Slashdot Mirror

← Back to Stories (view on slashdot.org)

New Siemens SCADA Vulnerabilities Kept Secret, Says Schneier

Posted by Roblimo on from the watch-those-centrifuges-spin-out-of-control dept.

From the article: SCADA systems -- computer systems that control industrial processes -- are one of the ways a computer hack can directly affect the real world. Here, the fears multiply. It's not bad guys deleting your files, or getting your personal information and taking out credit cards in your name; it's bad guys spewing chemicals into the atmosphere and dumping raw sewage into waterways. It's Stuxnet: centrifuges spinning out of control and destroying themselves. Never mind how realistic the threat is, it's scarier." What worries Bruce Schneier most is that industry leader Siemens is keeping its SCADA vulnerabilities secret, at least in part due to pressure from the Department of Homeland Security .

94 of 119 comments (clear)

  1. Read it before by ge7 · · Score: 1

    Uh oh, this story looks exactly like this story.

    1. Re:Read it before by McGiraf · · Score: 2

      Uh oh, this comment looks exactly like this comment.

    2. Re:Read it before by avgjoe62 · · Score: 1

      That was fun! Can we do it again?

      --

      How come Slashdot never gets Slashdotted?

    3. Re:Read it before by Chris+Mattern · · Score: 2

      Sure! "It's just a jump to the left, and then a step to the riiight..."

    4. Re:Read it before by ShadoHawk · · Score: 1

      "Put your hands on your hips!"

  2. If it did cause an accident... by AmiMoJo · · Score: 3, Insightful

    Seems like Israel and the US are playing a dangerous game here. Say that Stuxnet caused an accident that released radioactive material into the environment...

    --
    const int one = 65536; (Silvermoon, Texture.cs)
    SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    1. Re:If it did cause an accident... by Lehk228 · · Score: 2

      the whole thing would have been denied and covered up instead of bragged about.

      --
      Snowden and Manning are heroes.
    2. Re:If it did cause an accident... by MRe_nl · · Score: 2, Interesting

      The Japanese nuclear plant in Fukushima ran on Siemens computers that the Stuxnet worm was programmed to infect- in fact the virus was found in Fukushima systems last year.
      Makes you wonder why the cooling system wasn't functioning. Maybe the tsunami caused failures which Stuxnet made the reactors unable to handle.
      Failures at four other plants in Japan, German and South African reactors shut down.
      Using Siemens systems as well?

      --
      "Kill 'em all and let Root sort 'em out"
    3. Re:If it did cause an accident... by rubycodez · · Score: 2

      Quit reading tin hat nonsense sites. Have you seen the 1970s systems that control those GE Mark I's? No virus exists for those old things

    4. Re:If it did cause an accident... by gl4ss · · Score: 1

      neglible amounts, if any. the real why it would end up in atmo would have been the faults of the engineers working at the plant. if you don't know how to build control systems, you shouldn't be building a nuke in the first place.

      anyhow, scada networks, because of how practically all of them are designed, should be separated from untrusted networks anyways, and preferably all control going through some bridge that wouldn't pass "wrong" things - better yet, all control should pass through a human - but this depends on the specific use, really, as we don't have android typists acting as super firewalls(like in gits), who would want to type some textile pattern? nobody. you should treat them like your one-wire whatever networks, or like your local usb running on your table - if some attacker has access to that then what surprise it is that he can make the keyboard type "format c:".

      of course there should be SOMEONE who knows what the machines should be doing, how and why. like the plant manager, chief engineer and etc, too bad good guys to fill those spots don't grow on trees... but that is not news.

      --
      world was created 5 seconds before this post as it is.
    5. Re:If it did cause an accident... by Yvanhoe · · Score: 2

      Of course you have the sources for that ?

      From what I understand, stuxnet was targeting unrichment facilities, which is very different from what Fukushima is.

      --
      The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
    6. Re:If it did cause an accident... by Svartalf · · Score: 4, Informative

      Stuxnet doesn't "target" anything other than Windows SCADA systems (which should cause concern when you see those three words together...), notably those from Seimens. Anywhere you've got one of those SCADA systems, you've got a possibility of Stuxnet. It's just that Iran was using them for their process control systems for the enrichment plant.

      --
      I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
    7. Re:If it did cause an accident... by PremiumCarrion · · Score: 1

      If there was an accident surely all the danger would be in Iran. Why would Israel and the US be playing a dangerous game?

    8. Re:If it did cause an accident... by dachshund · · Score: 3, Interesting

      Stuxnet doesn't "target" anything other than Windows SCADA systems (which should cause concern when you see those three words together...), notably those from Seimens. Anywhere you've got one of those SCADA systems, you've got a possibility of Stuxnet. It's just that Iran was using them for their process control systems for the enrichment plant.

