4 ms·

This sort of thing happens everywhere. Grain dryers, wastewater treatment plants, etc. You get industry-specific vendors that believe their solution is opaque

by jauer 12y ago

This sort of thing happens everywhere. Grain dryers, wastewater treatment plants, etc. You get industry-specific vendors that believe their solution is opaque to anyone that hasn't received their specific training and they run loose. The end-user doesn't care because their expert in [whatever automation] tells them it has a password or proprietary protocol and can't be accessed without a program that's only given to trusted (industry) insiders.

jrochkind1 12y ago
> The end-user doesn't care because their expert in [whatever automation] tells them it has a password or proprietary protocol and can't be accessed without a program that's only given to trusted (industry) insiders. I doubt a discussion even gets that far. The end-user doesn't care because it works to do what they need, and they never even consider security.
otakucode 12y ago
There are some great presentations on YouTube from the Chaos Communication Congress and similar conferences about the abyssmal security of PLC-controlled industry stuff, including prisons. It is exactly as you say. They think their systems are too obscure for anyone to figure out. Of course, they hire the cheapest talent they can find to bang the things together in the first place and constantly look for ways to cut staff and replace developers and security personnel with newer (cheaper) people all the time, so they never end up with anything of any significant complexity. Even many places that think their networks are airgapped turn out not to be. In one prison discussed during one talk I watched, the prison had a commissary or something run by McDonald's... someone had connected to the commissaries Internet connection giving the Internet a direct route into all the insecure systems controlling the prison.

4 ms·

This sort of thing happens everywhere. Grain dryers, wastewater treatment plants, etc. You get industry-specific vendors that believe their solution is opaque

by jauer 12y ago

jrochkind1 12y ago
> The end-user doesn't care because their expert in [whatever automation] tells them it has a password or proprietary protocol and can't be accessed without a program that's only given to trusted (industry) insiders. I doubt a discussion even gets that far. The end-user doesn't care because it works to do what they need, and they never even consider security.
otakucode 12y ago
There are some great presentations on YouTube from the Chaos Communication Congress and similar conferences about the abyssmal security of PLC-controlled industry stuff, including prisons. It is exactly as you say. They think their systems are too obscure for anyone to figure out. Of course, they hire the cheapest talent they can find to bang the things together in the first place and constantly look for ways to cut staff and replace developers and security personnel with newer (cheaper) people all the time, so they never end up with anything of any significant complexity. Even many places that think their networks are airgapped turn out not to be. In one prison discussed during one talk I watched, the prison had a commissary or something run by McDonald's... someone had connected to the commissaries Internet connection giving the Internet a direct route into all the insecure systems controlling the prison.