Slashdot Mirror
Thousands of SCADA Devices Discovered On the Open Internet
Trailrunner7 writes with news of the continuing poor state of security for industrial control systems. From the article: "Never underestimate what you can do with a healthy list of advanced operator search terms and a beer budget. That's mostly what comprises the arsenal of two critical infrastructure protection specialists who have spent close to nine months trying to paint a picture of the number of Internet-facing devices linked to critical infrastructure in the United States. It's not a pretty picture. The duo ... have with some help from the Department of Homeland Security (PDF) pared down an initial list of 500,000 devices to 7,200, many of which contain online login interfaces with little more than a default password standing between an attacker and potential havoc. DHS has done outreach to the affected asset owners, yet these tides turn slowly and progress has been slow in remedying many of those weaknesses. ...The pair found not only devices used for critical infrastructure such as energy, water and other utilities, but also SCADA devices for HVAC systems, building automation control systems, large mining trucks, traffic control systems, red-light cameras and even crematoriums."
Part of the problem is the engineers designing them. They don't understand the sandbox they're playing in. It isn't in their culture and they don't know that they should secure them much less how to. I'm starting to see organizations hire product security engineers now to try and institute this stuff into the products but they seem way behind the curve IMHO.
So... how do I find the red light cameras?
Sounds like this could be fun!
I don't read your sig. Why are you reading mine?
I was just talking to my boss about this subject today. The merging of mechanical and network engineering is still considered a "new" development, often times the engineers designing the system for a building doesn't fully understand the IT that it rides on. It's a problem, and it's being addressed, but as the submission states there's a huge lag time with huge companies, so it'll continue to be a problem for a while.
The thing with security is... outside of the curve, there's outside-the-box thinking, comprehension and competence that are involved. You're trying to outsmart potentional attackers, not follow a white paper that they have access to. "Behind the curve" is false because there is no curve, there's just secure and insecure practices. The exploit will either work, or it won't. This only applies at the application level btw.
There are a LOT of idiots out there who do installations.
At one place I worked, contractors went into a remote office to install a phone system and ended up wiring a Win2003 server directly to the Internet (and the internal network) so that they could log into it to make changes to the phone system.
Two factors have caused this - one, the assumption that those with the knowledge to cause havok have better things to do with their time, and two, the assumption by manufacturers that factory floor equipment will be physically seperated from the public (and by implication, the Internet).
All the changes that have resulted in this situation or probably very recent (10 years), and are in situations where legacy networks and equipment have been bolstered by or re-connected with new stuff by young IT-types, not engineers, who probably had no idea all the industrial stuff wasn't secured!
This tagline was transcoded to result in at least one smirk. If you experience failure to smirk, please consult your Gen
Can someone PLEASE post the links to all the red light cameras (down here they're also fucking speed cameras useful for nothing better than revenue generation which has essentially be admitted to by city)....
I'd love to be able to *ahem*....access those.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
I have worked for a large world wide organisation where SCADA and similar on-line systems are very prominent. After raising concerns and asking ports to be locked down or default passords to be changed, there was a lot of departmental fighting over who's responsibility and usually after the battle royal of e-mails everyone would forget until the issue was brought up again.
Too much of a not broke don't fix attitude in smaller companies and bureaucracy in larger companies over responsibility.
Pay a couple more people to go through the list regularly and poke around, turn things on and off. Make it hotter on cold days and colder on hot days. Take pictures of cars running green lights, shut down all but one elevator, etc...
Just being mindful not to hurt anyone.
It'll soon be cheaper to fix the problem than to waste resources cleaning up the mess.
One factor that caused it. Management!
They are now used to checking their nuclear powerplant controls from their iphones (ok maybe that example is exgerated to make a point ... I hope!) If you now make it secure they will throw a hissy fit if they can't get their reports.
They will call IT to put it back on the internet to fix it. Once the cat got out of the bag it is hopeless. ... 2 factors.
The sales team sold it and told their engineers to include it too so they can sell more units. This was the selling point to upgrade and the sales people at the various SCADA makers will THROW A RIOT if it is not included as MBAs will buy from someone else who will let them do this if they wont.
http://saveie6.com/
Hey guys, no worries, I went in and changed the passwords.
USA USA USA
---
ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.
Consider the flipside, however. My servers get attacked all the time, with known default password attempts. Sometimes it comes thru ssh when they smell the honey.
Some of this is really suspect because they should have been cracked open like an egg by now. Yes, the number of IPv4 addresses are small, but SCADA sticks out like a sore finger (pun intended).
Clueless? I'm not so sure. Honeypots? Yeah, could be. By now, they should have 'outed' or shamed a handful of these guys so as to be examples for the rest, but no one's done that. Perhaps the Hickeyville Water Company would make a good posterboy for being stupid, and the others would fall in line. So something smells here.
