8 ms·

"Why is a wrench on the internet?!" Because we need to track critical bolt rundowns (generically called fasteners) and tool condition. That being said it does

by csours 3y ago

"Why is a wrench on the internet?!" Because we need to track critical bolt rundowns (generically called fasteners) and tool condition. That being said it doesn't need to be on the public internet, but it makes it a lot easier than setting up and managing a private network. I'm not defending putting this tool on the public internet, but its very normal to put all kinds of stuff on the network in a manufacturing plant.

ToucanLoucan 3y ago
> That being said it doesn't need to be on the public internet, but it makes it a lot easier than setting up and managing a private network. I'm sorry what? It's easier than setting up a portion of/separate LAN with no internet access? I mean, yes, in the strictest "lazy bastard" kind of way, sure. Can we not even ask that of businesses now? Sure Bosch should've secured these things, that's a given and they should be rightly held to the fire to fix them. But also like... wifi routers have been a household staple piece of equipment since like.. 2008? Depending where you live? And we still can't ask business operators to do even the most basic due diligence in setting up their environment, or at the least, hiring someone who can? This is like when you go to a restaurant and their access point is called Spectrum-Wifi-5G using WEP encryption with a password that's like, F8F023gX. Just well established that not a single fuck was given in doing this.
- csours 3y ago
  =) Have you ever worked in a manufacturing plant? Yes, the solution is TECHNICALLY very easy, but there's a bunch of gatekeepers that really slow things down. The solution to the problem in front of you is always technically very easy and clear, but there are always a tremendous number of problems to be solved in a production manufacturing environment.
  - ToucanLoucan 3y ago
    I mean, sure. But clearly they weren't solved. And if problems like this can't be solved then that points to larger organizational issues involved.
    - csours 3y ago
      > larger organizational issues It's always the incentives. Always.
  - Arrath 3y ago
    Not to mention how often things will effectively be set in stone once installed in the plant. How many utterly mission critical e.g. CNC machines are run by a miraculously still functional Gateway desktop running Windows 98 Plus, camouflaged under a few decade's accumulation of rusty shavings from the nearby lathe?
- netsharc 3y ago
  Maybe it needs the Internet to call home to check if you still have a valid license to screw... ;) - I should contact Bosch with this idea
  - freedomben 3y ago
    and don't forget that sweet sweet usage data that they can use and/or sell for marketing purposes. Knowing exactly what the customers do with your tool and when is nice...
fluoridation 3y ago
If it's a matter of tracking, it could still be done using a simple connector and some kind of base station. Presumably these things have batteries that need to be charged, so they need to be returned to some central location and connect by copper wires periodically one way or another. They don't need network connectivity to accomplish this.
- throwanem 3y ago
  The batteries connect to the charger, yes. The tool never does, and probably can't be physically plugged into anything for want of connectors. And what difference would it make, anyway? In exchange for massively complicating every aspect of the monitoring and control tasks, you're just interposing the need to infect the battery firmware in order to pop the tool. Do you imagine the battery will be secure when the tool is not?
  - fluoridation 3y ago
    You make the battery a simple storage device. It can't be infected any more than a piece of paper can be infected. Even if someone can write crap to the battery the tool won't care, since it just needs to write simple information to it, not execute anything. There are ways to solve the problem, it's just cheaper to make the tool an HTTP client and solve it on a server somewhere.
    - throwanem 3y ago
      Aside from assuming the secure firmware on the tool - and now, too, on the battery! - whose absence you were trying to solve a couple of posts ago, this sounds like a solid approach.
      - fluoridation 3y ago
        I've never seen anyone complain about the security of USB sticks (not at the firmware level anyway).
tw04 3y ago
Which is why we have air gapped OT networks. Critical systems like this shouldn’t even be reachable remotely. The slight convenience of remote troubleshooting isn’t worth it. Plus there are solutions out there to only temporarily and securely bridge the gap if it’s an absolute necessity.
- bagels 3y ago
  That won't save you if the attacker crosses the gap. Someone did this to Iran's centrifuge controllers.
- lisper 3y ago
  > Which is why we have air gapped OT networks. Which is why compromised USB thumb drives are a thing. https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet
  - tw04 3y ago
    You're talking about a several orders of magnitude difference in attack vector. Yes, a motivated nation-state actor willing to put literally ALL of their resources into attacking you will probably find a way to get it done whether through cyber-attack or just dropping a bomb on your head. Air-gapping your OT network protects the average company from 99.99999% of threat actors. If you're attempting to create nuclear weapons and a western nation is trying to stop you, you're either going to be compromised or murdered. That doesn't mean Bob's metal stamping should put the IOT controllers for his steel presses onto the public internet.
    - deleted 3y ago
      [deleted]
    - lisper 3y ago
      You are making a logical fallacy here. Inserting a compromised USB drive into an industrial environment is harder than a remote attack, but it's still not particularly hard. Just because there is a noteworthy case of such an attack being mounted by one nation-state against another doesn't mean that a state actor is required to mount such an attack.
Ekaros 3y ago
Tracking that x number of fasteners were correctly tightened to correct tolerances makes lot of sense for manufacturer. And having automatic tool makes it lot less likely that someone just fills paper or computer with right number. Point really is that they can prove it was done. And IIoT makes lot of sense. Having worked with such products. You can monitor remotely equipment and even do data analysis on the data to find patterns. A real use of machine learning. Not that it doesn't mean there shouldn't be very limited connection from singular or few gateway devices. And all of the other stuff stopping devices from connecting to and from internet...
- bashinator 3y ago