      Stuxnet targets a Siemens centrifuge controller that's programmed by an (air-gapped) Windows machine. Unfortunately this same basic pattern repeats itself all over the place.

      For any given SCADA system --- regardless of manufacturer --- you're extremely likely to see it connected to a modern PC, typically a windows machine. Even if the Windows machine is just running a terminal program, it's connected.

      What Stuxnet showed us is that these Windows boxes are a critical vulnerability, even if they're just an ingredient in the programming chain, even if the box is separated by an air gap. I'm sure Israel/US would have found a way to those centrifuge controllers, but without the Windows infection vector it would have been a whole hell of a lot more difficult.

    9. Re:If it did cause an accident... by heathen_01 · · Score: 1

      Yes, they should have been using macs. They don't get viruses.

    10. Re:If it did cause an accident... by kvvbassboy · · Score: 1

      What? If it is connected to a Linux machine, they will program Stuxnet to work with Linux. Or are you implying that non-Window machines are invulnerable?

    11. Re:If it did cause an accident... by turing_m · · Score: 1

      I think he meant in terms of danger to people's lives, not blowback.

      --
      If I have seen further it is by stealing the Intellectual Property of giants.
    12. Re:If it did cause an accident... by cavreader · · Score: 1

      I'm sorry but I must have missed the proof that the US or Israel was responsible for Stuxnet. But of course actual facts are old fashion and can be quite problematic when the don't support your world view.

    13. Re:If it did cause an accident... by TubeSteak · · Score: 3, Informative

      Stuxnet doesn't "target" anything other than Windows SCADA systems (which should cause concern when you see those three words together...), notably those from Seimens.

      You might want to do a little more research on the matter.
      Stuxnet's code has been picked apart: the trojan was designed to infect SCADA systems, but only to attack very specific hardware configurations.

      Stuxnet's payload was designed to (1) spin the uranium centrifuges used by Iran at certain known-to-be-destructive RPMs,
      (2) lie to the monitoring software which was supposed to prevent out of bounds conditions and set off alarms if they occur,
      and (3) should 1 & 2 not ruin the centrifuges, Stuxnet would go dormant and reawaken to try (1) and (2) again.

      Stuxnet is completely harmless unless you happen to attach the exact same hardware the Iranians had plugged into their SCADA controllers.
      Just to be very clear: Stuxnet's payload was specifically crafted to attack the known configuration of Iran's uranium centrifuging program

      --
      [Fuck Beta]
      o0t!
    14. Re:If it did cause an accident... by Antimatt3r · · Score: 1

      Actually Stuxnet does have a target. Each Siemen system has a unique serial number. Stuxnet only manipulated systems with certain serial numbers and it so happens that these serial numbers only existed in Siemens systems in Iran.

    15. Re:If it did cause an accident... by omglolbah · · Score: 1

      Most of the oil rigs in the North Sea and the land plants supporting them are programmed using windows XP machines.
      Some of the rigs also have HMI systems (800xA by ABB) that run on win2003 servers.

      There really are no modern control systems that do not have a windows component.. not if they have the feature-set required by most customers.

      It isnt remotely perfect, but the options to avoid it are extremely limited.

    16. Re:If it did cause an accident... by Wintermancer · · Score: 1

      Jus en Bello.

      In the event that a cyber attack did cause collateral damage (unlikely, in this case, but maybe not for future ones), whomever is pressing the launch button better be in uniform.

      Why? Military operations against actual targets are legitimate acts of military aggression. The Laws of Armed Conflict (LOAC) are the legal basis for determining whether an act is legitimate act or a war crime.

      This is why we don't prosecute fighter pilots for targeting a bus with a JDAM, that is known to be carrying Al Queda operatives along with their wives and children (this is a gross oversimplification, but you get the point). Civilian casualties are regrettable, but kinetic operations are not going to be shelved on that basis alone. If a civilian pulled the trigger to release that JDAM, they would be guilty of murder. Same thing applies to cyberwarfare operations.

      Welcome to the future.

    17. Re:If it did cause an accident... by sjames · · Score: 1

      Government officials care only about their own lives and those of their friends and family. That's why we can have wars. Note that the draft exemptions are generally met by the family of anyone who is involved in mandating a draft.

    18. Re:If it did cause an accident... by lennier · · Score: 1

      Civilian casualties are regrettable, but kinetic operations are not going to be shelved on that basis alone.

      Wow, that's cold.

      It's easy for you to say that when it's not your wife and children on that bus. If they were, you might have a different view on whether or not merely being a uniformed cog in an industrial death machine should allow "regrettable" murders to be shrugged off as if they were heavy rainfall.

      Funny thing is, I thought I was taught in high school that the "can't prosecute me, I was just following orders, sir" defence was smashed apart at Nuremberg. Apparently that wasn't the case?

