Slashdot Mirror
SCADA Hacker: Water District Used 3-Character Password
Trailrunner7 writes "In an e-mail interview with Threatpost, a hacker who compromised software used to manage water infrastructure for South Houston, Texas, said the district had HMI (human machine interface) software used to manage water and sewage infrastructure accessible to the Internet and used a password that was just three characters long. The hacker, using the handle 'pr0f' took credit for a remote compromise of supervisory control and data acquisition (SCADA) systems. Communicating from an e-mail address tied to a Romanian domain, the hacker told Threatpost that he discovered the vulnerable system using a scanner that looks for the online fingerprints of SCADA systems. 'This was barely a hack. A child who knows how the HMI that comes with Simatic works could have accomplished this,' he wrote in an e-mail."
the upside is if you can't afford your own truck landing robot helicopter, it shouldn't be too hard to steal one. access to truck landing robot helicopters should be an inalienable right.
i bet the password was h2o
It's hard to believe that's how Micronians are made. Why don't we see it right now by having you both kiss one another?
A child who knows how the HMI that comes with Simatic works could have accomplished this...
The obvious course of action to prevent future attacks against SCADA systems is to ban all children. Problem sovled.
If what I just said sounded like a troll, it was probably just a failed attempt at humor.
The weak point is always going to be the human being. Pile on as much security as you want and people are going to find ways to disable it and make themselves vulnerable. Thousands of jobs in the tech support industry depend on it.
GOD
It was h2o wasn't it? Come on, you can tell! It'll be our little secret...
LOL! Captcha: draught
Comment removed based on user account deletion
Damn it Jim, im a water guy not a computer expert!
How many children know how Simatic works?
I'm a good cook. I'm a fantastic eater. - Steven Brust
That's the same combination I have on my luggage!
Is a FRACKING SCADA system on the internet?
The Plant manager needs to be fired on the spot. there is ZERO need to have a full connection from a SCADA system to any internet accessable networks.
An airgap for data is standard operating proceedure for these things. Hell even crap SCADA software like "wonderware" supports a unidirectional ethernet cable and UDB broadcasting of the data stream so that you can airgap it from the administrative computers doing data collection.
Note: if you don't know what a "unidirectional ethernet cable" is, think standard Cat 5 with the TX wires clipped off on one end http://www.stearns.org/doc/one-way-ethernet-cable.html and YES they do work PC to PC with the right settings or by using a switch where you can force a port on without negotiation.
No hacker on this planet can crack a system that is at the other end of this type of cable, unless he has physical access.
Do not look at laser with remaining good eye.
H2O
"There is more worth loving than we have strength to love." - Brian Jay Stanley
How about passwords that don't have to charged each 30 days and you can't use the last 4 passwords.
I want to have a guess! It would probably have been something relevant to what they do, and then they'd have removed the vowels (cunning), so:
wtr
Summation 2
I'm in this line of work.. The password was not the problem. Even the hacker is thinking like 'corporate IT' would think in terms of security. The plant floor is different.
Here's the rule: A computer that controls industrial machinery should not be connected to the Internet. The only part of an industrial process that can even possibly be connected to the Internet is historical data and alarming.
HMI software is typically a set of screens representing the automation parts of a plant process. This means that in order to start/stop a motor or energize a valve, the screen is required. It is insecure to put a password on that screen. Yes.. insecure. The priorities at a plant are different. It is always the most secure to allow control of the plant to the people at the plant. There are physical E-stop buttons on control panels in case of emergency, but the E-stop is not the end all to prevent industrial disasters. For example, if a person has his hand caught in a valve, hitting the E-stop may cause the valve to move. Another example would be an exothermic process where explosive gases could accumulate in the wrong parts of the process, hitting the E-stop may not get rid of the gas. The operator at the plant is in charge of the process - it is critical that he or she always have control over the system.
Therefore, don't connect your plant floor to the Internet.. unless you want China to be able to control it. If white-collar executive-type people want to see pretty screens, give them historical data.
--- We need more Ron Paul!
Weren't we told that this did -not- happen? I distinctly recall seeing a denial from the authorities that any water system was compromised at any time.
I assume that a tech guy set up the system: "here your current password is 'Password1' Please change it, for security reasons...
