3 ms·

The more interesting question is why is the industrial control computer connected to the internet. Shouldn't these things be on a separate network protected by

by Fuxy 12y ago

The more interesting question is why is the industrial control computer connected to the internet. Shouldn't these things be on a separate network protected by an air gap all the time? Having stuff that doesn't need internet access connected to the internet is like asking for trouble.

duaneb 12y ago
> why is the industrial control computer connected to the internet. My guess is remote monitoring.
- Fuxy 12y ago
  So what's wrong with a separate internet connection, network and a computer with all its USB ports glued up connecting trough a VPN to the facility computers. You can read all the stats off the screen. Slightly more insecure then complete isolation but i suspect still better then what they had.
  - waps 12y ago
    And that VPN would connect to ... the office network where everybody runs outlook ? Or does it connect to a set of machines that run ssh with passwords shared with forums on the internet ? This configuration, incidentally, is probably exactly what the factory was running. There are a number of things that are commonly brought up as solutions to security. VPN's, Anti-virus, IDS, disabling USB, nat, ... none of them are. The solution to security problems is knowing all possible interactions between your software and the outside world. If you don't, there is at least a good chance it can be hacked. Of course, not having to know all interactions, some would say, is the reason we have computers in the first place.
    - walterbell 12y ago
      The VPN could connect to a Qubes-isolated VM.
      - waps 12y ago
        I've worked for classified organisations and they don't do this, because it's unsafe. For instance that VM would have to be an http server to actually see the data, it would have to run on a managed (through sssh ?) host, ... I mean why not give it an output-only serial line instead (isolating control signals. NO error recovery, windowing, ... allowed) ? At that point it doesn't really matter what's on the other side. The point here is that in this way you can guarantee information only flows in one direction. Plus it's dead simple (it will malfunction and at that time there will be many, many voices saying it's too simple, but it's not). The system on the other end of the serial line can be as convenient an insecure as you want, because it's not trusted to be secure. Needless to say, in practice there's still considerations of redundancy, so there are multiple output systems sending data over different fiber paths to different destinations. But all of them have the RX pin connected to ground. There is lots of security hardware that does this. This is how it works. Network of trust. A trusts B to ... Software trusts hardware to ... Operator trusts hardware to ... Operator trusts software to ... you make an overview of this and then you scratch anything you can. Depending on the level of security required you accept varying levels of inconvenience.
        walterbell 12y ago
        Thanks for the reminder on one-way channels. Each situation is different, e.g. software-based systems can build upon hardware separation (including one-way data diodes), while retaining the option for software defenses to evolve in response to ever-changing threats. (PDF) Air Gaps: http://www.invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf http://www.invisiblethingslab.com/resources/2014/Software_co... DIY Fiber diode: http://www.synergistscada.com/building-your-own-data-diode-with-open-source-solutions/ http://www.synergistscada.com/building-your-own-data-diode-w...
joshvm 12y ago
That wouldn't necessarily solve the problem, if you look at what happened with stuxnet. Getting a USB stick into a domestic steel factory probably isn't hard. As another commentator said, these plants are designed to be operated by people who don't know the difference between a mouse and a keyboard. The systems must work perfectly 24/7. I've seen the legions of machines running XP because the legacy software runs on it and God forbid they upgrade to Windows 8. That said everything seemed pretty secure there, loads of IT red tape needed to get anything on the network.
- Fuxy 12y ago
  Well the usual solution to that is glue up the USB port or no USB stick is allowed to enter or leave the facility. This doesn't make it impossible to get access but it make it a hell of a lot more difficult. For one thing the hackers don't have direct access they need to rely on the virus to do the dirty work and cannot do intelligence gathering on what systems are being used that well either.

by Fuxy 12y ago

duaneb 12y ago

> why is the industrial control computer connected to the internet. My guess is remote monitoring.

Fuxy 12y ago
So what's wrong with a separate internet connection, network and a computer with all its USB ports glued up connecting trough a VPN to the facility computers. You can read all the stats off the screen. Slightly more insecure then complete isolation but i suspect still better then what they had.
- waps 12y ago
  And that VPN would connect to ... the office network where everybody runs outlook ? Or does it connect to a set of machines that run ssh with passwords shared with forums on the internet ? This configuration, incidentally, is probably exactly what the factory was running. There are a number of things that are commonly brought up as solutions to security. VPN's, Anti-virus, IDS, disabling USB, nat, ... none of them are. The solution to security problems is knowing all possible interactions between your software and the outside world. If you don't, there is at least a good chance it can be hacked. Of course, not having to know all interactions, some would say, is the reason we have computers in the first place.
  - walterbell 12y ago
    The VPN could connect to a Qubes-isolated VM.
    - waps 12y ago
      I've worked for classified organisations and they don't do this, because it's unsafe. For instance that VM would have to be an http server to actually see the data, it would have to run on a managed (through sssh ?) host, ... I mean why not give it an output-only serial line instead (isolating control signals. NO error recovery, windowing, ... allowed) ? At that point it doesn't really matter what's on the other side. The point here is that in this way you can guarantee information only flows in one direction. Plus it's dead simple (it will malfunction and at that time there will be many, many voices saying it's too simple, but it's not). The system on the other end of the serial line can be as convenient an insecure as you want, because it's not trusted to be secure. Needless to say, in practice there's still considerations of redundancy, so there are multiple output systems sending data over different fiber paths to different destinations. But all of them have the RX pin connected to ground. There is lots of security hardware that does this. This is how it works. Network of trust. A trusts B to ... Software trusts hardware to ... Operator trusts hardware to ... Operator trusts software to ... you make an overview of this and then you scratch anything you can. Depending on the level of security required you accept varying levels of inconvenience.
      - walterbell 12y ago
        Thanks for the reminder on one-way channels. Each situation is different, e.g. software-based systems can build upon hardware separation (including one-way data diodes), while retaining the option for software defenses to evolve in response to ever-changing threats. (PDF) Air Gaps: http://www.invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf http://www.invisiblethingslab.com/resources/2014/Software_co... DIY Fiber diode: http://www.synergistscada.com/building-your-own-data-diode-with-open-source-solutions/ http://www.synergistscada.com/building-your-own-data-diode-w...

joshvm 12y ago

That wouldn't necessarily solve the problem, if you look at what happened with stuxnet. Getting a USB stick into a domestic steel factory probably isn't hard. As another commentator said, these plants are designed to be operated by people who don't know the difference between a mouse and a keyboard. The systems must work perfectly 24/7. I've seen the legions of machines running XP because the legacy software runs on it and God forbid they upgrade to Windows 8. That said everything seemed pretty secure there, loads of IT red tape needed to get anything on the network.

Fuxy 12y ago
Well the usual solution to that is glue up the USB port or no USB stick is allowed to enter or leave the facility. This doesn't make it impossible to get access but it make it a hell of a lot more difficult. For one thing the hackers don't have direct access they need to rely on the virus to do the dirty work and cannot do intelligence gathering on what systems are being used that well either.