      --
      You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
    19. Re:If it did cause an accident... by dachshund · · Score: 1

      Yes, they should have been using macs. They don't get viruses.

      But in all seriousness, the question I would ask is: how many known USB drive infection and privilege escalation vulnerabilities can you download for a 1-year-unpatched* Mac right now. How many can you download for the same Windows machine? In each category many have already been weaponized? How many of these can be tied together with widespread malware vectors that will get them near the machine to be infected?

      Of course many of the same vulnerabilities exist for the Mac and for Linux. The difference is that they haven't been discovered, widely publicized and weaponized. You could do all of these things given the resources --- e..g, if you were a nation state.

      But if you're not a nation state, then the availability of cheap exploits is what makes Windows machines such a terrifyingly weak link in the security chain, and something you can attack remotely on a relative shoestring. The fact that it's not being done is simply an illustration that the people who know how to do this stuff are not the same people who want to kill Americans. Right now.

      * A generous description of many of these air-gapped SCADA machines.

  3. Sometimes a SCADA hack is a good thing by Anonymous Coward · · Score: 3, Funny

    How do you think Reese's initially got chocolate in their peanut butter?

  4. Call me naive or something, but... by Pecisk · · Score: 2

    ...simply good old network security with hardened OSes (Linux, BSD, OS X) with seriously turned off all other services, firewalls and proxies with filtering won't do a trick?

    Who is running industrial systems with direct contact with Internet anyway?

    --
    user@ubuntubox:~$ stfu This server is going down for shutdown NOW!
    1. Re:Call me naive or something, but... by Anonymous Coward · · Score: 1

      ...simply good old network security with hardened OSes (Linux, BSD, OS X) with seriously turned off all other services, firewalls and proxies with filtering won't do a trick?

      Who is running industrial systems with direct contact with Internet anyway?

      Stuxnet infected the Iranian nuclear plan through USB.

    2. Re:Call me naive or something, but... by Lehk228 · · Score: 1

      iirc the wild form of stuxnet was not the same as the one that hit iran, theirs was placed by a spy, not spread "naturally"

      --
      Snowden and Manning are heroes.
    3. Re:Call me naive or something, but... by Pecisk · · Score: 1

      And excuse of sticking USB without security protocol (can't execute stuff from USB drives) is...? Still similary stupid to connecting boxes to Internet.

      --
      user@ubuntubox:~$ stfu This server is going down for shutdown NOW!
    4. Re:Call me naive or something, but... by wiredog · · Score: 2

      Many systems are remotely accessible, just not over the internet, and no one thought that heavy security would be needed. Even though those networks were getting compromised back in the 60's.

      Just pulling the cable when remote access isn't needed is a highly effective, and often neglected, security practice.

      --

      Best Slashdot Co
    5. Re:Call me naive or something, but... by jimicus · · Score: 4, Insightful

      I'm not sure it would have done much good. The general consensus of opinion is that this was a case of a determined attacker with a lot of resources, not some nutter on the Internet with a copy of the latest Virus Generator Toolkit (TM).

      How much weight we should give that opinion is something I'm not going to discuss.

      In any case, you think a determined attacker is going to be put off by a small thing like that? Hell, if it boils down to it you either organise double agents to apply for jobs at the target site or you target someone who already works there with a brown envelope full of unmarked, non-sequential notes. The latter is high risk, but find the right person, someone who's in debt up to their eyeballs and has been keeping it from their family for some time perhaps, and away you go.

    6. Re:Call me naive or something, but... by Maximum+Prophet · · Score: 1

      no one thought that heavy security would be needed

      Who is this imaginary "no one", that never thinks anything could go wrong? I and all my friends who grew up watching "War Games" are always thinking about how things could go wrong.

      It always seemed to me that what "no one" is thinking is not that bad things can happen, but "I'll put in just enough security so that the failure won't happen until after I retire."

      --
      All ideas^H^H^H^H^Hprocesses in this post are Patent Pending. (as well as the process of patenting all postings)
    7. Re:Call me naive or something, but... by Black+Parrot · · Score: 2

      Just pulling the cable when remote access isn't needed is a highly effective, and often neglected, security practice.

      I tried that, but my screen went black.

      --
      Sheesh, evil *and* a jerk. -- Jade
    8. Re:Call me naive or something, but... by cshake · · Score: 1

      I'd imagine it would be because the company that makes the machines that you're controlling only make drivers and control software for their own special computer systems that you have to buy from them. The advantage there is that if any part of the system goes wrong, from computer to end product, you have a single point of contact to get support from.
      I think the mistake that many people on /. make is thinking that everyone is a 'computer guy', where in reality the people running these computers just know how to work the interface itself and not anything below the hood, so calling external support is very valuable.

      And I bet a random *nix box that your friend in IT sent you wouldn't pass their ISO xxxxx certification.

