4 ms·

You wonder how many other internet connected things are exposed this way. I've always wondered if there are internet connected traffic light systems (I know mos

You wonder how many other internet connected things are exposed this way. I've always wondered if there are internet connected traffic light systems (I know most systems are ancient technology) are vulnerable in the same way.

tomswartz07 12y ago
They are. And some Wind Farms (windmill generators). http://shodanhq.com http://shodanhq.com Here's a fun search: http://www.shodanhq.com/search?q=Anonymous+access+granted http://www.shodanhq.com/search?q=Anonymous+access+granted
- jessaustin 12y ago
  That looks like FTP-type sites? What's the point?
  - tomswartz07 12y ago
    Sure, the link I had has FTP sites, with absolutely no login required. What can you do with an FTP site? Host your own phishing site. Modify the owner's own webpages. Related to this article: if you can narrow the addresses down to ones that also have these gas meters, then you can modify their website to say "Hey; free gas!" and mark their tanks as 'always full'. The key take-away here is that there is a literal TON of unsecured sites and multiple ways that something bad could be done.
herge 12y ago
I always laughed at the movie Live Free or Die Hard, but now I'm thinking it's more and more likely that hackers can completely bring down society from behind a keyboard.
ObviousScience 12y ago
A city with 50,000 compromised heaters drawing 1.5KW lets an attacker play with 75MW on the electric grid. (I just picked the middle value in a list of heaters; probably not a good estimate.) A moderate county (roughly 2 million people in 800,000 households) has about a 2400MW power supply. Compromising 6% of households' heaters would allow you to drive spikes on the order of 3% of the average power grid load (which includes things like business uses). With some targeting, you could probably get a larger influence on a localized portion of the grid. Somehow, I think attackers causing high-ish frequency noise (on the order of ~1 minute waves, or less) with 3% of the average power could cause problems for the electric grid.
achillean 12y ago
Yes, there are traffic lights on the Internet. See a bunch of examples here: http://money.cnn.com/gallery/technology/security/2013/05/01/shodan-most-dangerous-internet-searches/ http://money.cnn.com/gallery/technology/security/2013/05/01/...

tomswartz07 12y ago

They are. And some Wind Farms (windmill generators). http://shodanhq.com http://shodanhq.com Here's a fun search: http://www.shodanhq.com/search?q=Anonymous+access+granted http://www.shodanhq.com/search?q=Anonymous+access+granted

jessaustin 12y ago
That looks like FTP-type sites? What's the point?
- tomswartz07 12y ago
  Sure, the link I had has FTP sites, with absolutely no login required. What can you do with an FTP site? Host your own phishing site. Modify the owner's own webpages. Related to this article: if you can narrow the addresses down to ones that also have these gas meters, then you can modify their website to say "Hey; free gas!" and mark their tanks as 'always full'. The key take-away here is that there is a literal TON of unsecured sites and multiple ways that something bad could be done.

herge 12y ago

I always laughed at the movie Live Free or Die Hard, but now I'm thinking it's more and more likely that hackers can completely bring down society from behind a keyboard.

ObviousScience 12y ago

A city with 50,000 compromised heaters drawing 1.5KW lets an attacker play with 75MW on the electric grid. (I just picked the middle value in a list of heaters; probably not a good estimate.) A moderate county (roughly 2 million people in 800,000 households) has about a 2400MW power supply. Compromising 6% of households' heaters would allow you to drive spikes on the order of 3% of the average power grid load (which includes things like business uses). With some targeting, you could probably get a larger influence on a localized portion of the grid. Somehow, I think attackers causing high-ish frequency noise (on the order of ~1 minute waves, or less) with 3% of the average power could cause problems for the electric grid.

achillean 12y ago

Yes, there are traffic lights on the Internet. See a bunch of examples here: http://money.cnn.com/gallery/technology/security/2013/05/01/shodan-most-dangerous-internet-searches/ http://money.cnn.com/gallery/technology/security/2013/05/01/...