7 ms·

I have a Customer who uses this equipment (the Vedeer-Root gauges that the article describes) in unattended fueling stations. They moved from dial-up modems in

I have a Customer who uses this equipment (the Vedeer-Root gauges that the article describes) in unattended fueling stations. They moved from dial-up modems in the stations to Internet connections a couple of years ago (to facilitate modern credit card processing) and, at that time, the vendor who handles the tank gauges asked me to forward a port through each of the the stations' firewalls to the gauge. The idea that I was going to terminate a VPN in each station and accept no unsolicited traffic from the Internet was completely foreign to them. With that in mind, I'm not at all surprised by what rapid7 is reporting here. It's likely that those IP addresses where they're finding tank gauges also have other targets (like video surveillance systems, environmental monitoring systems, automated fire suppression systems) receiving Internet traffic on forwarded ports, too.

jauer 12y ago
This sort of thing happens everywhere. Grain dryers, wastewater treatment plants, etc. You get industry-specific vendors that believe their solution is opaque to anyone that hasn't received their specific training and they run loose. The end-user doesn't care because their expert in [whatever automation] tells them it has a password or proprietary protocol and can't be accessed without a program that's only given to trusted (industry) insiders.
- jrochkind1 12y ago
  > The end-user doesn't care because their expert in [whatever automation] tells them it has a password or proprietary protocol and can't be accessed without a program that's only given to trusted (industry) insiders. I doubt a discussion even gets that far. The end-user doesn't care because it works to do what they need, and they never even consider security.
- otakucode 12y ago
  There are some great presentations on YouTube from the Chaos Communication Congress and similar conferences about the abyssmal security of PLC-controlled industry stuff, including prisons. It is exactly as you say. They think their systems are too obscure for anyone to figure out. Of course, they hire the cheapest talent they can find to bang the things together in the first place and constantly look for ways to cut staff and replace developers and security personnel with newer (cheaper) people all the time, so they never end up with anything of any significant complexity. Even many places that think their networks are airgapped turn out not to be. In one prison discussed during one talk I watched, the prison had a commissary or something run by McDonald's... someone had connected to the commissaries Internet connection giving the Internet a direct route into all the insecure systems controlling the prison.

jauer 12y ago

This sort of thing happens everywhere. Grain dryers, wastewater treatment plants, etc. You get industry-specific vendors that believe their solution is opaque to anyone that hasn't received their specific training and they run loose. The end-user doesn't care because their expert in [whatever automation] tells them it has a password or proprietary protocol and can't be accessed without a program that's only given to trusted (industry) insiders.

jrochkind1 12y ago
> The end-user doesn't care because their expert in [whatever automation] tells them it has a password or proprietary protocol and can't be accessed without a program that's only given to trusted (industry) insiders. I doubt a discussion even gets that far. The end-user doesn't care because it works to do what they need, and they never even consider security.
otakucode 12y ago
There are some great presentations on YouTube from the Chaos Communication Congress and similar conferences about the abyssmal security of PLC-controlled industry stuff, including prisons. It is exactly as you say. They think their systems are too obscure for anyone to figure out. Of course, they hire the cheapest talent they can find to bang the things together in the first place and constantly look for ways to cut staff and replace developers and security personnel with newer (cheaper) people all the time, so they never end up with anything of any significant complexity. Even many places that think their networks are airgapped turn out not to be. In one prison discussed during one talk I watched, the prison had a commissary or something run by McDonald's... someone had connected to the commissaries Internet connection giving the Internet a direct route into all the insecure systems controlling the prison.