Slashdot Mirror
Microsoft Worms Crash Ohio Nuke Plant, MD Trains
stieglmant writes "For everyone who thought the 'blackout of 2003' was bad, how about this, according to an article at SecurityFocus, and another article at The Register, 'The Slammer worm penetrated a private computer network at Ohio's Davis-Besse nuclear power plant in January and disabled a safety monitoring system for nearly five hours.'" Russell writes "Maryland MARC Train Service was shut down most of Wednesday morning due to what sounds like the MS-Blast worm or one of its variants. The local Baltimore news reports that the cause was a signal malfunction but CSX, whose communications system runs the tracks, has an article describing the shutdown as a result of 'a worm virus similar to those that have infected the systems of other major companies and agencies in recent days'. This indicates that the network that the train signaling stations are on is not protected by firewalls, at least to block ports 135 and 444 where the DCOM vulnerability is attacked. Wow, taken to the extreme, the exploitation of their systems could have caused a train collision and injury or death to hundreds of Maryland and Virginia commuters."
...should be fired. Why was the safety monitoring system on a nuclear power plant exposed, even indirectly, to the internet?
I can't say that I don't give a fuck. I've just run out of fuck to give.
I think the fault here is with the moron that managed and accepted the software in the first place. One of the first disclaimers all software companies make is that they do not gauruntee that they are suitable for life threatening situations. Who accepted this software? Who speced it? Who supervised their work and ensured that they were competent people to manage this type of work?
is why anybody still thinks that Windows is suitable for a production control environment. I can understand the pretty gui for someone's desktop, but (and I'm serious when I ask this) what kind of utter cretin would think to put Windows, or any Microsoft product, in a fucking nuclear power plant, completely un-fucking-protected from this sort of stuff?
It doesn't make sense. Use a Unix/Linux machine, make sure it has only the access level needed from the outside (maybe sshd running, maybe), and keep the thing patched.
Why is this rocket science? Why do people who are building nuke plants and rail lines not know any better?
Sorry for going off on a rant, but damn it, somebody needs to say it.
Do you have ESP?
This indicates that the network that the train signaling stations are on is not protected by firewalls, at least to block ports 135 and 444 where the DCOM vulnerability is attacked.
Actually, I suspect that someone unwittingly plugged an infected laptop into the network inside of the firewall.
I know that my company was brought down by one careless user on the VPN. The user in question was working from home and had not followed the company instructions/policy for installing zonealarm pro. The result was that they were infected while working at home over the cable modem and the infection then spread rapidly through the company via the VPN.
-aelfweld
I just submitted the same story, it will probably get rejected, so here's some more links:
The Washington Post is reporting that the Slammer worm crashed the computerized display panel which monitors the most crucial safety indicators (coolant systems, core temperature sensors, and external radiation sensors) at Ohio's Davis-Besse nuclear power plant in January. No serious problems occured, primarily because the plant has been offline for more than 1-1/2 years.
Davis-Besse is run by FirstEnergy, which many people feel may bear much of the responsibility for last weeks power blackout.
... and people will stop using Windows in critical systems where failure can have catastrophic results. The only thing Windows does reliably is fail. Whoever decides to run a nuclear plant's safety monitoring system or a civil rail's monitoring and safety system on a Windows platform should be dragged into the street, shot, burned, pissed on, disemboweled and then hanged.
People are morons.
The heat from below can burn your eyes out
Wow, taken to the extreme, the exploitation of their systems could have caused a train collision and injury or death to hundreds of Maryland and Virginia commuters.
Thats why trains have human engineers and brakes. It's why people should use good judgement and observation. If you approach an intersection, and see that the traffic lights in all directions are green, use your head and stop, because something's wrong. Of course this is impossible, theres a mechanical failsafe that will make all lights blink red if that happened - making a 4 way stop, similar mechanical fallbacks are employed in the railroads. This is all besides the point.
Techies tend to overestimate the role of technology in day to day life. MARC was shut down more because the clerks were having a hard time selling tickets, since they cant do simple math in their heads.
