Slashdot Mirror
Researcher Claims Siemens Lied About Security Bugs
chicksdaddy writes "A month after an unknown gray hat hacker calling himself 'pr0f' used a three character password to hack his way onto Siemens software used to manage water treatment equipment in South Houston, Texas, a security researcher working for Google is accusing the company of trying to cover up the existence of other, more serious vulnerabilities in its products. Billy Rios has disclosed a range of vulnerabilities in Siemens SIMATIC software on his blog. The holes could allow a remote attacker to gain access to the Simatic user interface without a user name and password. Rios claims that he has disclosed the hole to Siemens and that the company has acknowledged the problem, only to deny its existence when a reporter asked for more information about the vulnerability."
The main problem these things have is that there's nothing more than password authentication protecting them from any random user getting in, and sometimes leak or get guessed.
For this kind of access there should be a technician dispatched to the site... no remote login should be allowed. Water control is a lot like Enron's electricity control in that a wipeout of any size can cause a complete mess of a local economy.
Iff the rest of their company sucks as badly as their professional services group, color me unsurprised.
I seem to remember seeing SCADA vulnerabilities being added to vulnerability testing tools and IDS systems recently -- anyone know if this is related (ie: the tools now check for these non-existent flaws) or if the additions were to cover previously-reported bugs?
If the former, Siemens had best fix this damn fast. Infrastructure companies are in a corner - they don't have the cash for a major migration and alternative vendors are hardly thick on the ground. Some will be unable to afford decent security and others will be too politicized to secure their networks. Much of the infrastructure is too big and/or too expensive to duplicate, so the market is useless. The only place this can be fixed is at Siemens itself. The others that technically could won't and the rest can't.
The problem with the current paranoia over security is that you can't fix a fault you won't admit exists, companies won't deploy a fix if you tell them it's not needed, and so what you're ultimately left with is not security, merely obscurity.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
I may misremember things, but wasn't the whole water-treatment plant 'hack' a legitimate worker logging in from his holiday in Russia, and some wannabe hacker claimed responsibility with fake screenshots?
I has been my expereince that many verticle market applications are poorly written with security being the least of their concerns. Now that *everything* is seemingly connected, extended and exposed to the internet it is only compounding the problem. Security needs to be built in to the core development tools tightly in order to stop these kind of things from happening. The last thing an application developer wants to worry about is security getting in the way of his/her code development. If I see another VB6 app out there I am going to, well, it's not pretty.
SCADA systems (Simatic or any other) should not be accessible from outside the plant.
Agreed that security needs revamping, but the main point here is that the plant control system is accessible from outside. That's the main problem, it should never be like that. You don't give access to a banks db's from outside its offices, don't allow access to missile launchers from the internet, so why on earth are people connecting a water plant control system to the internet?
The problem is not necessarily with Siemens. Industrial controls in general are not inherently meant to be accessible over large networks. They're designed to run reliably as they are, not with patches and updates. This applies to anything from Siemens/Fanux/Rexroth/Allen-Bradley/Mitsubishi to Cognex cameras to ABB/Fanuc/Kuka robots, or any little bastardized system in between.
Why not? Well, there is a ton of weird, unique software that runs on industrial controllers. They run some really embedded HMI (Human Machine Interface) software on top of, say, XP Embedded, or even NT4 or Win2k or some Linux flavor, or WinCE. If you start throwing out patches to those systems, there is a very very good probability that at some point, the system that you are updating will fail due to the update. Heck, Siemens updates regularly break its own software, much less Windows patches. If you try, and screw things up, you're forced to revert to some old dated backup or Ghost image stored in a filing cabinet on a CD-R or server if you're lucky. If you're not lucky, you call the vendor in to fix your broken system. Hopefully they are competent enough to have a backup from their last visit 6 years ago, and work from there, losing all your work in the meantime. So, you have machine downtime of hours, days, or even weeks if you're not lucky. How much does downtime cost? It depends on how many systems you took down, and the product. Conservatively, anywhere from $5,000 to $1,000,000 per hour.
What to do? You obviously can't push out patches. But, there is a lot of good that comes from monitoring machines, their productivity, uptime, faults, etc, remotely. By taking these systems off of an internal network, you also lose productivity in efficiency losses. So, you're forced to be the High Priest of IT and lock down a network like no other. No outside USB sticks, manufacturing firewalled off from the rest of the plant, and all kinds of restrictions that make users angry. It sucks, but it's possible. Unfortunately, small time manufacturers with their one part time learn-on-the-fly IT guy probably won't do it right. Perhaps this is where the DHS can come in to help, in the name of national security?
The OP claimed that Siemens lied about the security of their SIMATIC controllers, but don't you have to know you're lying in order to lie? Having dealt with Siemens over these things in the past (at one point we debated flying someone to Munich to club them repeatedly over the head until they realised there was a serious, showstopper flaw in their control system), it's quite probable that they genuinely believe that they're secure. We ended up using Allen-Bradley gear in the end, which also sucked, but not as much as the Siemens stuff.
It seem to me that big companies often think that they can get away with lying. And I suppose it's because it's such a big company that they think this.
When life throws questions at you, Google has the answers.
You can't blame the vendors as the sole culprit in this. A lot of the protocols that are industry standard, such as modbus, were invented long before security was a concern. They simply cannot stand up against modern hacking techniques. And until the industry catches up this will not change.
However this is a known issue and any competent engineer designing these systems accounts for the insecurities of these systems by requiring that the networks these devices sit on are isolated.
The biggest problem I've seen in the industry is that a lot of the companies that end up using these products go the cheap route whenever possible. So instead of laying down fiber optic cable or a radio link from the local dispatch office to a remote piece of equipment down the road, they opt to connect the remote system over the internet via consumer dsl service. Unbelievable really.
The OP claimed that Siemens lied about the security of their SIMATIC controllers, but don't you have to know you're lying in order to lie? Having dealt with Siemens over these things in the past (at one point we debated flying someone to Munich to club them repeatedly over the head until they realised there was a serious, showstopper flaw in their control system), it's quite probable that they genuinely believe that they're secure. We ended up using Allen-Bradley gear in the end, which also sucked, but not as much as the Siemens stuff.
That could be used as an explanation to escape just about any lie.. :)
I guess the point is, that if a security researcher sends you detailed information on vulnerabilities in your system, then either don't answer, or give a decent reply. If after 6 months the Siemens guy was not lying it means they are not very competent. It's not like this was a complicated issue...
The OP claimed that Siemens lied about the security of their SIMATIC controllers, but don't you have to know you're lying in order to lie?
.. it's quite probable that they genuinely believe that they're secure.
In case of Siemens, it's security-through-fucking-impossible-to-configure method, also known as "don't touch it, ever, hope it works".