Slashdot Mirror
US Warns of Problems In Chinese SCADA Software
alphadogg writes "Two vulnerabilities found in industrial control system software made in China but used worldwide could be remotely exploited by attackers, according to a warning issued on Thursday (PDF) by the US Industrial Control Systems Cyber Emergency Response Team. The vulnerabilities were found in two products from Sunway ForceControl Technology, a Beijing-based company that develops SCADA software for a wide variety of industries, including defense, petrochemical, energy, water and manufacturing. Sunway's products are mostly used in China but also in Europe, the Americas, Asia and Africa, according to the agency's advisory. SCADA software has come under increasing attention from security researchers, as the software has often not undergone rigorous security audits despite its use to manage critical infrastructure or manufacturing processes. SCADA systems are increasingly connected to the Internet, which has opened up the possibility of hackers remotely breaking into the systems. Last year, researchers discovered a highly sophisticated worm called Stuxnet that was later found to target Siemens' WinCC industrial control software."
I mean, there's a security flaw in the Siemens S7. Now let's all take a wild guess what the Chinese copied.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Whoever bought Chinese software to control industrial plants should be fired and made to work in a Microsoft call center.
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
No need to unfairly single out the Chinese. I feel confident to extend that out to pretty much any nation. Wasn't our bestest friend (sarcasm) Israel found to have the biggest espionage ring yet uncovered rigth here in the US of A?
Argh. The laws of science be a harsh mistress.
I won't buy things that contain their software & anyone who does, knows what they may get.
Is this news? Whatever software you are using has vulnerabilities.
So what if the software came from China? Do you think software from San Jose is any better? I don't see any evidence of some communist party conspiracy here.
Several years ago a bean counter decided we could save money so it was recompiled from the trusted Unix platform to Windows.
Not a huge problem as in the day it wasn't exposed to the internet but today it is and now it's not just infected USB drives that do cause trouble.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
If I operated linear networks like, say, Caltrans, the California Water Project, any number of river gauges or the California Independent System Operator (electric power broker), I'd probably see this as 'relevant to my interests'.
When I see these kind of articles coming out every other day, I can't help but think that this has more to do with security agencies pushing fear in the media to justify their existence. I'm tired of reading about how China is trying to take us down. We spend and spend with money we don't have. We borrow more from China and then buy the cheapest products from Walmart not even really thinking about the slave labor that produced those products. Are they complaining about working their ass off for almost nothing?
Want more security? Fire all these stupid fear-mongering security agencies and buy some open-hardware/software solutions from an American company that doesn't outsource their engineering and manufacturing jobs. Also, please don't connect your nuclear melt-down function to port 80. Problem solved.
I can't think of any reason to have an industrial controls network directly connected to the internet. Maybe there are valid reasons; I'd love to hear them. This is not necessarily a failure of SCADA, but a failure by the engineers to properly consider security.
This may be a stupid question...
What kind of moron connects their factory-internal manufacturing systems to the Internet?
-- Terry
I didn't realize the source was sh*tty (i still have no idea who or what rense is) it happened to be the first 2 or so hits on Google. However this is established that Israel spies on the US just as much, if not more than anyone. If different sources make you feel better:
http://en.wikipedia.org/wiki/Lawrence_Franklin_espionage_scandal http://www.alternet.org/world/130891/breaking_the_taboo_on_israel's_spying_efforts_on_the_united_states/
http://www.msnbc.msn.com/id/24256527/ns/us_news-security/t/american-charged-giving-secrets-israel/
You could list *any* country here. No need to get your vagina's up in arms because someone said something bad about Israel. The point was China is just the next in a long line of countries spying. Now, it might be much worse given how much they make for the US.
Argh. The laws of science be a harsh mistress.