      As for internet connection, they must all be hooked up to an internal network at least for logging and alerting other systems in case of problems, but having that network also connected to the web is beyond me.

    9. Re:Call me naive or something, but... by nnull · · Score: 1

      Quite a lot of people lately. Management wants to see their production on their office computers. They're easy to network and of course easy to hack. Siemens is not the only one vulnerable here, *cough* Schneider *cough* Schweitzer *cough* ABB...

    10. Re:Call me naive or something, but... by wiredog · · Score: 1

      Why would you need heavy security for something that is air-gapped? If the Bad Guys (TM) get physical access you've lost anyway! We didn't even require passwords for access, because the keyboard was locked in the control cabinet. The only time it was networked was when someone hooked up a modem so it could be remotely debugged or upgraded. After which the modem was disconnected.

      --

      Best Slashdot Co
    11. Re:Call me naive or something, but... by thegarbz · · Score: 1

      Who is running industrial systems with direct contact with Internet anyway?

      Here's a thought, why does it matter? So far there has been only one demonstrated attack on a SCADA system, and that attack didn't use the internet as its vector.

      SCADA systems benefit greatly from being connected to the world, but not directly. There should be many tiers of security both virtual and physical. It is the physical security here that was lacking. The best airgap in the network doesn't help you if one of your underlings plugs an infected USB stick into a machine on the process control network.

  5. Duh? by trifish · · Score: 1

    What worries Bruce Schneier most is that industry leader Siemens is keeping its SCADA vulnerabilities secret

    If you want to prevent the bad guys from exploiting a vulnerability, then don't... um... tell them about the vulnerability? But do tell the affected parties about it.

    1. Re:Duh? by Anonymous Coward · · Score: 1

      Yeah, security by obscurity. That works great. Keeps the world safe.

    2. Re:Duh? by nedlohs · · Score: 5, Insightful

      or fix it, that works really well too.

    3. Re:Duh? by markus_baertschi · · Score: 4, Insightful

      That is exactly what will not happen.

      The ones who should tell their Customers about the problem is Siemens. But they will play the problem down because it might affect the sales of the next batch of stuff.

      The evil hacker will just buy a bunch of systems, analyze it and find the vulnerabilities. This completely independent of the disclosure. Stuxnet was developed before this disclosure and I think the vulnerabilities used by Stuxnet are still there.

      This is why security by obscurity does not work in the real world.

    4. Re:Duh? by chaos.squirrel · · Score: 2

      If you want to prevent the bad guys from exploiting a vulnerability, then don't... um... tell them about the vulnerability? But do tell the affected parties about it.

      I think nuclear power plants and the like warrant something a bit more than security through obscurity...

    5. Re:Duh? by betterunixthanunix · · Score: 1

      Except that the bad guys have already been made aware of the vulnerability, since Stuxnet is out there for anyone to analyze. Do you think the Iranians have not been picking apart Stuxnet and trying to figure out how they can use it?

      --
      Palm trees and 8
    6. Re:Duh? by Svartalf · · Score: 1

      That's specifically not what they're doing...telling the affected people about it. They're keeping that information to themselves- because it might reveal the exploits in question. As for not disclosing because the bad-guys might figure it out...heh...keep fooling yourselves folks. The bad-guys almost always KNOW about them- it's why they call 'em "0-dayz".

      --
      I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
    7. Re:Duh? by Svartalf · · Score: 1

      The evil hacker will just buy a bunch of systems, analyze it and find the vulnerabilities. This completely independent of the disclosure. Stuxnet was developed before this disclosure and I think the vulnerabilities used by Stuxnet are still there.

      This is why security by obscurity does not work in the real world.

      Most definitely. Comments about someone not being able to afford to buy the devices not withstanding, it is very much what someone would do if they were to attack a system or come up with a new Stuxnet type piece of malware. Someone always has the wherewithal and resources to accomplish this sort of thing.

      --
      I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
    8. Re:Duh? by thePowerOfGrayskull · · Score: 1

      And yet obscurity is a valuable tool in security. Absolutely it should not be the only tool - but discarding it completely is like saying we should discard firewalls because firewalls can't stop all attack vectors. They are all tools, and none is sufficient security on its own - but many different tools used in conjunction can make for a formidable defense.

    9. Re:Duh? by thegarbz · · Score: 1

      That is exactly what will not happen.

      The ones who should tell their Customers about the problem is Siemens. But they will play the problem down because it might affect the sales of the next batch of stuff.

      Speaking of real world this is something that doesn't happen on a typical control systems vendor. Your typical vendor releases pages of errata. Your typical vendor knows what you have purchased and your typical vendor typically comes running in with a fix be it hardware or software, or a temporary workaround while they are coming up with the fix.

