Slashdot Mirror
US Warns of Problems In Chinese SCADA Software
alphadogg writes "Two vulnerabilities found in industrial control system software made in China but used worldwide could be remotely exploited by attackers, according to a warning issued on Thursday (PDF) by the US Industrial Control Systems Cyber Emergency Response Team. The vulnerabilities were found in two products from Sunway ForceControl Technology, a Beijing-based company that develops SCADA software for a wide variety of industries, including defense, petrochemical, energy, water and manufacturing. Sunway's products are mostly used in China but also in Europe, the Americas, Asia and Africa, according to the agency's advisory. SCADA software has come under increasing attention from security researchers, as the software has often not undergone rigorous security audits despite its use to manage critical infrastructure or manufacturing processes. SCADA systems are increasingly connected to the Internet, which has opened up the possibility of hackers remotely breaking into the systems. Last year, researchers discovered a highly sophisticated worm called Stuxnet that was later found to target Siemens' WinCC industrial control software."
You can't trust the Chinese.
I mean, it's chinese !!
I mean, there's a security flaw in the Siemens S7. Now let's all take a wild guess what the Chinese copied.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Whoever bought Chinese software to control industrial plants should be fired and made to work in a Microsoft call center.
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
I won't buy things that contain their software & anyone who does, knows what they may get.
Is this news? Whatever software you are using has vulnerabilities.
So what if the software came from China? Do you think software from San Jose is any better? I don't see any evidence of some communist party conspiracy here.
Several years ago a bean counter decided we could save money so it was recompiled from the trusted Unix platform to Windows.
Not a huge problem as in the day it wasn't exposed to the internet but today it is and now it's not just infected USB drives that do cause trouble.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
If I operated linear networks like, say, Caltrans, the California Water Project, any number of river gauges or the California Independent System Operator (electric power broker), I'd probably see this as 'relevant to my interests'.
When I see these kind of articles coming out every other day, I can't help but think that this has more to do with security agencies pushing fear in the media to justify their existence. I'm tired of reading about how China is trying to take us down. We spend and spend with money we don't have. We borrow more from China and then buy the cheapest products from Walmart not even really thinking about the slave labor that produced those products. Are they complaining about working their ass off for almost nothing?
Want more security? Fire all these stupid fear-mongering security agencies and buy some open-hardware/software solutions from an American company that doesn't outsource their engineering and manufacturing jobs. Also, please don't connect your nuclear melt-down function to port 80. Problem solved.
I can't think of any reason to have an industrial controls network directly connected to the internet. Maybe there are valid reasons; I'd love to hear them. This is not necessarily a failure of SCADA, but a failure by the engineers to properly consider security.
This may be a stupid question...
What kind of moron connects their factory-internal manufacturing systems to the Internet?
-- Terry
Given that China is hellbent on kicking the ass of every nation..
We need to move beyond irony in our global defense community: http://www.pdfernhout.net/recognizing-irony-is-a-key-to-transcending-militarism.html ... We the people need to redefine security in a sustainable and resilient way. Much current US military doctrine is based around unilateral security ("I'm safe because you are nervous") and extrinsic security ("I'm safe despite long supply lines because I have a bunch of soldiers to defend them"), which both lead to expensive arms races. We need as a society to move to other paradigms like Morton Deutsch's mutual security ("We're all looking out for each other's safety") and Amory Lovin's intrinsic security ("Our redundant decentralized local systems can take a lot of pounding whether from storm, earthquake, or bombs and would still would keep working"). "
"There is a fundamental mismatch between 21st century reality and 20th century security thinking. Those "security" agencies are using those tools of abundance, cooperation, and sharing mainly from a mindset of scarcity, competition, and secrecy. Given the power of 21st century technology as an amplifier (including as weapons of mass destruction), a scarcity-based approach to using such technology ultimately is just making us all insecure. Such powerful technologies of abundance, designed, organized, and used from a mindset of scarcity could well ironically doom us all whether through military robots, nukes, plagues, propaganda, or whatever else... Or alternatively, as Bucky Fuller and others have suggested, we could use such technologies to build a world that is abundant and secure for all.
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
You don't think that applies to German, Russian, US, or *insert nation state here* as well?
Well actually it doesn't since you can't "know" what you might get... it might well be something entirely new :P but that applies to China as well.
Stuxnet did not need internet connections to infect centrifuge controllers. The infection vector is humans with thumbdrives or other means of sharing warez with access to 'secure' networks.
Security problems in software? Made by the Chinese?? Wow. That would NEVER happen in software developed in the US...
Unless there's evidence the vulnerabilities were put there deliberately, how is this newsworthy?
We call it a bug...China calls it a feature.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Every line of code that we wrote was signed off by an individual chartered engineer. And that means that we printed off the entire source, and a Very Serious Chap sat down and Very Seriously Reviewed it, and if he approved it, he wrote his initials against it. Against every single individual line, using his hand, and a pen. A red pen. And if one line, one single line, didn't have that Very Serious Chap's initials against it, then the software didn't ship. No way, no how.
And once it shipped, that Very Serious Chap would Very Seriously take full responsibility for it, and for the consequences of using it, in the most literal and legal sense.
And now to save a penny in the dollar, SCADA systems are sourced from by the Whang Dong Control Systems, Light Industrial Tools and Edible Cuttlefish Products Conglomerate, of Zing Ping Province, China. WITHOUT ANY WARRANTY; WITHOUT EVEN THE IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Ain't it marvellous living in the Future?
If you were blocking sigs, you wouldn't have to read this.
Who is surprised?: TIme to Tighten things up and take some sort of control.
Is that to fucking hard to understand.
> Two vulnerabilities found in industrial control system software made in China
If there were only two vulnerabilities, China clearly didn't copy it from any western developer of SCADA software.
they're connecting it to the electronic Wild Wild West, the Internet.
critical systems should N E V E R be connected to an open network.
ever.
that's rule one.
why aren't the guys making these connections going to jail?
if this is supposed to be a new economy, how come they still want my old fashioned money?