Slashdot Mirror
Private Key Found Embedded In Major SCADA Equipment
sl4shd0rk writes "RuggedOS (A Siemens Subsidiary of Flame and Stuxnet fame), an operating system used in mission-critical hardware such as routers and SCADA gear, has been found to contain an embedded private encryption key (PDF). Now that all affected RuggedCom devices are sharing the same key, a compromise on one device gets you the rest for free. If the claims are valid, systems in use which would be affected include U.S. Navy, petroleum giant Chevron, and the Wisconsin Department of Transportation. The SCADA gear which RuggedOS typically runs on is often connected to machinery controlling electrical substations, traffic control systems, and other critical infrastructure. This is the second security nightmare for RuggedCom this year, the first being the discovery of a backdoor containing a non-modifiable account."
Never, ever, name any software "Rugged".
You're just asking for it.
Faster! Faster! Faster would be better!
The embedded controller market is a market full of devices programmed by hardware engineers, not by security professionals. They don't open up their systems for peer review and thus security flaws make it into the final product. There is definitely a sense of security through obscurity with those products, and it almost works except that the internet makes it too easy to broadcast information to the world.
At least now they know that their system is insecure, instead of having it come as a complete surprise when some attacker exploits the weakness to cause some sort of disaster.
I read the internet for the articles.
That part isn't the story. The story is the fact that they all have the same one. That part is insanity. Without key lifecycle management, including creation, distribution, and revocation, you might as well not use asymmetric encryption at all.
Hooray! We're all doomed... DOOOOOOOOOOOOOOOOOMED.
Wait, what does the WiDOT have that's SCADA that would end the world? I think the worst that would happen is that the times on the billboards above 41 would be wrong... or warn us of zombies ahead.
It is obvious by now.
To provide "mission critical" and then share weaknesses around.
To insert single point of privacy/authorization failure...
And all that from a German company.
Still puzzled.
http://opencm3.net, http://www.nongnu.org/gm2/
What the fuck is wrong with people? Don't they know we live in a post-PC world? Just throw that old gear on the trashpile of history where it belongs and buy everybody iPads. Problem solved.
L /thread
What possible reason would there be to have a shared private key among all devices? Even if there is some (weird, and probably not a good idea) requirement that it be identical across an entire user site, that should be part of a programming/keyfill process. If uniqueness is good, it should just generate a key on first boot...
"The vulnerability with proof-of-concept (PoC) exploit code was publicly presented by security researcher Justin W. Clarke of Cylance Inc."
I strongly suspect that the claims are valid.
Anyone care to post the PEM format version of the private key here? It would be helpful to confirm that it is not protected by a password that is also hardcoded into the firmware.
By now they're not even trying anymore.
And what do you want to bet that the backdoor came from an unfriendly foreign power in the form of an intern or a contract programmer? Takers? Any takers on that action?
Note to Siemens and the US military: You are not magically protected from software sabotage, particularly when you farm out your software production overseas.
Please do not read this sig. Thank you.
Mr Potatohead!
Backdoors are NOT secrets!
Obvious answer says if the CIA did it to the Russians, and the CIA exploited Seimens controllers in Stux and Flame, maybe the CIA is who put this in too.
For a few million dollars Siemens will quickly patch it.
They really didn't think the PLA was going to miss an opportunity for sabotage like this.
If the rich people in the US did not want to anger the PRC we would already have restricted purchasing anything that handles data for infrastructure or military to US made only.
I guess Richard Stallman was right, Run free software or risk losing the war and your freedoms.
When all your drones stop working Jar-Jar wins.
who's the researcher behind this? is he some sort of hacker who has it out for Siemens??/
How do we know he isn't a CIA cover story for spreading FUD about German engineering?
I lay blame at the CA's, I've spoken to two CA's about using certificates in Embedded devices using lots of low cost subdomains guid.domain.com Both recommended that I just use a wildcard certificate.
This is where we discover that the software development was outsourced to China or India, right?
I seem to recall a DARPA initiative to come up with ways of finding hidden backdoors built into hardware.
I've forgotten the details, but look up the Trust in Integrated Circuits program. Then too is the industry speculation that certain failures in Iraqi and Syrian electronics during recent conflicts was the result of such backdoors and not conventional EA/ECM techniques. So the US military is certainly aware of the possibility, it's just that, for now, they do not yet have any way of detecting or dealing with it.
There is no involvement of the Chinese in this story at all. The original company that created RuggedOS is Canadian. Who the heck modded the parent +5 Insightful?
fear crazed americans
They may be based in Canada, but RuggedCom's equipment is manufactured in China.
you cannot have security if you have random connections... walkabout machines, removeable media that can be read by office and home machines, modem connections, most evil The Connected Internet... that permit a cross of the security barrier.
there has to be an airgap, and the secure stuff stays inside the secure area, and the other world(s) can't get in there.
otherwise, you are open to attack, and eventually will be attacked.
amazing how damn lazy everybody has gotten. I learned this in the 70s.
if this is supposed to be a new economy, how come they still want my old fashioned money?
i-th root of pi minus 1 in a 17-bit field. you're welcome, feel free to implement it in Gray code.
if this is supposed to be a new economy, how come they still want my old fashioned money?
isn't it always?
if this is supposed to be a new economy, how come they still want my old fashioned money?
by changing the single worldwide default key and sending out new manual pages telling you what it is.
if this is supposed to be a new economy, how come they still want my old fashioned money?
How can one be sure the key in question is a private one and not a public key (aside from the working PoC)?
Are there markings who clearly differentiate the two like:
<!--PRIVATE KEY GOES HERE --!>...<!-- END PRIVATE KEY --!>
or something?
Mastering the English language is fucking easy: all you have to do is to put an f* word in every fucking sentence.
So the real problem is commodity IEC 60320 power cords, that explains so many things.
Are you saying that Snow Mexicans are behind this threat?
It's not that surprising and not limited to the embedded controller market. Not that long ago (in the last couple years) a major network equipment manufacturer included a private key that allowed full ssh access to the box without a password.
Your management plane should not be accessible to anything but your management VLAN. If the bad guys have access to that, it's already all over. With management VLAN access they'd just MitM attack your SSL session and serve another "factory" cert that isn't signed by a CA and most admins will just blindly ignore it. This is not news, but a low priority patching event.
Combine a IEC 60320 power cord with a PS/2 keyboard connector and you have a problem, unless the ground on your building is protected.
Canadians?
Yo Grark
Canadian Bred with American Buttering
My local ISP has been supplying his own custom ordered vdsl router with a custom compiled firmware. One of the missing bits are the TR-069 and the auth sections from both the webui and the telnet. My bet is that they buried their key somewhere so they can force feed me firmware updates and so on.
So now any half brained hacker can brute force their key and gain instant access to my lan. Bet they can tunnel in too.
Crappy, lazy coders needed to undermine the entirety of industrialized society. Must be willing to kowtow to clueless, incompetent managers to ensure all life or death controls are as simplistic as a coloring book and as secure as an unlocked screen door.
http://www.osvdb.org/show/osvdb/81406