  I don't think anyone is arguing that getting usage metrics from your tools in a professional setting is a big value add. The argument is that it requires internet connectivity, a heavyweight client, and third-party cloud services. If you just want to track basic metrics like torque and battery, stick an OpenTelemetry server on the wrench.
HumblyTossed 3y ago
> "Why is a wrench on the internet?!" You're subscription only allows 250 bolt twists. If you would like to upgrade your subscription, please visit www.wescrewyousoyoucancontinuetoscrewbolts.com
- Arrath 3y ago
  So that's why this one bolt was put somewhere with only enough clearance to get 1/32nd of a turn, to burn through my wrench subscription.
- malux85 3y ago
  You can get more bolt twists by enabling BoltTweet(tm) and connecting your social accounts. Every time a bolt turns more than 90 degrees BoltTweet(tm) will let all your friends and family know JUST HOW MUCH YOU LOVE BOLTS.
  - deleted 3y ago
    [deleted]
- bluGill 3y ago
  There is good reason to only allow 250 twists - you need to recalibrate after that many twists, and this is expensive. I don't know how many twists you are allowed, 250 seems a bit low. People can die if calibration procedures are not followed. If the manufacture says 250 twists, then you follow that 250 or you will lose millions in court.
  - nsvd 3y ago
    People can die in many different cases - I think it should be up to the wrench owner to make this decision, and not the wrench seller (who collects money for calibrating wrenches).
    - Arrath 3y ago
      > I think it should be up to the wrench owner to make this decision, and not the wrench seller (who collects money for calibrating wrenches). That would depend on the accreditations involved, yeah? One would certainly hope that the manufacturer goes through a rigorous design and testing process to ensure that the recommended service/calibration interval is accurate and occurs before the tool wanders out of spec for whatever its intended task is. As the end user you should presumably be able to reasonably adjust that service interval but it should require a similarly rigorous and documented process to determine how much more you can open it up, not just squinting at the wind and saying "eh they over-engineered it so I think we can get 30% more use out of before calibration" That's where the accreditations and specs come in. If I'm torqueing down a new Ikea bookshelf, I really don't care. New tires at a chain shop? Middling, to the point that they don't over-ugga-dugga my lug nuts on and destroy the bolts. I'm gonna re-tighten them myself after a drive or two anyway. Bolts in a new airliner being tightened down at the plant? You bet I want that shit to be to-spec, and the tools, too.
karaterobot 3y ago
> Because we need to track critical bolt rundowns (generically called fasteners) and tool condition. Unpopular opinion: I'm not convinced we need internet connected wrenches for this. We may want or be excited about, e.g., monitoring torque with internet connected wrenches, but I'm not convinced we need them. This may be a scaling issue, related to being able to make things faster with less experience and oversight. I'm generally skeptical of the unintended consequences of scaling production like that, and it may be giving me a bias. But I stand by the statement that there is no fundamental requirement to make wrenches connect to the internet in order to manufacture sensitive equipment.
- iSnow 3y ago
  Strictly speaking, we don't need it. But there's real demand in the industry to use networked IoT devices wherever possible and harvest the data so you can do things like QC (hand an audit trail to your customer that all bolts have been tightened with the exactly right torque) or preventive maintenance. No one wants to fall back to non-networked ways of manufacturing.
  - bobim 3y ago
    I don’t see how this is working. The QC audit will just testify that a bolt, somewhere, has been tightened. Or we need nuts with chips that communicate with the wrench and the part it’s fastening.
    - bigbillheck 3y ago
      You'd also be logging time of tightening, location of the wrench (to some granularity), user of the wrench, and so on, and on the other side you'd be tracking the state of whatever it is you're building so you know where it is at all times and can cross-reference.
    - iSnow 3y ago
      You also track who tightened the bolt when with which torque (could be wrong if the machine is defective and that is exactly what you want to be able to audit). Some machines are even able to tell in which spatial position they were used - kind of a micro-GPS. Some trials are running with AR glasses that show the position of a bolt to the operator and also log the actions.
drzaiusapelord 3y ago
I feel like we're at some weird technological historical point where we have IoT everywhere but we aren't passwordless yet. So we're polluting our world with IoT devices like this but they ship with "admin/password" as the default and expect someone with some technical knowledge to secure it, with the blessings of management who takes security seriously. In many organizations they have either one of these, or none of these. In people's homes, they have none of these. No one would care about IoT wrenches if they forced some app-based auth with mfa. We only care because we can trivially exploit them. Companies like Bosch shipping these things insecure by default is the real problem. Near everything embedded does snmp 'public' with write options and very few devices force strong passwords or passwordless or force mfa. The embedded space is a mess and where computers were pre-2000. This it the classic "we invented cars before seatbelts and don't want to spend money on safety anyways," scenario. Regulation here is badly needed. The market won't fix this itself. Bosch isn't really hurt by this stuff. They can just blame operators, the same way Boeing blames pilots or airlines when their Max's crash or fall apart in the sky. This is a classic perverse incentive of capitalism at play here and now that politics has moved towards idealizing a low-regulatory environment, we're only going to see more awful scenarios like this.
- iSnow 3y ago
  Well, Boeing most certainly hurt itself. But in the case of Bosch, people won't die so the fallout would be less severe.
thisisnico 3y ago
Having worked in manufacturing IT, I can tell you that the security of shop floor systems is an afterthought. A lot of the systems are German based, and they are set in their ways when it comes to IT, they find something that works and they use that for a long time. This is good for reliability, but bad for security, because there is a lack of patching/updating/security infrastructure.
skeeter2020 3y ago
this is something I initially thought was a stupid IoT device, but this connectivity actually makes sense - just not their implementation, which is inexcusable.