      This has happened to us on many occasions. One instance a certain series of commands issued on the display graphic would cause an alarm manager to stop responding. We were told what was the problem was and a few days later someone came from the vendor with a software patch. A more extreme case from the same vendor was when a hardware fault was found in a batch of cards. The fault could in a remote circumstance cause an output to drop to it's failsafe state. The vendor replaced some 13 of the cards on site.

      This is exactly why we stay with the vendor. Failure of equipment doesn't have anywhere near as much influence as what gets done to manage that failure.

  6. Re:I find the idea by smelch · · Score: 2

    Yeah, well how would you like incubators for human babies to start spinning out of control and destroying themselves?

    I'm not so worried about what terrorists might do in a cyber attack, I'm worried about the trolls.

    --
    If I can just reach out with my words and touch a butthole, just one, it will all be worth it.
  7. DHS probably wants the security holes by Anonymous Coward · · Score: 4, Insightful

    Actually it's probably the CIA, NSA and other TLA's that truly want the security holes. They're just using the DHS as the mouthpiece to convince the companies to keep quiet and not plug the holes. After all, without those holes, Stuxnet (and likely other woms/viruses/trojans) wouldn't be as effective as they apparently have been.

    1. Re:DHS probably wants the security holes by fuzzyfuzzyfungus · · Score: 4, Insightful

      I'm not so sure: Obviously, assorted sinister TLAs are happy to exploit available holes; but all but the really stupid ones have to realize that they don't exactly live in a unipolar world when it comes to writing viruses, and that the US(and its assorted western buddies) have a lot to lose in an atmosphere of general SCADA-smashing.

      If all SCADA systems become deeply vulnerable, who loses more? Industrial or post-industrial societies with high levels of complexity that could be on the edge of collapse with a few days of supply chain disruption, or the dusty low-GDP countries of the world where disenfranchised hackers, cheap laptops(and/or exploits provided by friendly powers using them as proxies) are still easily available?

    2. Re:DHS probably wants the security holes by jonwil · · Score: 1

      If the CIA etc really wanted to infect these things, why wouldn't they just infect the machines at the factory then use a front company to sell them to IRAN or whoever on the cheap.

      I remember seeing a JAG episode once where the spooks deliberatly allowed some bad guys to steal an F-14 and extract its control software (knowing that the software was to be given to IRAN for an upgrade of its F-14s and knowing that the software was deliberatly defective) and I see no reason it couldn't happen in the real world.

    3. Re:DHS probably wants the security holes by Jaysyn · · Score: 1

      Didn't the CIA do something like this to the USSR concerning oil pipeline control software?

      --
      There is a war going on for your mind.
    4. Re:DHS probably wants the security holes by HeckRuler · · Score: 1

      There's another layer here. Having vulnerabilities allows TLAs to do sneaky things, empowers them, and helps them do their job. And you're right, those things cut both ways. But, having them cut both ways ALSO empowers the TLAs. They all got a big budget boost in the aught years. Security was suddenly a really important thing.

      So what the TLAs want isn't always their intended purpose.

  8. Responsible Disclosure by Aladrin · · Score: 2

    Last I checked, 'responsible disclosure' meant giving the company time to fix the vulnerabilities before you released the info to the public.

    Am I missing the part where we've gone beyond that point?

    --
    "If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
    1. Re:Responsible Disclosure by DMUTPeregrine · · Score: 1

      Responsible disclosure meant giving the company time to fix the vulnerabilities before you released the info to the public.
      So the companies stalled and never fixed the vulnerabilities, tried to sue the researchers, etc.
      Responsible disclosure came to mean giving the company a set amount of time to fix the vulnerabilities before you released the info to the public.
      So the companies kept threatening researchers, called the grace period "extortion" and such, stalled for more time to "test", and didn't fix the vulnerabilities.
      Responsible disclosure died, and full disclosure took its place. The researcher's ethical responsibility is not to the company with the flawed product, but to the customers. Having all the details of a vulnerability is pretty much always useful for mitigating that vulnerability until a fix is released, and having the vulnerability publicly known motivates companies to actually fix the flaw. Thus, full disclosure is reasonable.
      Some companies DO fix vulnerabilities when informed of them. With these it is reasonable to provide the grace period. If you do not know, it is reasonable to provide a grace period. 90 days is typical. If a company refuses to fix the flaws within the time, they forfeit their future grace periods.

      --
      Not a sentence!
  9. NO!!!!! by SirTreveyan · · Score: 2

    It was peanut butter in their chocolate

    --

    SELECT * FROM User WHERE Clue > 0

    0 rows returned

    1. Re:NO!!!!! by SirTreveyan · · Score: 1

      Jezzz...evidently you don't remember the commercials Reese's used to run all the time. Don't take things so serious.