Some government sites have these onerous password requirements e.g no fewer than 15 characters, no consecutive characters even if they are a different case, at least one numeric and at least one punctuation. It's not surprising that coming up with something you can remember that fulfills these requirements is a bitch. Oh, and you have to change it periodically. IMHO, this naturally leads to writing the damn thing down somewhere.
Why the hell is something of this importance accessible from the internet???
Network admin for another city govt in Texas here... albeit a very much smaller city.
1) first of all, it's absolutely nuts to place your water purification SCADA (or even your wastewater plant's SCADA) onto any network segment that's accessible from the public Internet, and we in the IT department know that all too well, however we're not "in charge" of the SCADA systems and have essentially zero authority to do anything about it. Part of the problem here is that the folks who *are* in charge of these systems are thoroughly aware that we in IT know how to better secure their systems, but do not want us involved in any way because our security will "make things too hard for them to do their jobs".
2) The folks who run the SCADA systems on a daily basis know only two things about systems security: 1) diddly and 2) squat. They are water process and industrial chemistry people, not computer people, and it shows big time.
3) The vendors who supply and support the SCADA systems feverishly demand that the SCADA systems be easily accessible over the Internet for their convenience for remote support, and frankly do not give a rat's ass about the customers' security... their response is that security is not their problem it's ours.
So, it's no wonder these systems are getting hacked and it's going to get worse as time progresses.
ANYBODY who connects critical infrastructure control systems to the internet should be locked up for criminal incompetence..
IT IS NOT NECESSARY.
And, yes, I do know what I'm talking about.
http://youtu.be/Xy0NU-rAlT8
4:40
Flexible bare-metal recovery for Linux/UNIX
As usual, blame the owners and operators of the target, not the hacker. Because if I don't lock my front door, it's totally OK for you to come in and run up my utility bill and eat out of my fridge, help yourself to my stereo and tv while you're at it... and if I have a spare key under my hood that you find on my car, by all means, how could anyone be held accountable if they take it for a joy ride and/or steal it?
easy as 123 it's so easy to hack the water system.
It is possible to design a system that uses 3 character passwords that would still be relatively secure. 3 characters using 0-9A-Za-z and special characters would still yield 20 bits worth of entropy. If this is joined with a very low max-tries tied to the attempted username and enforced across all systems using this login, this is pretty tight. If your chances are 3/2^20 before the account permanently locks, odds it won't be broken. Remember ATM passwords are typically 4-6 digit numeric. This low entropy (13, 20 bit) is mitigated by eating your card if you screw up your password more than a few times.
I'm not condoning the use of pathetically short passwords here. I'm just highlighting the importance of other password related security measures that need to always be taken into account. I've broken into a major academic portal system (yes authorized) used by multiple large institutions before because of shitty implementations.
The most telling thing, for me, was this section of the linked article:
So...in the instance of a single shoe bomber, stopped by his own stupidity and the efforts of other airline passengers, TSA (a section of DHS) responds by calling it a systemic risk to air travel, and we must all take off our shoes. In the instance of a plot to use liquid explosives, which probably wouldn't have worked and was stopped in the planning stages, TSA responds by calling it a systemic risk and we must all limit ourselves to 3oz bottles of liquids that fit in a quart size bag. In the instance of a single underwear bomber, stopped by his own stupidity, TSA responds by calling it a systemic risk to air travel, and we must all be subject to X-ray/millimeter wave scanners and/or the big Grope.
In the instance of SCADA hacking, which could conceivably harm our infrastructure on a significant and systemic level from afar, with little/no risk of the perpetrators being caught, DHS responds by saying, "No big deal."
There's something very...wrong here.
some PHB who does not want to pay for on site staff say make so the work can be done remotely.
A child who knows how the HMI that comes with Simatic works could have accomplished this,' he wrote in an e-mail.
And a child knows too that you shouldn't break into other people's property...
That is annoying, forcing me to change my password at the end of the month from H@cker1 to H@cker2 to H@cker3, and H@cker4 before I can go back to the password I like, but they IT work preventers at my work are really good, so when I am working on the road for 2 weeks, they make sure I can't change my login password without being on the intra-net, and once I am 2 days passed the expire date, the prevent me from launching VPN, joining web meetings... So then I have to use gmail to email a co-worker my passwords so he can change them for me on connected laptop first. Lots of fun.
