Slashdot Mirror
Stuxnet Virus Now Biggest Threat To Industry
digitaldc writes "A malicious computer attack that appears to target Iran's nuclear plants can be modified to wreak havoc on industrial control systems around the world, and represents the most dire cyberthreat known to industry, government officials and experts said Wednesday. They warned that industries are becoming increasingly vulnerable to the so-called Stuxnet worm as they merge networks and computer systems to increase efficiency. The growing danger, said lawmakers, makes it imperative that Congress move on legislation that would expand government controls and set requirements to make systems safer."
This is a wake-up call to a new vulnerability. There are a helluva lot worse ways to have found out about it than this relatively innocuous version. It also exposes stupid weaknesses like the fact that all Siemens PLC's (programmable logic controllers) have a hard-coded password that was never meant to be changed, and that all the obscure proprietary software in the world on PLC's doesn't mean jack for security--because they all still have to take their orders from a machine running it software on regular old Windows.
We could have realized these vulnerabilities only after a bunch of stuff started exploding.
SJW: Someone who has run out of real oppression, and has to fake it.
Don't use Windows for important industrial systems.
There's no reason why these machines should be connected to the internet. Maybe some of the top-level communication computers to coordinate between plants, but certainly not the local-area computers/machines.
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
Do you really want the idiots in D.C. telling you how your computer must work? Ask anyone doing IT related stuff under the DoD -- their own security policies cause more outages and problems than anything else. Those policies are from people who supposedly know what's what. Now put clueless politicians in charge.
You DON'T want this, no matter how much you like government control of your lives.
I would think that the risk of prolonged downtime in a factory that plows through millions of dollars a day would be enough of an incentive for any manager to tighten their security.
As sophisticated as Stuxnet is, it still relies on people doing Very Stupid Things. The solution isn't government intervention to control how everyone designs their networks (They'd be perpetually ten years behind current technology anyway), but to just weather the current panic, learn from it, and remember CHANGE THE DEFAULT PASSWORDS and USE A FIREWALL! The only reason this has been such a problem is that industrial control networks are designed by people with insufficient training in IT security, so often even the most common-sense measures are neglected.
Don't exaggerate the issue. The exploitation of PLC's by Stuxnet is akin to a device on your car vehicles CAN bus issueing commands across the network. Does your cars radio require authentication? Newp. How about your speedometer? Newp.
What StuxNet *does* emphasize is why it's a very, VERY dumb idea to have a network with PLCs connected to an external network of any kind.
"OMFG, I can't believe my cancer test came up negative because some hax0r compromised it. What kind of suck software was RUNNING on that device?"
OOOOOOoorrrrrrr..
"OMFG, you idiots, WTF would you connect a device which is going to tell me if I'm *DYING* to the MTF internet?!?!"
-- I'm the root of all that's evil, but you can call me cookie..
Ain't it a biatch.
Set your phasers on "funky"!
Its probably American dollars that paid for stuxnet in the first place (by way of "Aid" to certain countries)
just deserts come to mind
And what if I pay some random employee of nuclear plant $1 million to run .exe from USB key? Then I possibly can create another Chernobyl. In case of Nuclear plants only solution is to stay with pure electrical control systems and not moving it towards electronical programmable (computer) control systems. If there is no SW, there is no possibility of infection.
839*929
Seriously, who TF came to the idea that all WANs are to be extinguished and only the Internet can be used for site-to-site networks? Maybe I'm showing my age, but I don't care: when I was working in IT (before returning to academia), private WANs were the norm, and nobody even dreamt of connecting any part of a company network, no matter how unimportant, to the Internet. Somehow, common sense wasn't snuffed entirely. Oh, and we did have e-mail, shockingly enough, which was nicely routed to the Interent (if the e-mail address was an Internet e-mail address).
"The agriculture ministry is not in charge of Gundam" - Japanese ministry official.
For the love of god! You cannot create another Chernobyl, it had ZERO core containment. US reactors have 12 feet thick concrete surrounding the core! It *may* melt down, but then it's entombed in tons of concrete, so there isn't much to worry about! Equating a meltdown to Chernobyl is naive.
As an AC this post will never see the light of day, but I really wish people would stop being so afraid of nuclear power, it's really our only hope to get off fossil fuels any time soon.