I don't need no instructions to know how to rock!!!!
in an environment like a nuclear power plant, why aren't there firewalls on all clients? i mean, network security in such an installation is about as important as it gets.
it's possible the vulnerability arose through someone accessing internet e-mail. but wall street firms regularly blacklist internet e-mail sites. they do that b/c they're regulated to ensure that proprieties are kept and people aren't defrauded. a nuke though--we're talking more than just dollars and cents here.
it may not be fully the fault of the admins.
ed
I don't care if you're running MS, Linux, or FreeBSD. That damn port should've been firewalled and the software should've been patched. What's scary is imagining what could've happened if someone intentionally tried to hack the power plant. Some terrorist cell could cause a nuclear meltdown without ever setting foot in the US.
-- Political fascism requires a Fuhrer.
That is a silly conclusion to come to. Presumably they're also implying the same about the power grid.
I have first-hand experience with Ontario Hydro's IT nework (now Hydro One's IT network ;) and I gotta say - they have firewalls up the wazoo. And this is the problem. They rely on border security. However, on networks as large as the ones being discussed, border security doesn't cut it. There are too many entry vectors. People reading email, people browsing the web, and oh my god people with laptops - the pain the pain.
So before you go thinking "they aren't even taking precautions that would have saved them! Fire them!" understand that it's *exactly* that attitude which caused the networks to go down in the first place - the common misconception the a firewall is a magic wand that will solve all their ills.
Border security does NOT cut it when you run insecure software on the inside, boys and girls. And you can take that to the bank.
Barclay family motto:
Aut agere aut mori.
(Either action or death.)
I'd love to see what the Linux community would say if some intravenous drug pump running an embedded version of Linux had a bug that caused it to fail and kill a patient?
They'd probably cry, 'But we already released a fix! They didn't install this patch, and this patch, and this patch, and then recompiled.'
Don't blame the software companies for the "sh*t quality" of their software, as you say--blame the system administrator who didn't install the already-available fixes or patches. That by far is your guilty party right there.
Karma: Excellent Birds (mostly as a result of listening to Laurie Anderson)
Perhaps the silliest quote from the article:
CSXT has confronted increasingly sophisticated computer viruses, like ones that have penetrated some of the most secure sites in the country in recent days.
Sorry, but they're obviously not "some of the most secure sites in the country". If they were, they wouldn't have been penetrated like this. How can I say this? Because my company didn't get penetrated.
I'm afraid of sounding like a broken record here, because if anyone looks at my past posting history they'll see I've said exactly the same thing. However, the fact is we have mission-critical 24/7/365 servers running Windows (as well as Linux) that simply can not be vulnerable. So we secure them, and we protect them, and put in safeguards, and work together as a team if there is a particularly nasty threat out there...and we keep running. Funny, that.
Sod it; plenty of other posters will argue the point about patching, firewalling, etc., and a myriad of rabid MS-bashers will refute and insult. Let my small voice add merely this to the fray -- it doesn't have to be this way, even if you use Windows. All that is required is people who know what they're doing.
What major release has Micro$loth put out there that's made everyone's lives better and easier in the last several years? I can't think of any. These published reports just show what a house of cards the Windoze platform is.
They are assuming the ports were not blocked. Which is crap, I've been to dozens of companies in the past week who are blocking all incoming ports and still got infected by this virus. These companies also had SAV corporate edition which was configured to update the definations via a FTP script, so they were actually getting their definations updated daily rather than the crappy live update which updates about once a week. Granted, they should have patched their systems when the RPC flaw was first exposed, but you shouldn't be so quick to point fingers.
Train control has this luxury. Computer systems onboard airplanes do not... simply turning off jet engines in case of computer failure is not an appealing possibility.
You're not just connecting to your business partners, you're connecting to everyone they've ever connected to.
The Register article says "It began by penetrating the unsecured network of an unnamed Davis-Besse contractor, then squirmed through a T1 line bridging that network and Davis-Besse's corporate network. The T1 line, investigators later found, was one of multiple ingresses into Davis-Besse's business network that completely bypassed the plant's firewall, which was programmed to block the port Slammer used to spread".
I'd never let a client do that. From a business risk management point of view, you *might* allow a direct connection by a vendor, *if* you had a good contract requiring them to keep good security and be responsible for breaches, and *if* you had secured everything sensitive in your internal network. From a theoretical or technical point of view, you should never trust something you don't control.
