Slashdot Mirror
US-CERT Warns of Serious Hole In ActiveX Control From Iconics
Trailrunner7 writes "The US's Computer Emergency Response Team (CERT) issued a warning (PDF) to critical infrastructure firms on Wednesday about a serious security hole in products from Massachusetts firm Iconics that could leave critical systems vulnerable to remote attacks. US companies in the electricity, oil and gas, manufacturing and water treatment sectors have been warned about a flaw in an ActiveX control used in two products by Iconics. The software, Genesis32 and BizViz, are Human-Machine Interface (HMI) products that provide a graphical user interface to various types of industrial control systems. The software can control industrial systems used for a variety of purposes including manufacturing, building automation, oil and gas, water and waste water treatment, among other applications."
Security wholes in active-x, whodathunkit.
Isn't this something you'd have to be using IE to catch?
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
News at 11
Why are computer systems that control critical infrastructure accessible from the Internet? And even if it has access to the Internet, why is someone using it to go to web pages that are not on the company Intranet?
The truth is that all men having power ought to be mistrusted. James Madison
If some system is critical to running your oil and gas field, it DOES NOT belong on the internet. No matter what software it runs.
Anyone who gives such a machine internet connectivity should be fired for incompetence and actively endangering the business.
Plus, as we learned about a million years ago, ActiveX is insecure by design.
OK, OK, I don't know that. But that is what I was waiting for....
I am a Controls Engineer and work with HMI interfaces everyday.
We keep seeing more and more things like this in the controls world. Every few months, we hear, this HMI or this controls software has these vulnerabilities and can be owned this way or that. Properly designed controls systems do not touch the internet or extend beyond the controls world.
Place I work at, we have completely separate hardware then IT. Our own switches, our own computers, etc. We keep everything separate specifically to guard against someone hacking into our system and taking it over. Someone can't sit across the world and hack into our system because it doesn't connect. They would have to penetrate our security perimeter first in order to gain access to our controls system. If they do that, then it doesn't really matter which HMI software we are using, we are owned anyway.
It does scare me when I think about some of the other plants and industries make connections to the intranet for reasons from their controls system and trust that their securities will hold.
For the love of God, WHY THE HELL would you EVER EVER EVER EVER EVER EVER consider using ANY product even REMOTELY related to Windows for Industrial Control Systems?????? THIS is not some anti-microsoft rant mind you- its simply that Industrial Control Systems DO NOT USE consumer operating systems but rather HARD REAL TIME OPERATING SYSTEMS. If you do not know what the word "Deterministic" means in relation to Embedded Computing, you should go look it up first. There is a process known as Verification whereby every goddamn functional unit and every goddamn line of code is mathematically proven, is rigorously tested in some kind of Unit Testing Verification Harness software, and you simply would not slap some Windows or even normal Linux on an Industrial Control System. If you have an Industrial Control System using ACTIVEfuckingX you are probably dealing with a developer who is not actually an embedded systems developer, but rather a lazy idiot. Ciao
I thought they died with the DOS days!
HMI Module Alpha Humana on approach to Space Station Mercury.
"Thanks for the warning now lets get back to the real issues... How are shareholder forecasts locking for next quarter?"
Two of my imaginary friends reproduced once
Why are those systems connected to the Internet anyway? They should have two terminals. One on a private network only that controls critical systems, and one that is on the public Internet so employees can check their e-mail, etc.
Is there a reason ActiveX is being used in software that controls critical infrastructures? I don't want to jump to conclusions, but that seems almost as silly as a Security Consulting firm that doesn't test their own website for security holes.
Sorry, offtopic:
Has anyone ever told you that the way you try and make your points actually kinda weakens them ? Your post has some interesting content, but the way it is written angers, distracts, even takes away quite a chunk of your credibility.
The Cloud - because you don't care if your apps and data are up in the air.
The advisory says that this ActiveX-based software is vulnerable. It doesn't say it's on internet-facing httpd servers.