The most common passwords are god, love, sex, and password. Doesn't surprise me. Why was god on the mainframe this late at night, anyhow? Zero cool would have done better.
More than half of the URLs referenced by the webpage you posted regarding unidirectional ethernet cables do not load. I've never heard of anyone selling these, and it's obvious that knowledge of it is sparse and vanishing. Maybe this is why the fellas setting up the SCADA systems never thought of it? Also, keep in mind the reason these systems are hooked up to the internet is that the managers are lazy and don't want to have to go to each location, so they set these systems up for remote access. Lazy people aren't going to bother with a sophisticated solution like this, it requires too much effort. Seems like there should be a company that sells them easy to use cables, ready-made. Even then, they probably won't use them because it takes less effort not to address the problem at all and just hope nothing ever happens. Hope is cheap.
The password, the isolation, the technobabble is not the problem. Bad people are the problem. Start hunting down and exterminating bad people. If the prize for hacking into a water plant is 15 minutes of fame followed by an early grave we'll see the population of scumhackers nosedive.
A password is either compromised or it is not. Age doesn't have anything to do with it.
I wonder if this is why my water pressure has been crap the last couple of days.
Before I left Unisys, I think mine got from 01 to 18. For some reason I was excited about reaching the big 2-0.:P
I would say the odds were pretty good they made the mistake of hieing an aggie.
Things that need external service technicians often have very simple passwords. For example I work in health care and I know of at least two major companies who's components have the same login for every site for administrator access. You probably as a customer could insist on changing it but the vast majority of sites don't. So need to give someone some radiation? You know the password. That said it isn't going to affect a whole community but the 30-100 patients that get treated before the problem is detected? Very doable. Similarly wifi routers from ISPs almost always have a default password most people I know change the WPA key but don't touch the admin account password. So anyone allowed into the network (or who can plug a network cable into the back of the box for a couple minutes) can take it over pretty easy. Not a real big deal I realize because if they change the password to login (since they don't know yours presumably that is what they would do to get internet access) you'd realize it isn't working and work to set it back. But if you are running a wired network primarily but it is a wifi device could be an issue.
And "123" (without quotation marks) is my password.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
At a larger scale: say your China and you are hacking power plant passwords to be able to shut them off (not blow them up). If the passwords are cycled frequently you likely will always have some passwords you've cracked and some you haven't, but the chances that you'll get a sufficient subset of the passwords cracked so you could completely bring the power grid down in a geographical area is remote.
http://threatpost.com.nyud.net/en_us/blogs/hacker-says-texas-town-used-three-digit-password-secure-internet-facing-scada-system-112011
So is the electrical grid. (Or at least some of the big windmills from Endurance Wind Power.)
At my previous employer we started using the month at the end of our passwords so IT implemented a 24 password history... I just moved to 'yydd'.
Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
I hate passphrases because I once used one for PGP and then forgot which verbs were in the past tense and which weren't. I guess I could have hacked my passphrase easily, but I didn't really need it, so I gave up.
Hey don't blame me, IANAB
Security theatre:
This is a demonstration of how vulnerable crucial infrastructure is, and it will be used to justify the already bloated budget for "homeland security" and "cyberwarfare". Budgets will be increased by billions more to address this imminent threat.
Reality:
A bunch of incompetent idiots were too lazy to come up with a decent password or to isolate a critical system from the internet because they haven't been paying attention to the last 2 decades of security-related research and money spent to implement it. There's no sign this kind of incompetence will be cured by spending more money.
My employer does this, so every 30 days I go through the following routine:
8:00 AM - Change password to PASSWORD2
8:01 AM - Change password to PASSWORD3
8:02 AM - Change password to PASSWORD4
8:03 AM - Change password to PASSWORD5
8:04 AM - Change password back to PASSWORD
Sit back for another 30 days.
What IS a worry to me is that this is the SECOND SCADA system hacked in about as many days, despite Homeland Insecurity insisting the first case was a one-off.