by csours 3y ago

ToucanLoucan 3y ago

> That being said it doesn't need to be on the public internet, but it makes it a lot easier than setting up and managing a private network. I'm sorry what? It's easier than setting up a portion of/separate LAN with no internet access? I mean, yes, in the strictest "lazy bastard" kind of way, sure. Can we not even ask that of businesses now? Sure Bosch should've secured these things, that's a given and they should be rightly held to the fire to fix them. But also like... wifi routers have been a household staple piece of equipment since like.. 2008? Depending where you live? And we still can't ask business operators to do even the most basic due diligence in setting up their environment, or at the least, hiring someone who can? This is like when you go to a restaurant and their access point is called Spectrum-Wifi-5G using WEP encryption with a password that's like, F8F023gX. Just well established that not a single fuck was given in doing this.

csours 3y ago
=) Have you ever worked in a manufacturing plant? Yes, the solution is TECHNICALLY very easy, but there's a bunch of gatekeepers that really slow things down. The solution to the problem in front of you is always technically very easy and clear, but there are always a tremendous number of problems to be solved in a production manufacturing environment.
- ToucanLoucan 3y ago
  I mean, sure. But clearly they weren't solved. And if problems like this can't be solved then that points to larger organizational issues involved.
  - csours 3y ago
    > larger organizational issues It's always the incentives. Always.
- Arrath 3y ago
  Not to mention how often things will effectively be set in stone once installed in the plant. How many utterly mission critical e.g. CNC machines are run by a miraculously still functional Gateway desktop running Windows 98 Plus, camouflaged under a few decade's accumulation of rusty shavings from the nearby lathe?
netsharc 3y ago
Maybe it needs the Internet to call home to check if you still have a valid license to screw... ;) - I should contact Bosch with this idea
- freedomben 3y ago
  and don't forget that sweet sweet usage data that they can use and/or sell for marketing purposes. Knowing exactly what the customers do with your tool and when is nice...