---- Teach Peace. It's Cheaper Than War.
I saw a gas station and one of the pumps there was in "maintenance mode" or something. Anyway, it wasn't working and on a little LCD display on its body there was an IP address. It wasn't a private IP so I noted it down and when I got to work I tried accessing it through HTTP. Well, what do you think? A nice web-based username+password interface popped up.
Now I ain't a hacker and I really didn't try anything, but I'm sure a skilled security professional would have hacked right through that interface. It's really amazing how many poorly secured interesting devices are out there.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
It's also the idiots implementing these systems. One of our international offices moved sites over the Xmas break. The contractor installing the HVAC controller at the new site wants me to open up the firewall so any public IP can access the device on port 80. Apparently it's safe because "...it's running Linux".
*sigh*
It gripped her hand gently. 'Regret is for humans,' it said.
When I read; large mining trucks I immediately thought how awesome it would be for geeks to take them over via SCADA devices.
Wow, the large dirt hill fights you could have. The swimming pools of snobby rich people, mysteriously filled in. Monster truck rallies interrupted by attacks of 7 story Mega Monster Trucks. The sheer coolness of surrounding WalMarts with huge walls of landfill waste.
"I'm down here at city hall, and it's absolute mayhem. A large truck, bigger than the building in front of me, is now rolling over all the toll booths, after dumping a huge pile of what must be a mouton of coal on the doorstep of Matty Moroun's estate."
>>"ad space available -- low rates!!!"
I was just talking to my boss about this subject today. The merging of mechanical and network engineering is still considered a "new" development, often times the engineers designing the system for a building doesn't fully understand the IT that it rides on. It's a problem, and it's being addressed, but as the submission states there's a huge lag time with huge companies, so it'll continue to be a problem for a while.
Very insightful but the problem is worse than just the merging of mech/network engineering within a single company. There is a sea of dysfunction washing over the different companies, systems, processes, players and roles. There is a big mess to clean up and although it galls me to say so, I think some sort of legislation may be required both in terms of setting standards and of assigning accountability for poor systems. I won't hold my breath waiting for help on this side.
Some stuff I know to be true:
- CEOs & CFOs are motivated by share price and stock performance issues; they consider IT infrastructure to be an expense item to be minimized. Security devices are cheap but no in house expertise is fostered, and external advice may be poor or ignored if it leads to inconvenient costs. Truck drivers and drag-line operators are valued positions at a mining company because what they do generates income and income to cost is readily calculated; network designers and IT security admins are just an expense item to be minimized. They generate no obvious positive monetary benefit. More trucks/draglines/drivers/operaters = more income and more profit. More IT people = less profit.
- Equipment vendors may be experts at their specific technology but the control programs are not part of their core knowledge. An example I have seen: although the vendor uses some robust logic controllers in the system, they all tie back to a custom control layer built originally by a summer co-op student for a lab demo. The control program does have login security but has never been through any sort of security audit. All system functionality funnels through this layer. It does have a beautiful presentation layer built by a contract software house. BTW, although the login has some protection, by default there is a network API that is always wide open and can not be shut off or everything crashes. No one knows why. If Production Company A buys production equipment from Vendor Company B, the security vulnerabilities are provided at no extra charge. None of the security issues are documented by B (they largely don't know they exist) and B has no good advice to offer on security issues in any case. The sales droids typically say security is not an issue and their track record speaks for itself. No serious events must mean the product is great.
- Even if production security is seen to be an area of need, corp culture and politics keep anything meaningful from happening. The IT expertise that a company does have is usually focused on internal desktop and financial/HR security issues. They know nothing of the SCADA world which marries physical devices to the abstract world of networks and computing. Worse, the IT division (complete with VP or EVP) views any use of computers and networks outside of the corporate LAN to be a threat to the corporate well being. The IT division sees the production network as a threat to the corporate LAN (usually the threat is worse in the other direction!) so production must run outside the corporate firewalls. This is ok, but IT management actively undermines development of a production side IT division as that is a threat to the corp. power structure. Production networks are built and run by engineers who are smart and have a side interest in computing but whose areas of expertise are power control or chemical production or mechanical systems.
- There is no widely accepted set of standards for production network design and deployment. Production network implementers invent the wheel again and a
Don't blame me, I'm just the guy that wrote the specification and the software.
- Management told me to remove security. Too much effort (what's a linter? Stop using it. Shorter passwords. Private network? Can't we just use a cable modem? "Fuzzing" ? Takes too long... turn it off)
- Management told me to remove encryption. Too hard to read and debug over-the-wire for the field tech, who might have to run a program and click a button to decode traffic. Or worse, move a jumper to "debug".
- Management had me source the cheapest possible components, and try to use software to recover from their faster and bizarre failures.
- Management had me install DHCP support into the SCADA devices, so it could be hooked onto the easiest possible network.