Worry 1: We now know that there are many such systems connected to the Internet without even basic security. There's plenty of reprogrammable zombie networks and plenty of people with zero conscience, although the good news is that most of the latter are in politics and so safely isolated from reality.
Worry 2: At best, it means that those entrusted with national cybersecurity are clueless about people. At worst, it means that those entrusted with national cybersecurity are clueless about computers as well.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
the password was god, that'd be so corny since I heard it was a common password from the film Hackers
First scenario. A group of disaffected youth break into a business with a crowbar. They steal the cash box and trade the list of credit card reciepts to the local dope dealer for a couple of lids. They trash the inventory and take what they want. The local police later arrest the group trying to fence the stolen goods at a local pawn shop. They goto court and their defense is that it was the shop owner's fault that he didn't have an infantry squad guarding his store. They are sentenced to 1-3 years in the penitentary and the community is glad that the group of thugs are off the street.
Second scenario. A group of disaffected youth gain entrance into the computer system of a business with a script. They take the database table of credit card users and sell it online to the Russian mafia then go buy a couple of lids. They truncate the database's table of customers and have online system ship electronic goodies to their Mom's basement. They go online and claim that it is the business owner's fault that he didn't have the latest and greatest security system. The Slashdot crowd acclaim their skillz and anxiously await their next exploit.
More like some PHB who has to field calls on weekends/holidays w/o overtime pay and would like to do it remotely.
..used a password that was just three characters long.
Amazing, "1 - 2 - 3? That's amazing! I've got the same combination on my luggage!"
We need more fingerprint hardware instead of passwords.
After seeing my kids cellphone with a fingerprint reader I've come to realize that they should be everywhere so that we don't have to remember sets of pin numbers to check out groceries, etc.
Well not everywhere but in places which are generally public so that there is little chance of hanky panky (stealing prints, etc.)
Maybe using the same password that is used on your luggage was not such a great idea. Well at least it didn't control the air shield. :D
Secure network management of remote systems, including SCADAs, is known for decades. To have a system disconnected from remote network management station is not an option from business operating point of view, unless wanting to stay in the stone age.
Promoting personnel on the basis of less competency, so as not to endanger own management position, is the core problem. In a short while all management are douchebags. Promoting at random, such as throwing dice would help.
They should honestly make weak passwords a criminal offence on national infrastructure.
How about "OPE" = "Our Pure Essence" from Dr. Strangelove?
#1 The attack came from the former Warsaw Pact and
#2 Obviously, the Communist conspiracy is out to contaminate our "Precious Bodily Fluids"!
Tracy Johnson
Old fashioned text games hosted below:
http://empire.openmpe.com/
BT
We in IT understand that you are not interested in the security of your laptop and being able to sign in with the easiest password possible. You have things to do. We really do understand that. You however, need to understand that the data on that machine is not yours. It is the company's data. The company does not want to see their data compromised, damaged or pilfered in any way. The "IT work preventers" as you call them are tasked with the company's best interests, not yours. Having to remember to change your password every thirty days is not that bad. It is not your IT departments' fault that you are more concerned with password change time frames, than you are with your job. That constitutes pure laziness and arrogance on your part. You are also the type of user that visits questionable websites and allows family and friends to your your work machine, gets some kind of virus or malware and then tells IT that you have "...no idea how that stuff got on there..." We all know your type.
Winter or Spring?
Instead of concentrating the cost prohibitive approach of trying to secure from the SCADA standpoint, more interest should be put into analyzing why these systems are accessible over the internet. Does each system really need to be accessed externally? If you put effective firewalls, password management, quotas and access controls on the web portal you won't have to worry about all of the internal workings. If you lock the front door to your home, there is no need to lock every interior door. Systems such as these shouldn't be easier to hack than a facebook page.
I've got the same combination on my luggage!
In soviet russia password cracks you!
xkcd reference
It's less than one Library of Congress
Have i missed any you insensitive clod?
ah crap! i forgot:
Your ideas intrigue me and I wish to subscribe to your newsletter.
After three wrong tries me bank locks me out. How difficult is this system to implement? You could also time password tries. 1000 times in one second might be a clue that a computer is trying to hack the account. Either that or someone can really type fast but has a very poor memory.