Slashdot Mirror
Researcher Publishes Industrial Complex Hack
snydeq writes "Security researcher Kevin Finisterre has published code that could be used to take control of computers used to manage industrial machinery, potentially giving hackers a back door into utility companies, water plants, and even oil and gas refineries. The code exploits a flaw in supervisory control and data acquisition software from Citect. The vendor has released a patch and risk arises only for systems connected directly to the Internet without firewall protection. Finisterre, however, sees the issue as indicative of a 'culture clash' between IT and process control engineers, who are reluctant to bring computers off-line for patching due to the potential havoc wreaked by downtime. 'A lot of the people who run these systems feel that they're not bound by the same rules as traditional IT,' Finisterre said. 'Their industry is not very familiar with hacking and hackers in general.'"
You make a fair point but what happens if one of those machines does fail? Believe me, I've had triple redundant power supplies fail on me before it will happen.
The IT world believe in redundancy and so too I would have thought does the industrial world where uptime has to be 100%. Rebooting your Exchange server should not result in any downtime if email is considered mission critical.
So if there are redundant control systems in place why can't individual machines be brought offline and patched as necessary?
The only argument I can see that holds water here is that an update could theoretically break the tool but if it is properly redundant then it won't come back online when you're done and the problem stops there until the node can be replaced or updated.
What if the machine is a nuclear reactor?
If an engineer can get eyes on without disrupting operation (talking over the phone), then he might be able to avert a problem.
What if the machine is part of a chemical plant?
Same as above.
As an engineer in both instances, you would probably move more than an hour away.
Since there are usually junior engineers on at night it can be very helpful to have a senior engineer with eyes on. It wasn't until I had 10 years of experience before I realized that I didn't have the knowledge or experience to handle an emergency during my first 5 years.
And the powers that be wouldn't think of paying for someone that had more experience to be there.
So some of the accidents that occur at night which are blamed on people being tired are due to them not having enough experience.
I agree that more money and security are needed.
But very few managers get paid extra for spending more money.
The worst I've seen is where a controller was connected to a phone line. That controller had about 20 chemical reactors tied to it. Another controller also had a phone line and it had 4 reactors tied to it. But before this sounds really dramatic, if someone had hacked in they probably could have done some damage to the reactors, but it would not have caused a danger to humans.
The worst I saw (safety/security) was where someone had installed pipelines carrying caustic chemicals without using a double-walled pipe (Yeah, Electrical Engineers are the same as Chemical Engineers). Yep , sure enough they had a leak. Luckily no one was injured. Some equipment was trashed, but they had insurance.
The funniest was when the insurance guys came and wanted it to be turned on to confirm that it wasn't working. The engineer told him that he highly recommended that the equipment not be turned on. He actually showed them the fuzzy crap that was growing on the controller boards. He and another guy went and gathered five fire extinguishers, put those at their feet and told them to pull out the big red button and to press this button to start it up, if they really had to. Then told them they would be waiting outside. The insurance guy turned popped out the emergency stop button. The robotics went nuts and white flashes could be seen from the vents of the controller panel. Never got to the power on button. Experiment lasted about 3 sec. Insurance agent nearly drove the Emergency off button into the panel.
There were 3 more systems and they decided that they could just look at the fuzzy stuff on the control cards. Didn't need to turn them on after all.
So considering all the trouble we had with keeping safety standards in check, I'd say good luck with handling getting money for proper security costs.
And they finally did double-wall their chemical lines and eventually it became a legal requirement. So from then on there wasn't a problem with getting chemical lines double-walled and properly labeled, not with just the yellow caution tags, but with flags. Flags weren't a legal requirement, but they are cheap.
He who said 1,000,000 monkeys on 1,000,000 typewriters would eventually type the great novel, never saw an AOL chat room