      --

      SELECT * FROM User WHERE Clue > 0

      0 rows returned

  10. Re:Secure the perimeter by drinkypoo · · Score: 2

    Now imagine the scenario where you have windows machines on the same network as your SCADA devices because the tools you've bought or built work this way. Someone attaches an unauthorized device to your network and fail, fail.

    Now, I think we can probably agree that you can and should take steps to prevent something like that from happening, but there is the issue of getting from point A, where your network is insecure, to point B, which requires at least buying or developing a whole bunch of new software. This is non-trivial and it costs a lot of money so a lot of operators probably weren't even looking at it until recently.

    --
    "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  11. Perfect example by return+42 · · Score: 1

    Sounds like exactly the sort of thing Wikileaks exists for.

  12. Re:I find the idea by Black+Parrot · · Score: 1

    Yeah, well how would you like incubators for human babies to start spinning out of control and destroying themselves?

    Do incubators spin?

    --
    Sheesh, evil *and* a jerk. -- Jade
  13. Re:I find the idea by smelch · · Score: 1

    You mean incubators for babies aren't the same as the incubators in Jurassic Park?

    --
    If I can just reach out with my words and touch a butthole, just one, it will all be worth it.
  14. Re:Secure the perimeter by Black+Parrot · · Score: 1

    Now imagine the scenario where you have windows machines on the same network as your SCADA devices because the tools you've bought or built work this way. Someone attaches an unauthorized device to your network and fail, fail.

    Aren't those development tools rather than run-time tools? If so, isolate your system and get serious about how you allow stuff to be moved over to it.

    --
    Sheesh, evil *and* a jerk. -- Jade
  15. Lifetime of a bug/hole by Tei · · Score: 1

    Hole/bugs lifetime is forever. If you find a bug or a hole, and you choose to ignore then, it will not go away. It will be there waiting for his moment to ruin your morning. Maybe bug/holes are not as important as people dedicated to the racketeer industry think. So if you can't fix then on the morning, you can fix then after the tea, if you fix then today.

    --

    -Woof woof woof!

  16. Re:I find the idea by Gilmoure · · Score: 2

    We're incubating troll babies?

    WAH?

    --
    I drank what? -- Socrates
  17. Re:I find the idea by countertrolling · · Score: 1

    You all keep on pissing and moaning about Iranian nukes, while part of the new Saudi arms deal is to protect future Saudi nuclear ambitions.. which, by the way, also involves Pakistan (had to use google cache to get the whole article)

    And what did this clown ever do to deserve all those medals?

    --
    For justice, we must go to Don Corleone
  18. Re:Secure the perimeter by Interfacer · · Score: 4, Informative

    Not really. The process control is done on real-time controllers, but visualization is usually on windows machines. Data historians, configuration databases, OPC servers, etc are often Windows servers. Add to that that hotfixes and service packs have to be vendor approved before putting them on the live system. This means that those systems often run whatever was approved at the time of installation, which can be years out of date.

    Many SCADA and DCS systems are also horribly insecure, have default or hard coded administrative passwords, etc. What doesn't help is that they are often managed by people who are good at the actual process stuff, but not necessarily at security or system administration.

  19. Open Secret by adavies42 · · Score: 5, Informative

    I did my master's thesis on SCADA security. tl;dr: there isn't any. We're talking about an industry that uses unencrypted radio links in their control systems....

    --
    Media that can be recorded and distributed can be recorded and distributed.
    -kfg
    1. Re:Open Secret by Anonymous Coward · · Score: 1

      Believe me I know all about it, as I'm a guy that designs and puts those links in. I've been making a big push with the uppers for more secure links and it is starting to get in now. Licensed bands with AES etc. Previously it would all be modpacs or Canopy links. We're starting to move to licensed stuff with AES now, but damn near everything in this area was already done like this. Anyone could pretty much get on the network with the right know how. Most of the stuff is the water control systems for the cities/towns.

    2. Re:Open Secret by Svartalf · · Score: 2

      Heh... They're "thinking" about using crypto on things like the radio links. They're "concerned" about things like "latency" (Here's a hint, if you're worried about injecting a 1-2 character's worth of transmission time delay at 9600 baud, you're doing it wrong.) so the industry's been reticient at trying to at least lock down some aspects of the remote links. Biggest problem is the downtime of some systems in addition to the overall expense of things while they retrofit to higher data rates, end-to-end crypto (and not the security mode of DNP3 and other SCADA device protocols...), and security monitoring. Most of the "smart grid" security model's been predicated on security through obscurity and authenticated command and control with data being plaintext in most cases because that's the "least expensive" solution to the "problem".

      --
      I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
    3. Re:Open Secret by Anonymous Coward · · Score: 1

      Wait a second. Unencrypted *radio* links? Seriously? I sure hope it's for controlling the ice cream and chocolate factories of the world and not something important.

    4. Re:Open Secret by Myrcurial · · Score: 1

      Master's Thesis on SCADA Sec? Really? Published anywhere?

