Slashdot Mirror
New Siemens SCADA Vulnerabilities Kept Secret, Says Schneier
From the article: SCADA systems -- computer systems that control industrial processes -- are one of the ways a computer hack can directly affect the real world. Here, the fears multiply. It's not bad guys deleting your files, or getting your personal information and taking out credit cards in your name; it's bad guys spewing chemicals into the atmosphere and dumping raw sewage into waterways. It's Stuxnet: centrifuges spinning out of control and destroying themselves. Never mind how realistic the threat is, it's scarier."
What worries Bruce Schneier most is that industry leader Siemens is keeping its SCADA vulnerabilities secret, at least in part due to pressure from the Department of Homeland Security .
Uh oh, this comment looks exactly like this comment.
Seems like Israel and the US are playing a dangerous game here. Say that Stuxnet caused an accident that released radioactive material into the environment...
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
How do you think Reese's initially got chocolate in their peanut butter?
...simply good old network security with hardened OSes (Linux, BSD, OS X) with seriously turned off all other services, firewalls and proxies with filtering won't do a trick?
Who is running industrial systems with direct contact with Internet anyway?
user@ubuntubox:~$ stfu This server is going down for shutdown NOW!
Yeah, well how would you like incubators for human babies to start spinning out of control and destroying themselves?
I'm not so worried about what terrorists might do in a cyber attack, I'm worried about the trolls.
If I can just reach out with my words and touch a butthole, just one, it will all be worth it.
Actually it's probably the CIA, NSA and other TLA's that truly want the security holes. They're just using the DHS as the mouthpiece to convince the companies to keep quiet and not plug the holes. After all, without those holes, Stuxnet (and likely other woms/viruses/trojans) wouldn't be as effective as they apparently have been.
Last I checked, 'responsible disclosure' meant giving the company time to fix the vulnerabilities before you released the info to the public.
Am I missing the part where we've gone beyond that point?
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
It was peanut butter in their chocolate
SELECT * FROM User WHERE Clue > 0
0 rows returned
or fix it, that works really well too.
That is exactly what will not happen.
The ones who should tell their Customers about the problem is Siemens. But they will play the problem down because it might affect the sales of the next batch of stuff.
The evil hacker will just buy a bunch of systems, analyze it and find the vulnerabilities. This completely independent of the disclosure. Stuxnet was developed before this disclosure and I think the vulnerabilities used by Stuxnet are still there.
This is why security by obscurity does not work in the real world.
If you want to prevent the bad guys from exploiting a vulnerability, then don't... um... tell them about the vulnerability? But do tell the affected parties about it.
I think nuclear power plants and the like warrant something a bit more than security through obscurity...
Now imagine the scenario where you have windows machines on the same network as your SCADA devices because the tools you've bought or built work this way. Someone attaches an unauthorized device to your network and fail, fail.
Now, I think we can probably agree that you can and should take steps to prevent something like that from happening, but there is the issue of getting from point A, where your network is insecure, to point B, which requires at least buying or developing a whole bunch of new software. This is non-trivial and it costs a lot of money so a lot of operators probably weren't even looking at it until recently.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Sure! "It's just a jump to the left, and then a step to the riiight..."
We're incubating troll babies?
WAH?
I drank what? -- Socrates
Not really. The process control is done on real-time controllers, but visualization is usually on windows machines. Data historians, configuration databases, OPC servers, etc are often Windows servers. Add to that that hotfixes and service packs have to be vendor approved before putting them on the live system. This means that those systems often run whatever was approved at the time of installation, which can be years out of date.
Many SCADA and DCS systems are also horribly insecure, have default or hard coded administrative passwords, etc. What doesn't help is that they are often managed by people who are good at the actual process stuff, but not necessarily at security or system administration.
I did my master's thesis on SCADA security. tl;dr: there isn't any. We're talking about an industry that uses unencrypted radio links in their control systems....
Media that can be recorded and distributed can be recorded and distributed.
-kfg
Spinning Incubator Babies would be a really excellent name for a rock band.