Slashdot Mirror
Siemens SCADA Flaws To Be Disclosed At Black Hat
itwbennett writes "In May, NSS Labs Researcher Dillon Beresford pulled out of a Dallas hacking conference at the last minute when Siemens was unable to fix problems he'd found in the firmware of its S7 programmable logic controller. Now NSS Labs CEO Rick Moy says Beresford is rescheduled to deliver his talk at Black Hat, which runs Aug. 2-3. Beresford has discovered six vulnerabilities in the S7 that 'allow an attacker to have complete control of the device,' Moy said. Devices like the S7 do things such as control how fast a turbine spins or open gates on dams."
Does Mr. Beresford realize that, in the blasted wasteland that follows the fall of industrial civilization, pasty computer experts are relegated to the status of "slave" or "food source" by psychotic warlords wearing football/BDSM themed armor?
Make sure that Lord Humongous owes you some favors before Blackhat rolls around, everyone!
Devices like the S7 do things such as control how fast a turbine spins or open gates of doom.
FTFY
Questions raise, answers kill. Raise questions to stay alive.
I have Siemens hearing aids... does that mean someone is going to hack my head through the aids' wireless (used mostly to communicate between the two)?
NSS Labs expects Siemens to issue a patch in the next few weeks, well ahead of the August presentation. "They didn't give any firm timelines," he said. "They said unofficially that they were pretty confident that they'll be able to get their stuff out before then."
Beresford wasn't impressed with that comment. [...]. "Now that they're trying to minimize the impact and do PR damage control, I feel that they're not servicing the public's interest," he said. "I'm not pleased with their response... They didn't provide enough information to the public."
What if Siemens confidence evaporates and, August time, some of these vulns are not yet patched? Will they allow the presentation?
Questions raise, answers kill. Raise questions to stay alive.
I've worked with Siemens' S7 and SiMotion systems, and i've never seen a single company attach them to a large computer network inside their company.
The only ways to reprogram S7 or SiMotion is by either connecting to an ethernet / profinet connection the machines are on, or by acquiring physical access and establishing a serial connection.
I work with PLCs (Programmable Logic Controllers like the article mentions) and to be honest it's news to me that they even HAVE security.
Most PLCs will accept any data table read/write, any programming command and any firmware update without any authentication whatsoever. Also the SCADA system (the visualisation system which talks to the plant's PLCs) will typically run on Windows XP, usually without any service packs/patches, no antivirus, and often the Windows firewall disabled. "Security" on a SCADA is typically implemented only by disabling mouse events on the client-side command button if the operator does not have appropriate access level.
In any control system there's data that needs to be analyzed. Someone has to transfer telemetry from the control system to an engineer's workstation. Today this is normally done by an USB stick, if there's no direct network connection, and that's the weak point.
I believe a secure network connection is better than the "sneakernet" approach. It's better to have a good firewall allowing only a limited set of ports than to let people plug things into the computers.
Another good approach would be to transfer the data through CDs or DVDs, using only new, blank media, but there would always exist the risk that someone would use an old CD containing malware.
it would be more likely the DHS muscled NSS out of the conference, if there was any of that kind of play involved. If not, then they did what any reasonable researcher, and in fact person, should do; Assess the danger to society caused by withholding the information against the damage done by releasing it.
This kind of information should always be released. The problem is that people in the DHS think the movie "War Games" is a documentary.
The real danger is not a random script kiddie connecting to the system to play games. Danger comes from people who have inside knowledge of the system, people who know things like network addresses, which machine does what. There's no way to be obscure here, because the enemy already knows what he needs to enter. Remember stuxnet, everyone seems to agree that it was the work of experts.
Sharing the information about vulnerabilities is what allows people to take precautions. Of course, the correct procedure would be to first inform the manufacturer and let them contact the system users before publishing the data, but what if the manufacturer is not doing their part? Better let the users know, through whatever means are available.
"the SCADA system (the visualisation system which talks to the plant's PLCs) will typically run on Windows XP, usually without any service packs/patches, no antivirus, and often the Windows firewall disabled.
"Security" on a SCADA is typically implemented only by disabling mouse events on the client-side command button if the operator does not have appropriate access level"
"SIMATIC PC-based Controllers use a real-time-capable software controller based on Windows operating systems .. Software controller for Multi Panels Control, operation and monitoring on a well-proven and extremely rugged Windows CE platform in real-time"
Clearly, the real embarrassment here is that the DoD is using these vulnerabilities to kill Iranian centrifuges. I don't have a problem preventing Iran from having nukes, as I think they should not ever have them. However with the recent "cyber security" announcement that digital hacking can be considered an act of war, I wonder if we'd have come to the same conclusion if we were in missile range of Iran.
Releasing these hacks could have unintended consequences. Imagine if some hacker group used them for their own nefarious purposes... There could be floods, explosions. Real-world consequences. Not just some stolen passwords.
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
A fundamental principle of security: critical infrastructure (flood gates, nuclear power plants...) doesn't connect to the internet. Any design that violates this basic principle of security should be considered proof of criminal negligence. (I'm not a lawyer). You are not responsible for what happens when you release details of serious security vulnerabilities if you've told them about the problem and given a reasonable amount of time given to repair the fault.
Doing security patches on embedded systems takes a lot of time. The code could be running from ROM chips that must be physically replaced, and the code must be audited to ensure no bugs or new security issues- and you might not have a list of who has your device (they might not know either). When your code runs the flood gates on a major dam you must be very sure it works properly.
Check to see if your Company name is available http://bit.ly/m2IHF4
These folks need to go open source.. for the safety of the world!
In fact.. go one step further and have all governments of the world require all public infrastructure to only be run on open source systems. This is our only hope of staying ahead of terrorists. This same type of problem (and need) has also been seen in the problems with US electronic Voting Booth. The recent RSA seed + proprietary algorythm lead has proven that closed source = security risk. Wake up politicians!
Tweeks
Wait for more of such stuff to come in future. What else do you expect when they hire cheap programmers and overpaid executives ?
I think that Stuxnet permanently put the rest the idea that disconnecting your critical systems from the internet was sufficient to secure them. Sure, you need to do it, but you also need to (somehow) prevent your users from moving contaminated media into your secure systems.
I am thinking of the Modicons and Allen Bradley PLCs around the world.
On the PLC5 and the SLC-500, security (if set) was generally an afterthought and then normally used to keep factory floor folk out of the PLC. I know because I knew where to find the text-encoded password in the memory dump files.
The ControlLogix was a similar open book - rarely if ever secured. Then again, you could get on the backplane via the ENBT adapter and then talk directly to any card in the system including the SERCOS cards and the ControlNet/DeviceNet/Data Highway cards.
Modicons = what security.
Of course, this was some 10 years ago and things might have improved somewhat since then (not holding my breath though).
And yes, Allen Bradley and Modicon are used in a LOT of critical infrastructure locations.
Ron Gage - Westland, MI
A black hat is actually withholding info on how to control a device because he's concerned it will be used for such a thing? HUH?!?!? Who ARE these people?
Could Arduino be a "cheap" hardware upgrade from what we are currently using? Would Arduino be more secure? Subquestion... Is there software/firmware upgrades that could be used to fix these flaws? Yesterday?
"Lottery: a tax on people who are bad at math." Churchill, W. Can I get an AMEN!!!!?
Fsck society! What's it really done for us lately?
The new right fascists are bilingual. They speak English and Bullshit.
Oh DarkTangent will save us all from the impending doom.......
daed