Monitoring systems are just as safety-critical as control systems. After all, the feedback loop is part of a control system. Imagine an intruder changing the readings to show that reactivity was decreasing, core temperature was dropping, and coolant pressure was so high that relief valves should be opened. You'd have a Three Mile Island rerun. That system should never, NEVER have been exposed even indirectly to the Internet.
But then, Davis-Besse is the plant where someone thought the way to check for an air leak was to poke around with a lit candle near flammable insulation wrapping critical control cables (1975).
Next thing you know, the Dept. of Homeland Sec. will issue a regulation requiring the use of Palladium or similar tech. on all computers. After all it is for our 'safety.'
McFly777
- - -
"What do people mean when they say the computer went down on them?" -Marilyn Pittman
First of all, this kind of service should never be connected to the public network, or even better, never to a non-dumb terminal.
Secondly, Microsoft CLEARLY spells out that their software is never to be used in this kind of implementation. Most software manufacturers do -- Sun, Apple, and most Linux distros IIRC.
Now, if this is a case of a critical service being overflowed from a remote location simply because it's connected to a public network, that's bad enough. To be running a consumer operating system on those critical services is simply unacceptable and probably worthy of execution. I don't care if the system was offline at the time -- this kind of thing should be definitely ringing warning bells. I hope whatever moron implemented this system gets fired.
From reading the article the services that went down had analog backups, but it's still unacceptable. Don't connect critical services to the fucking Internet.
Who's negligence is it really??? Microsoft's, or the person who used WINDOWS for something that would affect whether or not they breathe tomorrow morning? Only on slashdot do posts like this get modded up... Pure flamebait
Let me guess... It is the lazy administrator's fault. Well, when the patch is not easily installed most "windows administrators" -- like my mom who settles down in front of her machine to do the puzzle page each day -- just don't do it. When you don't know that the patch is out there, then how the fuck can you install it? Most computer users do not sit and watch bugtraq all fucking day. I don't read m$ EULAs because I don't use their products, but I am sure they indemnify themselves against their own poorly thoughtout piece of shit software.
Comparing it to Windows will be a moot point, since El Dorado is going to have a 40% larger code base than XP.
Cringely made this same mistake the first part of his weekly article http://www.pbs.org/cringely/pulpit/pulpit20030814. html. It's not always the "network" guys that are responsible for system patches and client firewall. Especially not in large companies.
With MS systems it's not just a matter of loading a patch, quite often they break something especially third party apps, fail to fix the problem they claim to fix, or open a new vulnerability.
If a model of car were found to be so defective -- bolts breaking, carbonmonixide in the passenger compartment, split drive shaft when you change gears, works with only one brand of gas, plays only approved radio stations, etc. -- no one would think to blame the user.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
Sure, one could argue that they should have applied patches and that it isn't M$'s fault but tell that to the jury. When surviving relatives see the potential for a profitable liability suit they are going to go after the biggest pockets and that is M$.
Yes, and then software liability will be mandated by legislation and then everyone in the software industry will be trouble. Be careful what you wish for. If MS goes down for something like this, the whole software industry is in trouble. We don't make as much as doctors in this business, so we can't afford the malpractice/liability insurance.
Again, the question should be asked why were mission-critical systems connected directly to any network, other than connections to other mission-critical boxes?
And it's not MARC's problem... they only run on CSX's tracks.
Who are the retarded idiots that let Microsoft within five miles of nuclear safety equipment? Microsoft's software is not quality controlled to any standard suitable for risking human life, and they even admit that in their EULA (no warranty, no liability).
Healthcare article at Kuro5hin
This will probably get me flamed to no end but think about it..
One life and death critical systems they should use proprietary hardware, OS and software.
Not any version of Windows, not any version of Linux, not Intel, not AMD, but something totally alien. Something that is designed from the ground up to be DIFFERENT and CLOSED that can not communicate with the outside world and the system that the outside world run on.
I'm talking about Air Traffic Control systems, Nuke plant controls, railroad traffic systems, hospitial systems, military systems, power systems, public utilities.
I mean NEW CPU's and a NEW OS and NEW software that is so different and so tightly closed that nothing can communicate with it but other systems of the same design.
With every other little dickweed with a Wally World emachine typing "1337" into google and downloading DIY virus labs, and these same little punks having access to the same networks that all the above mission critical systems communicate on, well, it's a disaster waiting to happen.