Because it is easier to control your system with a GUI than a command line. A picture is worth a thousand words, especially if you are monitoring various components across a large system. Nothing says the control systems themselves aren't running on specialized OS's, but what is wrong with exposing hooks for a GUI to control it with (and now-a-days you WILL need a GUI in a control room somewhere for most applications)? At least with Windows you know the risks and can at least mitigate if not eliminate them. It isn't any worse than running Linux for a GUI and trusting that it is safe since "no-one writes viruses for Linux." And as far as running control systems across a network, oil pipeline companies do it all the time. Or do you expect them to locate guys out in a hut with a telephone at every valve location in a thousand mile pipeline system? Hey Joe open the valve a little more. Not everything runs in one room.
-- I ignore anonymous replies to my comments and postings.
There are several real time systems which run windows as idle task, this means that windows only gets runs while no realtime critical tasks are scheduled. The realtime system provides some sort of virtual interface for example a network interface which can be accessed from windows, this way a component containing non realtime critical parts of the software (user interface) can be implemented in windows. (I had to run some realtime tests this way once, the UI was a eclipse client sending the test cases to the virtual network card of the realtime system, which would run the tests and send the results back once finished).
the last year Chief Systems Engineers were included in top level management meeting and relied on to direct the technical direction of products was around 1994. About that time, management was getting comfortable with Microsoft Windows and the semi technical ones or those managing technical staffs were getting gobs of literature all about how Microsoft Windows and Microsoft software could fly them to the moon and back before lunch was over. They were playing with Visual Basic and became expert programmers in their own minds. That is when management started dictating what tools would be used on products and when pressed would tell you that nobody gets fired for choosing Microsoft.
FYI, there was a UNIX based comm system up at LAX which got replaced by a Windows 9x box. When they found out the OS would repeatably crash after 49 days or something like that they solved the problem with a reboot _every_ 30 days. A new guy came onboard, thought hey, things are running fine so why reboot it. CRASH and for about 6 hours LAX has not ground to air nor air to ground communications. Many close calls but no crashes. But the 3fing idiots used a Windows box, Windows 9x even, for a mission critical system. I quit a military contract position when word came down from Command that all UNIX systems would be replaced with Windows. The way I see it, there are idiots making technical choices all around us and until Microsoft fades away, that's not going to change.
I miss the days when the Chief Systems Engineer ran the show and was usually the brightest person in the company and everyone knew it.
LoB
"Anyone who stands out in the middle of a road looks like roadkill to me." --Linus
I'm sorry to wake you up from your little dream world. But the largest supplier of SCADA control software is all Windows based. Plus no-adays, software developers, and more especially the managers leading them, have no clue what Deterministic or Hard Real Time mean.
I've seen supposed Control System development companies throw out the systems based on Commercial RTOSs and with a proven track record, basically because they don't support the latest and greatest Fads (like REST, XML, HTTP, SVG). The management like those that support the buzzwordy new gods (usually those GenYs). The rationalisation is generally starts out, that it's just too hard to get experienced developers for the old platforms and we don't really need hard real-time because of the advances in processing+network+disk resources available now.
The next and current step in the decline, is that all we need is a good set of processes in place, and the new-gen of developers+managers will be able to real-time control systems. After all, it's just software and any code-monkey should be able to replace experience with the right processes to support them.
Prepare for a lot more pain. "As some reporter said a long time ago. "Ohhhhhhhhh! The humanity".
Aaah...naive. I'll answer the question.
1) Not everything in control needs realtime.
2) It's cheaper
3) It's possibly less risky because it's better tested. Especially if it's not on a network. Why use RTOS when you can chat to a piece of hardware over a serial port. Or even zigbee these days...
4) windows comes with its own firewall that works just fine if you set it up right.
A fairly well known vendor provides continuous gas data by plugging a serial device into an outlet, and then cabled into a computer certified to run Win2000. The computer polls the serial line for data, and transmits using a proprietary client to a hardcoded VPN connection (PPTP) that pushes a file name set from a config.ini into an FTP server via ... I think windows scheduling service twice a day.