fluoridation 3y ago

If it's a matter of tracking, it could still be done using a simple connector and some kind of base station. Presumably these things have batteries that need to be charged, so they need to be returned to some central location and connect by copper wires periodically one way or another. They don't need network connectivity to accomplish this.

throwanem 3y ago
The batteries connect to the charger, yes. The tool never does, and probably can't be physically plugged into anything for want of connectors. And what difference would it make, anyway? In exchange for massively complicating every aspect of the monitoring and control tasks, you're just interposing the need to infect the battery firmware in order to pop the tool. Do you imagine the battery will be secure when the tool is not?
- fluoridation 3y ago
  You make the battery a simple storage device. It can't be infected any more than a piece of paper can be infected. Even if someone can write crap to the battery the tool won't care, since it just needs to write simple information to it, not execute anything. There are ways to solve the problem, it's just cheaper to make the tool an HTTP client and solve it on a server somewhere.
  - throwanem 3y ago
    Aside from assuming the secure firmware on the tool - and now, too, on the battery! - whose absence you were trying to solve a couple of posts ago, this sounds like a solid approach.
    - fluoridation 3y ago
      I've never seen anyone complain about the security of USB sticks (not at the firmware level anyway).

tw04 3y ago

Which is why we have air gapped OT networks. Critical systems like this shouldn’t even be reachable remotely. The slight convenience of remote troubleshooting isn’t worth it. Plus there are solutions out there to only temporarily and securely bridge the gap if it’s an absolute necessity.

bagels 3y ago
That won't save you if the attacker crosses the gap. Someone did this to Iran's centrifuge controllers.
lisper 3y ago
> Which is why we have air gapped OT networks. Which is why compromised USB thumb drives are a thing. https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet
- tw04 3y ago
  You're talking about a several orders of magnitude difference in attack vector. Yes, a motivated nation-state actor willing to put literally ALL of their resources into attacking you will probably find a way to get it done whether through cyber-attack or just dropping a bomb on your head. Air-gapping your OT network protects the average company from 99.99999% of threat actors. If you're attempting to create nuclear weapons and a western nation is trying to stop you, you're either going to be compromised or murdered. That doesn't mean Bob's metal stamping should put the IOT controllers for his steel presses onto the public internet.
  - deleted 3y ago
    [deleted]
  - lisper 3y ago
    You are making a logical fallacy here. Inserting a compromised USB drive into an industrial environment is harder than a remote attack, but it's still not particularly hard. Just because there is a noteworthy case of such an attack being mounted by one nation-state against another doesn't mean that a state actor is required to mount such an attack.

Ekaros 3y ago

Tracking that x number of fasteners were correctly tightened to correct tolerances makes lot of sense for manufacturer. And having automatic tool makes it lot less likely that someone just fills paper or computer with right number. Point really is that they can prove it was done. And IIoT makes lot of sense. Having worked with such products. You can monitor remotely equipment and even do data analysis on the data to find patterns. A real use of machine learning. Not that it doesn't mean there shouldn't be very limited connection from singular or few gateway devices. And all of the other stuff stopping devices from connecting to and from internet...

bashinator 3y ago
I don't think anyone is arguing that getting usage metrics from your tools in a professional setting is a big value add. The argument is that it requires internet connectivity, a heavyweight client, and third-party cloud services. If you just want to track basic metrics like torque and battery, stick an OpenTelemetry server on the wrench.

HumblyTossed 3y ago

> "Why is a wrench on the internet?!" You're subscription only allows 250 bolt twists. If you would like to upgrade your subscription, please visit www.wescrewyousoyoucancontinuetoscrewbolts.com