      SCADA security isn't. I'm sorry but it's true. And the entire "security industry" is talking just like all the slashtards commenting.

      Doing security right in this environment is non-trivial. The SCADA/ICS vendor community isn't providing it because SCADA/ICS customers aren't asking for it. The downside of course is that the SCADA/ICS customer is NOT the individual who is going to suffer when the screwups happen. The SCADA/ICS vendors and customers have externalized the costs of failure on the general public and no country-scale government is actually doing anything other than paying lip-service to the idea of dealing with aging/insecure infrastructure.

      If you want to see more - have a look at the talk I did at DEF CON 18 - it covers the situation nicely.

    5. Re:Open Secret by rabtech · · Score: 1

      Long ago, I worked as an IT admin for a grocery company that owned it's own bakery, ice cream, drink, etc plant. The "industrial control systems" I saw in use were the worst engineered pieces of junk I've ever encountered. I am talking unpatched Windows 95 systems running a crappy VB 4 UI, that talked to a poorly written VxD to control the ice cream mixer, which was a massive piece of equipment that could easily kill someone standing too close to it.

      I just got one of those TI $4 embedded development kits and while I applaud them for trying to draw in hobbyists and small companies, the SDK is a serious piece of crap. You might as well just write pure assembly... The C code is a mishmash of indecipherable macros and #defines that seriously look more like assembly than C. Forget about any kind of abstraction.

      From what I hear from my friends (one of whom used to program for defense embedded systems), it is all like that. Terrible platforms, terrible code, security through obscurity (if that), etc.

      The fact that stuxnet was able to exist? The fact that the video signals from some of our drones are broadcast unencrypted over the air? None of it is shocking in the least. It makes Microsoft IIS circa 1997 look positively secure and well-written by comparison.

      --
      Natural != (nontoxic || beneficial)
    6. Re:Open Secret by russotto · · Score: 1

      From what I hear from my friends (one of whom used to program for defense embedded systems), it is all like that. Terrible platforms, terrible code, security through obscurity (if that), etc.

      There's no practical way to defend the embedded system from the device which programs it. So while it's true that the tools use to program embedded systems are often primitive, it has little to do with attacking them.

      The fact that the video signals from some of our drones are broadcast unencrypted over the air?

      IIRC, that was due to
      A) A shortage of hardware in the field to decrypt the encrypted video and
      B) A lack of enemy capability to exploit the unencrypted video.

    7. Re:Open Secret by dargaud · · Score: 1

      I do control/command systems as well and there are many reasons why there's few if any security. One of them is that in the (rare) case of a reboot, you want the system back online automatically as quick as possible. You don't want to wait until 9am when the first employee who knowns the password can type it in... hence no passwords. Note: I'm NOT saying it's a good thing !

      --
      Non-Linux Penguins ?
    8. Re:Open Secret by adavies42 · · Score: 1

      Master's Thesis on SCADA Sec? Really?

      Yes, the cite would be something like

      Davies, Aaron G. "A Toolkit for Intrusion Detection in a SCADA Environment." MA thesis. University of Louisville, 2005.

      Published anywhere?

      Astonishingly, yes, at least if you count ProQuest. Not that I'd bother reading it (or at least anything but the background material) if I were you--it was basically about hooking up a SCADA emulator to Snort and an alert correlator to make a testbed you could deploy potential attacks against to see if your filter configuration worked. I have no idea if anyone ever did anything with it; I can't find any evidence that anyone's ever cited it, anyway.

      --
      Media that can be recorded and distributed can be recorded and distributed.
      -kfg
    9. Re:Open Secret by thegarbz · · Score: 1

      As the person on site somewhat responsible for managing encryption keys for wireless telemetry and wireless process control systems on my site I call bullshit. Either that or you did your thesis in the 80s oldtimer.

  20. Re:I find the idea by drinkypoo · · Score: 1

    Yeah, well how would you like incubators for human babies to start spinning out of control and destroying themselves?

    Not really an issue here on earth, maybe on a space station it would be a consideration. Or were you thinking of Fetus Harvesters?

    --
    "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  21. Re:anonK by ledow · · Score: 1

    Seeing as you're the only one commenting on this, and I can't see it either, it's probably YOU that's infected, or you clicked something you didn't mean to.

    Hell, there aren't even any banner ads on that page at all.

  22. Re:I find the idea by torgis · · Score: 3, Funny

    Spinning Incubator Babies would be a really excellent name for a rock band.

  23. Re:I find the idea by Black+Parrot · · Score: 1

    Spinning Incubator Babies would be a really excellent name for a rock band.

    Spin, Baby, Spin!

    --
    Sheesh, evil *and* a jerk. -- Jade
  24. computer systems that control the real world? by doperative · · Score: 1

    "SCADA systems -- computer systems that control industrial processes -- are one of the ways a computer hack can directly affect the real world".