We need to move beyond irony in our global defense community: http://www.pdfernhout.net/recognizing-irony-is-a-key-to-transcending-militarism.html ... We the people need to redefine security in a sustainable and resilient way. Much current US military doctrine is based around unilateral security ("I'm safe because you are nervous") and extrinsic security ("I'm safe despite long supply lines because I have a bunch of soldiers to defend them"), which both lead to expensive arms races. We need as a society to move to other paradigms like Morton Deutsch's mutual security ("We're all looking out for each other's safety") and Amory Lovin's intrinsic security ("Our redundant decentralized local systems can take a lot of pounding whether from storm, earthquake, or bombs and would still would keep working"). "
"There is a fundamental mismatch between 21st century reality and 20th century security thinking. Those "security" agencies are using those tools of abundance, cooperation, and sharing mainly from a mindset of scarcity, competition, and secrecy. Given the power of 21st century technology as an amplifier (including as weapons of mass destruction), a scarcity-based approach to using such technology ultimately is just making us all insecure. Such powerful technologies of abundance, designed, organized, and used from a mindset of scarcity could well ironically doom us all whether through military robots, nukes, plagues, propaganda, or whatever else... Or alternatively, as Bucky Fuller and others have suggested, we could use such technologies to build a world that is abundant and secure for all.
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
Every country in the world spies on one another. It's SOP and has been so since countries were first recognized. What do you think the embassies are used for? Probably 70% of the embassy staffs report to their version of State Security. Diplomatic immunity is not for the ambassadors and political staff it is for protecting the spies who get caught.
"Do not run Windows on control systems." OK, What OS has no vulnerabilities open to attack?
Stuxnet did not need internet connections to infect centrifuge controllers. The infection vector is humans with thumbdrives or other means of sharing warez with access to 'secure' networks.
Other OS have vulns, but using an OS that the drones aren't tempted to touch is preferable, as well as one they DO NOT HAVE AT HOME.
The average person is tech-ignorant, that will never change and has never been different. Throw many barriers to entry to discourage them and keep them in their place.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
We call it a bug...China calls it a feature.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
OpenBSD, as of the current release.
Sure you can... if it's open-source. This isn't a "Chinese software sucks" problem, it's a "proprietary software sucks" problem.
Every line of code that we wrote was signed off by an individual chartered engineer. And that means that we printed off the entire source, and a Very Serious Chap sat down and Very Seriously Reviewed it, and if he approved it, he wrote his initials against it. Against every single individual line, using his hand, and a pen. A red pen. And if one line, one single line, didn't have that Very Serious Chap's initials against it, then the software didn't ship. No way, no how.
And once it shipped, that Very Serious Chap would Very Seriously take full responsibility for it, and for the consequences of using it, in the most literal and legal sense.
And now to save a penny in the dollar, SCADA systems are sourced from by the Whang Dong Control Systems, Light Industrial Tools and Edible Cuttlefish Products Conglomerate, of Zing Ping Province, China. WITHOUT ANY WARRANTY; WITHOUT EVEN THE IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Ain't it marvellous living in the Future?
If you were blocking sigs, you wouldn't have to read this.
You just may have given me the argument for management that I need to get away from endlessly trying to "lockdown" Windows.
"What luck for the rulers that men do not think." - Adolph Hitler
The boss is often the problem. They 'need' access from their desks to 'monitor' things. That's where the cross-over happens. One way data feeds into a reporting engine are better but then the muppets don't feel they're in control.
This isn't a "Chinese software sucks" problem, it's a "proprietary software sucks" problem.
Which coreboot-compatible motherboard are you using? What video card are you using? Do you have a RAID controller?
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
they're connecting it to the electronic Wild Wild West, the Internet.
critical systems should N E V E R be connected to an open network.
ever.
that's rule one.
why aren't the guys making these connections going to jail?
if this is supposed to be a new economy, how come they still want my old fashioned money?
I doubt many people have access to a SCADA system at home and anyone trying to compromise this type of system would have harder time getting hold of a SCADA test bed then they would getting access to any OS.
Given that China is hellbent on kicking the ass of every nation..
He says on a US-centric site. Oh, Irony, thou hast been outdone!
Similar to the upcoming US election results
You can't trust an anonymous coward.
I do my RAID in software under Linux and every GPU I own has the open-source drivers loaded.