Arrath 3y ago
So that's why this one bolt was put somewhere with only enough clearance to get 1/32nd of a turn, to burn through my wrench subscription.
malux85 3y ago
You can get more bolt twists by enabling BoltTweet(tm) and connecting your social accounts. Every time a bolt turns more than 90 degrees BoltTweet(tm) will let all your friends and family know JUST HOW MUCH YOU LOVE BOLTS.
- deleted 3y ago
  [deleted]
bluGill 3y ago
There is good reason to only allow 250 twists - you need to recalibrate after that many twists, and this is expensive. I don't know how many twists you are allowed, 250 seems a bit low. People can die if calibration procedures are not followed. If the manufacture says 250 twists, then you follow that 250 or you will lose millions in court.
- nsvd 3y ago
  People can die in many different cases - I think it should be up to the wrench owner to make this decision, and not the wrench seller (who collects money for calibrating wrenches).
  - Arrath 3y ago
    > I think it should be up to the wrench owner to make this decision, and not the wrench seller (who collects money for calibrating wrenches). That would depend on the accreditations involved, yeah? One would certainly hope that the manufacturer goes through a rigorous design and testing process to ensure that the recommended service/calibration interval is accurate and occurs before the tool wanders out of spec for whatever its intended task is. As the end user you should presumably be able to reasonably adjust that service interval but it should require a similarly rigorous and documented process to determine how much more you can open it up, not just squinting at the wind and saying "eh they over-engineered it so I think we can get 30% more use out of before calibration" That's where the accreditations and specs come in. If I'm torqueing down a new Ikea bookshelf, I really don't care. New tires at a chain shop? Middling, to the point that they don't over-ugga-dugga my lug nuts on and destroy the bolts. I'm gonna re-tighten them myself after a drive or two anyway. Bolts in a new airliner being tightened down at the plant? You bet I want that shit to be to-spec, and the tools, too.

karaterobot 3y ago

> Because we need to track critical bolt rundowns (generically called fasteners) and tool condition. Unpopular opinion: I'm not convinced we need internet connected wrenches for this. We may want or be excited about, e.g., monitoring torque with internet connected wrenches, but I'm not convinced we need them. This may be a scaling issue, related to being able to make things faster with less experience and oversight. I'm generally skeptical of the unintended consequences of scaling production like that, and it may be giving me a bias. But I stand by the statement that there is no fundamental requirement to make wrenches connect to the internet in order to manufacture sensitive equipment.

iSnow 3y ago
Strictly speaking, we don't need it. But there's real demand in the industry to use networked IoT devices wherever possible and harvest the data so you can do things like QC (hand an audit trail to your customer that all bolts have been tightened with the exactly right torque) or preventive maintenance. No one wants to fall back to non-networked ways of manufacturing.
- bobim 3y ago
  I don’t see how this is working. The QC audit will just testify that a bolt, somewhere, has been tightened. Or we need nuts with chips that communicate with the wrench and the part it’s fastening.
  - bigbillheck 3y ago
    You'd also be logging time of tightening, location of the wrench (to some granularity), user of the wrench, and so on, and on the other side you'd be tracking the state of whatever it is you're building so you know where it is at all times and can cross-reference.
  - iSnow 3y ago
    You also track who tightened the bolt when with which torque (could be wrong if the machine is defective and that is exactly what you want to be able to audit). Some machines are even able to tell in which spatial position they were used - kind of a micro-GPS. Some trials are running with AR glasses that show the position of a bolt to the operator and also log the actions.

drzaiusapelord 3y ago

I feel like we're at some weird technological historical point where we have IoT everywhere but we aren't passwordless yet. So we're polluting our world with IoT devices like this but they ship with "admin/password" as the default and expect someone with some technical knowledge to secure it, with the blessings of management who takes security seriously. In many organizations they have either one of these, or none of these. In people's homes, they have none of these. No one would care about IoT wrenches if they forced some app-based auth with mfa. We only care because we can trivially exploit them. Companies like Bosch shipping these things insecure by default is the real problem. Near everything embedded does snmp 'public' with write options and very few devices force strong passwords or passwordless or force mfa. The embedded space is a mess and where computers were pre-2000. This it the classic "we invented cars before seatbelts and don't want to spend money on safety anyways," scenario. Regulation here is badly needed. The market won't fix this itself. Bosch isn't really hurt by this stuff. They can just blame operators, the same way Boeing blames pilots or airlines when their Max's crash or fall apart in the sky. This is a classic perverse incentive of capitalism at play here and now that politics has moved towards idealizing a low-regulatory environment, we're only going to see more awful scenarios like this.

iSnow 3y ago
Well, Boeing most certainly hurt itself. But in the case of Bosch, people won't die so the fallout would be less severe.

thisisnico 3y ago

Having worked in manufacturing IT, I can tell you that the security of shop floor systems is an afterthought. A lot of the systems are German based, and they are set in their ways when it comes to IT, they find something that works and they use that for a long time. This is good for reliability, but bad for security, because there is a lack of patching/updating/security infrastructure.

skeeter2020 3y ago

this is something I initially thought was a stupid IoT device, but this connectivity actually makes sense - just not their implementation, which is inexcusable.