    Only if you connect the SCADA systems directly to the Internet and run them on top of Windows. Instead of running them behind a secure VPN connection running on embedded hardware.

    1. Re:computer systems that control the real world? by PPH · · Score: 1

      The problem with such systems is that they can be 'infected' through the programming platform. In the case of Stuxnet it was the PCs used to program the PLCs that were infected. And one of the vectors of infection was the use of infected USB flash drives on these (Windows) systems. Programming PLCs is often done through a direct cable connection, so while keeping industrial control systems off 'The Internet' may be a good idea, it isn't sufficient to prevent such an attack.

      --
      Have gnu, will travel.
    2. Re:computer systems that control the real world? by geekoid · · Score: 1

      This types of attacks should happen regardless of the OS.

      These are specifically targeted attacks, the manly take advantage of human trust.

      And yes, the SCADA systems need to be isolated, and then need to only allow access from specific machines.

      OTOH, that level of security is expensive, and for some reason everyone thinks infrastructure programs don't cost money. and all money the government gets is 'waste'.

      --
      The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
  25. UR doin it rong! by wiredog · · Score: 1

    Pull the other cable.

    Not that one! You'll go blind!

    --

    Best Slashdot Co
  26. Hyperbole. "Out of control... destroying" by Anonymous Coward · · Score: 1

    "spinning out of control and destroying themselves"

    The image the author creates is of a machine spinning at such velocity it explodes in a shower of fragments. While that makes for great copy, it's hardly what happened. In reality, Stuxnet caused the affected centrifuges to alter their rotational speed by only a few percent, which resulted in lower material rendering in the cascading purification process. This result has several advantages to a "self-destructing" centrifuge. 1) a destroyed centrifuge is an obvious problem which would trigger immediate investigation, while a "drifting" (and misreported) spin rate is not easily discovered 2) an undetected problem tends to pollute product quality and lead to doubts and investigations of all areas of the manufacturing process -- wasting time and expert resources diagnosing the root cause
    I think you get the point.

  27. They shuod keep then secret by geekoid · · Score: 1

    there should also be strict government oversight to ensure the vulnerabilities are being fixed.

    --
    The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
    1. Re:They shuod keep then secret by VortexCortex · · Score: 1

      there should also be strict government oversight to ensure the vulnerabilities are being fixed.

      ... And that the fixes don't make it to other governments. See: VUPEN's alleged Chrome exploit.

      VUPEN released a video of the exploit in action to demonstrate a drive-by download attack that successfully launches the calculator app without any user action.

      The exploit shown in this video is one of the most sophisticated codes we have seen and created so far as it bypasses all security features including ASLR/DEP/Sandbox (and without exploiting a Windows kernel vulnerability), it is silent (no crash after executing the payload), it relies on undisclosed (0day) vulnerabilities discovered by VUPEN and it works on all Windows systems (32-bit and x64).

      VUPEN, which sells vulnerability and exploit information to business and government customers, does not plan to provide technical details of the attack to anyone, including Google.

      Guess it depends on who you think the "bad guys" are. I say, show the world and let the good 'n malicious duke it out -- hint: Bug fixes are often easier to code than full exploits.

  28. Call Jack Bauer by LittlePud · · Score: 1

    Someone has been watching too much 24 Season 7.

  29. Show that things are a-ok on the comfy VB forms by ThatsNotPudding · · Score: 1

    meanwhile, the processes race towards disaster. I assume this is what the Iranians experienced.

  30. On the other hand... by Kamiza+Ikioi · · Score: 1

    ... I can see not publicizing vulnerabilities. We don't, for instance, want our military publicly posting our vulnerabilities. Because, they sure as anything aren't going to ask for public patches. Public disclosure only really works if someone in the public can help. On the other hand, if you are running legacy systems in any number of unknown locations, you can't apply the patches anyways.

    We always talk about how bad obfuscation is as a security vector. However, it is a vector. Knowledge of a thing can be its greatest weakness. For instance, publicizing how a company's internal network is setup can help an attacker greatly. But, hiding it can increase security. It's soft security, but it's better than no security.

    --
    I8-D
  31. Re:I find the idea by thePowerOfGrayskull · · Score: 1

    Only those manufactured by Rhetorical Devices Inc.

  32. Re:I find the idea by kmoser · · Score: 1

    It would be made up of former members of Scraping Foetus Off The Wheel.

  33. More information about the reported weaknesses by Dirk+Gebert · · Score: 1

    Hi, I’m Dirk Gebert, system manager for security for Siemens Industrial Automation Systems. I’m on the team working on the topic mentioned in this article. We are posting updates on this website: http://www.siemens.com/industrialsecurity. Let me know if you have questions that are not answered there.