Slashdot Mirror
Support Forums Reveal SCADA Infections
chicksdaddy writes "We hear a lot about vulnerabilities in industrial control system (ICS) software. But what about real evidence of compromised SCADA and industrial control systems? According to security researcher Michael Toecker, a consultant at the firm Digital Bond, the evidence for infected systems with links to industrial automation and control systems is right under our eyes: buried in public support forums. Toecker audited support sites like bleepingcomputer.com, picking through data dumps from free malware scanning tools like HijackThis and DDS. He found scans of infected systems that were running specialized ICS software like Schweitzer Engineering Labs (SEL) AcSELerator Software and GE Power's EnerVista Software (used to configure GE electric power protection products). The infected end user systems could be the pathway to compromising critical infrastructure, including electrical infrastructure. 'With access to a protection relay through a laptop, a malicious program could alter settings in the configuration file, inject bad data designed to halt the relay, or even send commands directly to the relay when a connection was made,' Toecker wrote."
Why are you people posting about your nuclear power plant problems online?
Will we have to go up in front of a group and say, "Hi. My name is PPH and I plugged a thumb drive into my SCADA controller. I've been doing Windows for years and I guess it just caught up with me one day."
Have gnu, will travel.
if you keep picking on the SCADA, it will never heal!
of course it gets infected.
--
"It is now safe to switch off your computer."
Why would anyone responsible for these computers (running devices whose operation is dangerous to human life) ever connect them to the internet?? Are they complete morons? Why would they be able to keep their jobs? Are they all idiot sons of rich people and therefore can't be fired or something? I don't get it? What am I missing?
I'm a sysadmin for a small municipal office with a SCADA system. I manage every computer except the one used for SCADA, which is the responsibility of the vendor. Their only concern is that the computer stays unmodified from their "standard" set up, but it still requires unrestricted Internet access. This means:
*Windows XP SP2
*Automatic Updates turned off
*No third-party software (ex: antivirus)
*No domain/group policy
*Symantec pcAnywhere 11 host (this is the version Symantec admited to being breached and to stop using)
As the sysadmin I can stick it on a VLAN to keep it away from the computers I'm responsible for, but other than that, my hands are tied.
The only thing I could do was to log all the traffic to/from those boxes and save it in case anything happened in the future.
I blame whomever negotiated those contracts. There is no reason why those machines cannot be firewalled at the very least.
I, along with many others at my company, have Quickset loaded on our laptops. It's just configuration software that you use to prepare protective relays (and could use to communicate with them). I suppose the database on it could be hacked (it's a secured pgsql database, but that security can easily be overridden if you know what you're doing). It is *not* a SCADA package. It's on every relay tech's laptop, along with many engineers. I'd not be surprised to see virii on computers with Quickset on it at all, as many of them will be used in the corporate environment, and technician's laptops. I would be surprised to see a virus targeting the package though. Mine gets updated through the SEL Compass application, which downloads directly from their web site, and updates are fairly frequent.
Honestly, I'm not worried about Quickset. That doesn't bother me one bit, and I use it just about every day.
Even with the "perfect" airgap, many protocols are unencrypted and quite vulnerable to a $20 radio from e-bay, a tape recorder and some good timing.
I can tell you that none of the protective relays I've installed, the engineers involved didn't care one bit for security and all the SEL relays, Square D SEPAM relays, GE Relays, they are all installed with the default password with full access to anyone that has a RS-232 or Modbus cable. None of these relays are set correctly and barely anyone knows what setups to use on them. If someone really wanted to create a disaster, these relays are wide open, and someone with a laptop can easily just make a quick script to upload malicious settings and code to these relays very easily and quickly. The ones that are networked via status updates are even worse. As for SCADA systems, the majority of them are running Windows XP with no updates on, no antivirus, no anything and have full unrestricted access to the internet with full access to the PLC's on machines. These vulnerabilities have been known for YEARS by many installers, so I really don't find this article that surprising.
If someone has access to the RS232 port on the relay, you have MUCH bigger problems. Heck, they can remove the six screws and set the 'no password' jumper on an SEL relay and not worry about passwords at all.
Once physical security is compromised, electronic security is worthless. Hit the bus diff lockout switch and the station will clear anyway...
I currently take care of one the largest SCADA/DCS/PLC systems. I have had numberous discussions about security but our policy seems to be security through obscurity.