- Management had me unlock the cellular modem so it would connect to any tower.
- Management had me use public DNS in my SCADA system, because running our own would have cost an afternoon.
- Management had me write a 4 digit backdoor PIN into all hardware, that could not be turned off.
- Management had me specify, design, and write a remote firmware flash interface supporting and utilizing most of the above.
- Management had me write a remote reverse serial console proxy available by pointing your web browser at the right URL.
- Management had me use public rdate servers rather than pay for an accurate internal clock.
Look, I'm just a software engineer. I know a bit of hardware. I let people know when things are dangerous. I quote them times and estimates and costs.
I quote them expected failure rates.
They settle on the cheapest most disease-ridden stray cat they can find starving in a ditch and sell it as a liger. And your engineers somehow buy it.
Look, I may not know everything about securing them -- but most of these problems aren't caused by inept engineers, they're caused by management and sales cutting corners to buy their third porsche.
I'd *LOVE* to see a reverse bounty program. Sell the management induced bugs in your software to a company client for legal protection against lawsuit, and five years of contractual consulting rates to clean it up.
From the program in it, I guess it was a demo, not running anything.
I found it completely by accident by searching for the part number of one of the modules that happened to be in the chassis with the controller and the ethernet bridge. The ethernet bridge has its own web page which automatically displays the contents of the chassis, with links to the modules.
I added a controller-scoped tag to it called "ICanSeeYouFromTheInternet", and a tag description of "Please put your ENBT on a private network"
A couple days later it was gone.
"Reality is that which, when you stop believing in it, doesn't go away." - Philip K. Dick
For those not overly up to date on their acronyms: "SCADA (supervisory control and data acquisition) is a type of industrial control system (ICS). Industrial control systems are computer controlled systems that monitor and control industrial processes that exist in the physical world. SCADA systems historically distinguish themselves from other ICS systems by being large scale processes that can include multiple sites, and large distances." http://en.wikipedia.org/wiki/SCADA
Three Squirrels
Railroads commonly control switch points with DTMF tones over open radio channels.
This is widely known and a dreadful safety issue but no one talks about it.
As a SCADA/Integration guy, I can say that most controls engineers cringe at the thought of their networks being open to the internet. It's usually managers and bean counters who demand real-time global data reporting who drive this lunacy. It's not as simple as it appears.
Scruting the inscrutable for over 50 years.
My name is Jake Brodsky. I worked with Bob Radvanovsky and others to create this experiment.
The formal announcement of this project is here.
Nearly fifty percent of all graduates come from the bottom half of the class!
I worked as a Controls Engineer for 6 years designing, installing, and commissioning PLC / SCADA systems. The clients were anything from large steel mills, manufacturing plants, government, and even propulsion systems for naval vessels. My company was contracted to install these systems and sometimes train the customer's personnel to then handle problems or make additions to the control system if necessary.
The personnel were more often than not your normal plant electricians and if we were lucky an actual engineer, but usually not one with much IT ability. Today's controls systems almost always have a normal Ethernet network sometimes utilizing commercial OTS network switches. This is a big change from 10-15 years ago when the communication media was mostly proprietary for control networks.
When a problem arose I've seen these guys just unplug and plug in CAT5E Cale's wildly in the hopes of rectifying a problem that brought a process line or machine to a hault without much thought as to where the issue lies. Other times the plant manager will want to view the SCADA data from his office so he will instruct an employee to just bridge the control network to the business / office network.
It's really not the fault of the people designing the systems. In the end the company that owns it takes the blame. The vast majority of customers will not pay extra to have their employees trained on these systems and I've never seen one concerned with security. My company sent me to Certified Ethical Hacking training in order to try and make our systems more secure, but in the end the systems integrator's hands are tied.
There are controls systems and controls software with passwords hard coded and some that are even burned into ROM - not EEPROM. The problem is that manufacturers have to be able to provide tech support and sometimes that tech support is to non-tech people. The prevailing attitude when I worked in the field was " who would be interested in the system anyway?" Security based on apathy I guess...
IT people used to avoid the SCADA equipment because they needed to understand how their security settings might affect interaction between SCADA's and controllers and they were intimidated - a mistake could cause a product spill or worse.
So, IT was tentative about maintaining SCADA's, engineers were apathetic and couldn't accept that a hacker might be interested in a computer system, and manufacturers wanted to be sure that service could be provided over the phone or net to any idiot no matter their training level.
Is it any wonder that we have numerous SCADA systems running with minimal if any security?
I would blame the engineers less than the vapid, bonus-seeking salesmen telling them to make access as stupid and easy as possible to allow mid-level managers to check in on things without having to get off their asses or sometimes even off the golf course. As usual, most of the blame can be laid at the foot of that three letter monument to sloth and incompetence: MBA.