Slashdot Mirror
New Siemens SCADA Vulnerabilities Kept Secret, Says Schneier
From the article: SCADA systems -- computer systems that control industrial processes -- are one of the ways a computer hack can directly affect the real world. Here, the fears multiply. It's not bad guys deleting your files, or getting your personal information and taking out credit cards in your name; it's bad guys spewing chemicals into the atmosphere and dumping raw sewage into waterways. It's Stuxnet: centrifuges spinning out of control and destroying themselves. Never mind how realistic the threat is, it's scarier."
What worries Bruce Schneier most is that industry leader Siemens is keeping its SCADA vulnerabilities secret, at least in part due to pressure from the Department of Homeland Security .
Uh oh, this story looks exactly like this story.
I find the idea of Iranian centrifuges spinning out of control and destroying themselves comforting rather than scary. Its a shame teh same hasn't happened to Pakistan.
Seems like Israel and the US are playing a dangerous game here. Say that Stuxnet caused an accident that released radioactive material into the environment...
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
How do you think Reese's initially got chocolate in their peanut butter?
...simply good old network security with hardened OSes (Linux, BSD, OS X) with seriously turned off all other services, firewalls and proxies with filtering won't do a trick?
Who is running industrial systems with direct contact with Internet anyway?
user@ubuntubox:~$ stfu This server is going down for shutdown NOW!
I would leave exposed SCADA interface in the open, after Stuxnet it should be clear that securing SCADA interfaces should be done on a higher level - by putting it in a different VPN etc.
Whether the vulnerabilites are public or not doesn't change the fact that a given setup is secure or insecure by design...
What worries Bruce Schneier most is that industry leader Siemens is keeping its SCADA vulnerabilities secret
If you want to prevent the bad guys from exploiting a vulnerability, then don't... um... tell them about the vulnerability? But do tell the affected parties about it.
Actually it's probably the CIA, NSA and other TLA's that truly want the security holes. They're just using the DHS as the mouthpiece to convince the companies to keep quiet and not plug the holes. After all, without those holes, Stuxnet (and likely other woms/viruses/trojans) wouldn't be as effective as they apparently have been.
Whatever comes out of this, I don't want to be the one with Siemens in my face.
Last I checked, 'responsible disclosure' meant giving the company time to fix the vulnerabilities before you released the info to the public.
Am I missing the part where we've gone beyond that point?
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
It was peanut butter in their chocolate
SELECT * FROM User WHERE Clue > 0
0 rows returned
Sounds like exactly the sort of thing Wikileaks exists for.
Seems odd to me that there is a lot of talk about Siemens but not Rockwell (by far the more popular PLC here in the US) nor Wonderware (a more popular SCADA platform in the US than Siemens), nor any talk of GE products (with higher market share in the power including nuclear market segments, again limited to in the US).
Hole/bugs lifetime is forever. If you find a bug or a hole, and you choose to ignore then, it will not go away. It will be there waiting for his moment to ruin your morning. Maybe bug/holes are not as important as people dedicated to the racketeer industry think. So if you can't fix then on the morning, you can fix then after the tea, if you fix then today.
-Woof woof woof!
Keep it internal and put an 'air' wall between the systems and the internet.
By 'air' wall I mean disconnected from the internet. Only a fool would connnect say a reactor control system to the internet.
However; we've seen the results of a fools work before...
Remember what Murphy says:
"Anything that can go wrong will go wrong and; at the worst possible time."
Just ask the Japanese.
I did my master's thesis on SCADA security. tl;dr: there isn't any. We're talking about an industry that uses unencrypted radio links in their control systems....
Media that can be recorded and distributed can be recorded and distributed.
-kfg
Antivirus went nuts trying to open the first link. xss
http://jurelia.co.be/games/mario.jar a variant of Java/Agent.BP trojan
2 of those followed by an ip address trying to dl an avi.
"SCADA systems -- computer systems that control industrial processes -- are one of the ways a computer hack can directly affect the real world".
Only if you connect the SCADA systems directly to the Internet and run them on top of Windows. Instead of running them behind a secure VPN connection running on embedded hardware.
Somehow I'm thinking that "vulnerability" is the new word for "backdoor".
Pull the other cable.
Not that one! You'll go blind!
Best Slashdot Co
"spinning out of control and destroying themselves"
The image the author creates is of a machine spinning at such velocity it explodes in a shower of fragments. While that makes for great copy, it's hardly what happened. In reality, Stuxnet caused the affected centrifuges to alter their rotational speed by only a few percent, which resulted in lower material rendering in the cascading purification process. This result has several advantages to a "self-destructing" centrifuge. 1) a destroyed centrifuge is an obvious problem which would trigger immediate investigation, while a "drifting" (and misreported) spin rate is not easily discovered 2) an undetected problem tends to pollute product quality and lead to doubts and investigations of all areas of the manufacturing process -- wasting time and expert resources diagnosing the root cause
I think you get the point.
there should also be strict government oversight to ensure the vulnerabilities are being fixed.
The Kruger Dunning explains most post on
Someone has been watching too much 24 Season 7.
meanwhile, the processes race towards disaster. I assume this is what the Iranians experienced.
... I can see not publicizing vulnerabilities. We don't, for instance, want our military publicly posting our vulnerabilities. Because, they sure as anything aren't going to ask for public patches. Public disclosure only really works if someone in the public can help. On the other hand, if you are running legacy systems in any number of unknown locations, you can't apply the patches anyways.
We always talk about how bad obfuscation is as a security vector. However, it is a vector. Knowledge of a thing can be its greatest weakness. For instance, publicizing how a company's internal network is setup can help an attacker greatly. But, hiding it can increase security. It's soft security, but it's better than no security.
I8-D
Giving them time to fix the vulnerabilities only works with companies that are enlightened enough (and responsible enough) to use that time to try and fix the vulnerabilities. Many companies won't bother and will just use that time to demonize you and/or threaten you with lawyers etc.
It's been tried in the past, and usually nothing short of full disclosure will get these companies off their asses to actually fix the problems.
Supporting businesses that use SCADA systems, we've become very aware of the fact that Stuxnet isn't just a risk of passively awful events like pollution, or even awful pollution - there are genuine risks of explosions and people quite litterally dying immediately after a developer pushes a bad change. Malicious code going to scada systems is the sort of thing they make Bruce Willis movies about. If you aren't terrified when you read about SCADA systems attacks - you haven't grasped the full implications.
Credit where it's due, for all that Siemens did a piss poor job of securing their product before Stuxnet - they are actually really helpful, really communicative and generally handling the issues fairly well. Fixing the problem in a secure, robust, change controlled way, with the kind of risk that goes along with any change to these systems - is neither fast, cheap or easy. It's hard to look at Siemens response to Stuxnet and say 'here's something they could do better/instead'. But it's still unbelievable how exposed they were before Stuxnet shone a light on this shit.
Hi, I’m Dirk Gebert, system manager for security for Siemens Industrial Automation Systems. I’m on the team working on the topic mentioned in this article. We are posting updates on this website: http://www.siemens.com/industrialsecurity. Let me know if you have questions that are not answered there.