They use FTP over the VPN because this is built into off the shelf windows. NO extra programs needed.
The people that 'maintain' this system are utterly terrified of patching windows, installing a service pack, cygwin, or any sort of program. They have the competence to edit the ini file, but not change firewall settings or the destination of the VPN.
The maintainers and original developers wouldn't consider installing an SSH executable to help us get them away from the vendor because putting *ANYTHING* on the windows computer voids the warranty wholly (from the reseller of this product). People aren't supposed to do anything but occasionally pull up a menu and click on the buttons. They don't have DLL hell because there's only one damned app on it that doesn't ship with the o/s.
In order to read the system, we actually had to build a cable splitter with a relay that would swap our device on and off and query it independently--they were that afraid to touch the o/s and install a simple script that would FTP the data to somewhere else.
Let me put it to you this way--the people who maintain this...well...they seemed incompetent. The people who wrote it, are neither lazy, nor idiots. They sold a machine that probably cost $1000 to purchase with maybe 10k in development costs to companies that were willing to pay ...much more than that. Okay, maybe they're lazy...but they sure made a profit.
Verification is...not needed. Windows works good enough off the shelf if you don't install crap on it. So does linux. So would bsd or mac or BeOS. So would any o/s with an ip stack. I could probably program my ANDROID to do what was needed if I had a serial USB connection...
But windows development "expertise"...is dirt cheap.
Don't put anything new on it, keep it firewalled off...you're fine.
Now...the moment you start talking back to these over the VPN, it gets interesting. That isolated network might not be so isolated once somebody plugs a wireless access point into their desktop's USB NIC so they can RDP into it from their iphone while on the shitter...
Not that I've ever seen that...
So when are people going to start getting fired for buying M$
Seriously Active-X has been knows since its inception to be a giant security hole.
Its about time the expensive people started getting fired for buying it.
For the love of God, WHY THE HELL would you EVER EVER EVER EVER EVER EVER consider using ANY product even REMOTELY related to Windows for Industrial Control Systems??????
In our case, two reasons:
1. USB sticks. These things are a serious nightmare. Customer requirements are to be able to load programs via USB, and yet some USB sticks give trouble to some non-Windows systems. Our pre-Windows solution was to provide a list of known-working USB sticks. This was a nightmare, since the available sticks part numbers seemed to change from week to week. We stocked sticks and even gave out working ones, but it took an amazing amount of effort. Virtually every stick on the market has been tested against Windows.
2. Machine vision libraries. Our vendor is awesome and was willing to port their libraries to anything we wanted. However, the warning was that we would be the only users (or one of only a handful) on a non-Windows system. We were not willing to take that risk.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
If you get so upset with process control, what do you think of windows XP embedded running on life support machines. Oh yea!!! Trust me, its been done :D
Blue-screen of death here we come...
1. USB sticks. These things are a serious nightmare.
Not true for at least half a decade.
2. Machine vision libraries. Our vendor is awesome and was willing to port their libraries to anything we wanted. However, the warning was that we would be the only users (or one of only a handful) on a non-Windows system. We were not willing to take that risk.
If you use off-the-shelf, general-purpose yet proprietary single-vendor machine vision library for industrial control, you are doing it seriously wrong.
Contrary to the popular belief, there indeed is no God.
Not true for at least half a decade.
Amazing, because that's about exactly when the decision was made!
If you use off-the-shelf, general-purpose yet proprietary single-vendor machine vision library for industrial control, you are doing it seriously wrong.
Why? Everything involves compromises. This vendor was particularly good at our specific application.
To be fair, if the decision was made today, it might be Linux. More people use the library with Linux now, and Linux seems to work with USB keys of all flavors. We may even go that route eventually as a unit cost reduction if hardware support can be consistently found.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
"Serious hole" and ActiveX are the same thing.
Somehow 'I told you so' does not quite say it.