Later
ALL security is through obscurity.
Modbus cable? What kind of security are you dealing with here? From what I can gather the only time someone will be able to start messing with this stuff is if they are there, standing right in front of the relay. At this point all bets are off. There are many thousands of things someone could do at a plant to wreak havoc even once you have passworded your modbus interface, and many of them are far less technical than modifying a protective scheme so why bother.
If this is your only remaining concern I would like to hear about their excellent use of physical security (i.e. locking non-authorised people out of the room with the important technical thingies). I would also like to hear how the electricians and engineers can get in and adjust these relays, how long does someone need to work at the plant before being given the password to make changes? If your answer is that they have access to the systems as soon as they've completed training then you're going to fall for the same attack as Stuxnet, an inside job involving a piece of gear plugged directly into system by a trusted worker at the plant.
Also if your answer is anything other than easy and implicit trust I want to know if your plant is actually profitable and if broken stuff ever gets fixed or just sits there as the required approvals for someone to physically touch it work their way through tangled bureaucracy.
Believe me passwords on our protective relays are of major concern, right after we've solved world peace and all the other security issues that plague a typical power distribution system.
'First I got infected by "malware protection designed to protect" and "windows xp recovery" I used rkill to fix this. But now any google search gets redirected and I hear commercials even with no browser open. The TDSSKiller won't run even when is renamed. And SAS or malware bytes won't detect anything.' link
AccountKiller
If it weren't for the fact that Vdd and Vss are reversed, a properly programmed PIC 12f675 could be a pin-for-pin replacement for a 555. As a matter of fact, I've stopped using 555s entirely, since a 12f675 provides the same functionality, and more, with NO external parts.
Installing a trojan would be as easy as inverting the 1 and 8 pins inside the package.
You failed to account for authorized people having their machines unknowingly infected. Passwords are also moot when exploits are used, which tend to be highly available since SCADA systems tend to use old unpatched versions of Windows. There was nothing in the Stuxnet setup that requires it to be an inside job.
Organizations that use SCADA and/or distributed controls, typically the manufacturing and raw materials sectors but also public utilities, very seldom maintain complete on-site in-house support for said systems or their industrial sub-components (proprietary machine programs, frequently written in Step 7 or ControlLogix but locked down by the machine vendor). Neither are most maintenance budgets able to afford frequent on-site vendor visits.
That means off-site tech support, and therefore internet access.
Air walls only work when you have an unlimited budget, a perfect system, or adequate full-time on-site support. I think I saw one of those in a movie once.
Scruting the inscrutable for over 50 years.
Besides handling technology strategy for a restaurant business in southern ontario, I also design, build, and maintain industrial control systems. One project I handed in this capacity was building a control network for an industrial plant's ethernet control network, basically from scratch.
One thing that makes the new way of doing things so dangerous is that even the best people at a site usually don't have the first idea that there's even a problem, let alone how to fix it. People in charge (reasonably) want information from the process control systems to be accessible to decision makers, but often they're going to give control to tradesmen.
I have great respect for tradesmen, and I am one myself, but there's a simple fact that their entire lives the technology has been different than today. I'm almost 30, and in a room filled with tradesman, I'm often the youngest by 20 years. That by itself wouldn't be a problem, but even on their best day, these guys don't tend to do computers. They run cables, or troubleshoot ground loops, or rebuild relays, or install gearboxes, or calibrate transmitters, or rebuild fuel injectors. Only very specialised tradesmen are going to have much experience with computers, and even within that specialised group, an even more specialised group is going to be familiar at all with network security to the point that they might be able to lock down their network in such a way that can prevent a hacker or worm attack.
ICS-CERT has been a great resource for me, trying to figure out the best way to implement a long-term control system security strategy that can protect against the next self-propagating worm that catches the world completely off-guard, so there are some resources out there. Besides that, I'm implementing regular penetration testing on any intranet-facing machines to ensure that if the corporate IT lets something pass, it won't make it into control systems, following up by closing any holes we find.
Change is going to have to come from all sides to really make a difference, though. I'm solving the problems of one site of tens, maybe hundreds of thousands. Tradesmen who will maintain and build control infrastructure must be informed of the gravity of their task. Managers must be informed of the dangers of network security, which can literally be life or death. Executives must know about the problems and pass this on down the line as a priority right from the top, as well.