it was complied with) automatically from the network. In the most precision kind of work of that kind some decades ago, every bolt and hole would have a little sticker/tag on it, and there would be double-and triple-checked lists. And this is why the vulnerability is particularly alarming. An attacker who targeted and compromised a manufacturer using these could, I dunno, slightly alter all the bolts used on an airplane, in a very specific way, so it is prone to failure prematurely. These sorts of vulnerabilities have the same sort of potential for economic/national targets in a sophisticated (probably state-backed) attack, similar to that one which destroyed all those centrifuges in Iran: https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet
- Turing_Machine 3y ago> An attacker who targeted and compromised a manufacturer using these could, I dunno, specifically and slightly alter all the bolts used on an airplane, in a very specific way, so it is prone to failure prematurely. Hmmm... https://www.bbc.com/news/world-us-canada-67919436 https://www.bbc.com/news/world-us-canada-67919436
- retrac 3y agoSuch incidents happen every day in all kinds of products, for far more mundane reasons than anything malicious. Let's not get ahead of ourselves.
- troyvit 3y agoSome hack lawyer in charge of the Boeing 737 Max 9 is reading your comment right now and drooling. "It was the wrench's fault!"
- DeathArrow 3y agoI hope they won't be able to infect network-connected toilets, or that would be a disaster!
- 1970-01-01 3y ago>It’s unlikely that the vulnerabilities will ever come under mass exploitation. Did we forget about STUXNET? This IS very hard to do, but NOT unlikely.
- some_random 3y agoStuxnet was a more-or-less unprecedented operation against an extremely high value target, and while there have been other attacks against OT since then they've been a lot less sophisticated. It seems reasonable to rate the likelihood of mass exploitation here as unlikely, in fact that seems like an overstatement to me.
- latchkey 3y agoIf I was North Korea and I wanted to make a few BTC while simultaneously embarrassing North America production lines, this would be a great way to do it.
- dbttdft 3y agoOkay, well it turned out that the entrepreneurial yuppies in question failed to deliver on "it will just automatically do everything for you, we can't even define what, just everything". Now back to paper and human chain of command. Or we can keep pretending until the world's nukes can be remotely controlled by random people on the internet, you do you.
- Slava_Propanei 3y ago[dead]
- iSnow 3y agoI will never stop being amazed that producers of high-end networked IoT equipment do not hire a pen tester team for their products. It's brutally hard to get networked security right, so you should hire an external red team from time to time.
- lifeisstillgood 3y agoSo I doubt the market will Provide here. But there is a strong case for regulators / insurance firms - choose (at least one) small SoC, with hopefully solid open credentials - Define that as the “floor” for IoT devices. - run a minimal kernel on it, enough that anyone can easily extend - provide ten years worth of security patches and updates - provide helluva good test rig The people who built this were wrench engineers not nginix hackers - if their wrench cost 7p per unit more (but so did all the completion) do they mind as long as “that’s the standard way” Or am I dreaming?
- RecycledEle 3y ago"The more you over-tech thr plumbing, the easier it is to stop up the drain." --Scotty
- ajdude 3y agoDupe? https://news.ycombinator.com/item?id=38939581 https://news.ycombinator.com/item?id=38939581