Slashdot Mirror
Siemens SCADA Hacking Talk Pulled From TakeDownCon
alphadogg writes "A planned presentation on security vulnerabilities in Siemens industrial control systems was pulled Wednesday over worries that the information in the talk was too dangerous to be released. Independent security researcher Brian Meixell and Dillon Beresford, with NSS Labs, had been planning to talk Wednesday at a Dallas security conference about problems in Siemens PLC systems, the industrial computers widely used to open and shut valves on factory floors and power plants, control centrifuges, and even operate systems on warships. But the researchers decided to pull the talk at the last minute after Siemens and the US Department of Homeland Security pointed out the possible scope of the problem."
Perfect example of security through obscurity. Yeah, everyday script kiddies won't be messing around in the systems, but those dedicated to do damage or spy have the time and means to get to know the systems. And it's even easier for them because the systems aren't properly secured.
The argument that some knowledge is too dangerous to know is specious and flawed. But I can't tell you how or why for fear of undermining our existing regime of ignorance and ineptitude.
Crumb's Corollary: Never bring a knife to a bun fight.
As the Iranians found out the hard way, it's difficult to keep an intruder out despite the obscure nature of PLC (most people probably don't even know what that is.)
ELOI, ELOI, LAMA SABACHTHANI!?
And then they all stuck their heads back safely in the sand and slept soundly that night.
In other words, if your systems rely on PLC systems from Siemens, you had better hope that no attacker can get through your firewall.
The truth is that all men having power ought to be mistrusted. James Madison
Actually, they stuck their heads back up their asses. Only Ostriches stuck their head in the sand.
But the researchers decided to pull the talk at the last minute after Siemens and the US Department of Homeland Security pointed out the possible scope of the problem."
Don't you mean the DHS told them not to do it or they would get a thorough anal probing in the airport security check on their way out of town. I'm pretty sure they understood the "scope of the problem" before they started doing the research (which was also probably the motivation for the research).
...doesn't the existance of a virus that can attack such devices make this a zero-day flaw? The hack is public, since anyone can disassemble the virus that's in the wild and see how it works.
And, frankly, I don't see it being awfully difficult for any Black Hat with a mind to to rip out the prior payload and install one that can attack a wider range of devices. Surely it is in the interests of security for corporations to understand what they can do to mitigate the risk of this.
The DHS, IMHO, is acting in a manner that directly threatens US interests and US corporations by preventing those at risk from knowing as much as those who pose a risk. This argument has been had out before, with regards to CERT and when it should post alerts. It was accepted that there would be a reasonable pause to allow a fix. The virus was first discovered in July 15 2010. So the vulnerabilities have been zero-day for 10 months now.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
... stick your fingers in your ears and repeat after me, "La-la-la-la-la-la-la..."
Asking people not to listen (such as the US government telling college students, of all people, not to read ANYTHING about Wikileaks) makes as much sense as telling the speakers not to speak.
I8-D
There is a notion in security engineering of responsible disclosure, which is letting a company know about a vulnerability long enough before you present it so as to allow the company to fix it and deploy the fix. I believe that what happened here was that the company complained that they did not have enough time to fix the problem and deploy the fix, and that DHS and the researcher agreed with that conclusion. I do not think this is terribly far fetched, and I doubt that there is a conspiracy to leave vulnerabilities in industrial equipment used here in America, not when the Iranians want to get back at the US and Israel for Stuxnet.
Palm trees and 8
The people you don't want to know about this stuff, already know. The only reason Siemens or others don't want the info made public is to save face.
boycott slashdot February 10th - 17th check out: altSlashdot.org
What is being argued is that Siemens did not have enough time to patch this vulnerability and deploy that patch in major installations of these systems. I do not doubt it; the real question is whether or not they are busy deploying a fix, and I would not doubt that they are. Stuxnet is out there being studied by people who would use it to attack US factories, if they could, and I would bet that the US government is putting pressure on Siemens to fix the problem. If within a year, the talk is still being suppressed, we can start talking about conspiracies to control knowledge, but for now I would say it is more an issue of responsible disclosure.
Palm trees and 8
somebody make a WWII style propaganda poster with that, plz.
A lot of people seem to want to scream about censorship, but they're missing the point. This is one of the best case scenarios I've seen in relations between companies and security researchers.
For those who can't be bothered to RTFA, here's a summary.
Researchers found a serious flaw. The company developed a fix. It turned out that the fix was flawed. The company told the researchers about the potential impact of giving the talk before the flaw was fixed, and the researchers voluntarily postponed the talk while a better fix is built.
That's it, and it looks like everybody did the best thing they could. Isn't this what we'd want Siemens to do? "You've got a right to give your talk, but we'd like you to postpone it. Here's why. Your call."
--Somebody infect me with a
Stuxnet virus developed by Musad/CIA attacks Siemens controllers. Uploaded via jump drive during regular maintenance cycles. Fukushima. Nuff said.
So it would decrease security to give that information to people who pay for a sec talk, people who are most likely sent there by companies, companies possibly that use the technology in question?
Let's think for a while: Someone who wants to blow up a dam or nuke a power plant probably doesn't really care too much about "virtual trespassing", aka hacking and the legal implications thereof, and neither would he bother to second guess spending some 1000 bucks on someone who would provide this information, while a law abiding CISO or CSO at a company using those systems (who might instead go to sec cons to hear about them) cannot take these venues to receive the information.
Is it me or is the reasoning for suppressing the talk a tad bit backwards?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
First of all, don't you realize every time you make a joke about "anal probes" at the airport, you're being not-so-subtly homophobic? Same thing with prison-rape jokes. I'm about as much a fan of those jokes as I am of the acts.
It's bad practice to say that being afraid of somebody's hobbies makes you afraid of them because it infers that you have to do those hobbies with them. I'm not saying the jokes are classy. I'm saying somebody's hobbies are their own personal business and due to common courtesy. I'm also saying that somebody can be scared to death of homosexuality, suck it up, and profit immensely by being civil to the people around him/her.
Why are these things internet accessible in the first place?
I mean why don't they just add a "blow everything up" or "emit random signals that will probably destroy the attached equipment" button and save everybody the trouble?
If the US intelligence services and Siemens had worked together in the past to exploit SCADA vulnerabilities in systems owned by unfriendly nations.
Why would they want to increase awareness of SCADA problems?
echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
This and the recent Stuxnet virus story show the potential for viruses to start hitting infrastructure and equipment - providing an opportunity for both corporates and governments to do some really serious damage... a new book that considers the potential here is 'A joy to serve the company' http://www.amazon.com/s/ref=nb_sb_noss?url=search-alias%3Ddigital-text&field-keywords=a+joy+to+serve+the+company&x=0&y=0