And when some script kiddie crashes a 747 full of people from his Wally World emachine on his mommies AOL account, what then? Or the same kiddie opens the floodgates on a dam and kills 200,000 people. Or a million people. Or makes a nuke plant go Chernobyl?
When burglars keep breaking into your safe every week and robbing you blind you would assume that it's time to get a better safe..
Before the world went insane and computerized every friggin thing from toasters to pay toilets to the power grid, this sort of thing was IMPOSSIBLE. Time to fix it folks..
Flame away..
I work on a military network that has the policy "one path in; one path out"... and let me say that policy has nothing to do with reality. What was very interesting about the most recent worm was that the communications infrastructure organization (whom we will refere to as CS) got a very vivid lesson in network security... or lack there of.
The base I'm on is well firewalled (sidewinder) and the ports that the initial variants of Blaster used were blocked. e-mail is virus scanned and the desktops/servers are all patched via SMS (remember, everyone had a full week to patch before the exploit code started showing up).
Despite all these measures (including MS SMS patching), the worm still got on the network and infected a sizable number of desktops (let's just put the number in the low 5 digit area).
So, how did the worm get there if the firewall blocked it's propagation from the outside and e-mail was scanned and desktops were (supposedly) patched?
two words: user entropy.
How many people within any given org are on laptops? (you know, the people who take their work home with them and connect to the internet via an ISP that doesn't have a firewall) How many rouge modems are there? (and remember, with the advent of NAT and dialing appliacnes, one doesn't have to have administative access to a PC to establish and unauthorized path) How many GoToMyPc enabled desktops are floating around? Haven't run across GoToMyPc yet? You will... and it will traverse your firewall and web proxy quite easily. Think you have all your bases covered? Ask yourself this question: If a users plugs something requesting a DHCP address into a RJ-45 wall plug, will it get a usable address? Probably. Ok, there's 802.3x, but how many laser printers actually have this capability?
Admins try to make things work. In complex environments with dumb end-users, this means making things simple. Lots of simple systems (remember with the first S in most of the TCP/IP protocols stands for) interacting with one another leaves a lot of room for, well, "Slack".
The only real way to contol security is to have a closed system with tight control (satellites, power grids, etc.) Then you only move the security threat to insiders (who should be opt-ed in so deeply it's not psychologically possible for them to be a threat).
What's disturbing is that important systems seem to be going the commoditization route with respect ot IT infrastructure. Whatever happened to completely physically seperate networks (but, oh, you have to get your patches from somewhere and waiting for the technet CD isn't an option)?
Dumbasses at nuclear power plant allow systems to be brought down by a bug microsoft and the IT security industry warned people about weeks ago. Management unaccountable for making their lazy IT employees do their job.
We were all lucky the blaster worm really wasn't destructive..
Sure it was annoying, and a DDOS isn't good, but it COULD have been really malicious and MUCH worse...
The ability to run arbitrary code on a server opens up your entire infrastructure. But the moron had machines reboot to announce they were infected.. what was he thinking?
Or was this just a distraction from a much larer and sinister plan?
---- Booth was a patriot ----
Rules of IT:
1) Do not place a vulnerable system on a critical network unless absolutely necessary.
2) When configuring a computer/server, always assume that you are hooking up to a hostile, unfiltered network.
If they'd applied these two rules to their network, routers, servers, etc., this likely wouldn't have happened. These are pretty basic ideas, folks. If you have a Windows box on the same network as a computer controlling nuclear saftey checks, you better have a damn good reason and you better check for patches weekly.
~Dalcius
Rome wasn't burnt in a day.
When will it end?
"Microsoft Worms Crash Ohio Nuke Plant"
Ummm...no, it clearly states in the body: disabled a safety monitoring system for nearly five hours.
You've got to be kidding me.
This can't be true! Please tell me it isn't.
Who the hell uses MS Windows to monitor a _nuclear__power__ plant_?
I would've never thought I'd be so happy to live in germany. At least our nuclear plants have their own, customized real time operating systems watching over what's going on.
Jebus Crickey, I'd suggest you'd get yourself a new set of plants right along with that new powergrid that's due.
We suffer more in our imagination than in reality. - Seneca