Slashdot Mirror
Malware Infects US Power Facilities Through USB Drives
angry tapir writes "Two U.S. power companies have reported infections of malware during the past three months, with the bad software apparently brought in through tainted USB drives, according to the U.S. Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). The publication (PDF) did not name the malware discovered. The tainted USB drive came in contact with a 'handful of machines' at the power generation facility and investigators found sophisticated malware on two engineering workstations critical to the operation of the control environment, ICS-CERT said."
...If they have them installed and actually recording. Find out which ones were inserting the USB drives in question, fire them and ban them from ever being hired at any infastructure facilities. Train the remaining employees in security best practices and run random scans of any equipment they bring into the premises.
More often than not security breaches are a result of an oversight, but far too often, it's laziness and incompetence.
If computers were people, I'd be a misanthrope.
1. It is stuxnet
2. it is something else
Patents Drive Free Software as Hurricanes Drive Construction Industry
I can't help but laugh at the infantile levels of thinking and planning which goes into building secure infrastructure systems. Here's how I would do it:
1. First, insulate critical infrastructure systems from the rest of the World. Don't install 'secure' routers or 'secure' firewalls. Simply insulate them. End of.
2. Do not install any software (OS, database or application) that needs to be activated from the outside, or auto-updated from the outside.
3. Do not ALLOW any USB based access to any of the networked machines, ever. If at all, the USB drive needs to be connected to a Linux machine, that does not auto-mount or run any auto-magic stuff. Then, any files that need to be sent to the server need to be quarantined prior to updating.
4. Same goes for WiFi. Only allow mahcines with known, registered MAC addresses, after pre-auditing and authorising them.
Dealing with the aftermath of such insecure architecture, without Solving them once and for all, is a criminal offence by the IT admins and must be prosecuted as such. Irrespective of the outcome or lack of any infections despite insecure architecture.
If you keep throwing chairs, one day you'll break windows....
Good, if USB's are the infection route, then it probably means they've been smart enough to not connect these systems to the internet.
Good, they're not screaming 'cyber war' and conflating script kiddies with the country of the p0wned PC that sent the infection.
Bad, However, why have they left the USB ports open? And why are the ports autoexecuting this malware? I mean, even my Dad (82 years old) has the auto execute registry flag turned off. He can plug malware infected keys till his hearts content and it won't run. It's just really sloppy! You pay people to secure critical systems like this and they don't do their job, so you need to sack them and hire competent people instead.
Well at least as competent as an amateur 82 year old.
What a long ass name for such a useless agency. Who gives a fuck about their opinions? What, do you think the government knows more about power plants than the fucking people who actually build them?
To all the orifices of the employees who plug random usb stickies to supah secret guberment computators... ...and to the admins of the said machines.
I run IT security for an entire country for an aerospace company, the most prevalent virus that we've detected is some unsophisticated and annoying worm that spreads via removable media and network file shares, it's based off AutoIT. Lucky for us sensitive areas don't even have USB controllers or have them disabled at BIOS level so it's only prevalent in low security areas and they've all been caught by our IDS & IPS.
When firing him, make him walk past all the other employees lined up at the front doors, who turn their backs one by one as he passes them. And as he walks to his car, the slow-clap chant of "unclean, unclean, unclean" should be encouraged. And a hail of out of date McAfee trial disks thrown at his car as he drives away.
No. It's not to punish him further, it's to reinforce acceptable group behaviour on those who remain.
"We don't do this to you if you steal a laptop or a roll of copper wire. We don't do this to you if sneak out at noon every day. This is the thing we do this for."
... would any machine running Windows be attached to or associated with anything that was critical to the operation of a power plant?!
Just in case you are scared about power plants failures - don't! There are much better things to be worried about.
For example - only a bit more that 4 years ago, the UK Navy finished retrofitting its nuclear subs with... Window XP and 2000! For sensors and weapons control no less. At the time, /.ers coined a new meaning for the BSOD.
Questions raise, answers kill. Raise questions to stay alive.
...running Windows at all? Seriously, that's just asking for trouble.
I've heard the infection spreads more easily if you stick it in the port on the backside. I know for most people, its a PITA to do that. you might have to get down on your knees an so on, though there are those who prefer it and for them it's especially important to use adequate protection.
Because it is the industry standard and they would be fired for suggesting otherwise? Wake up, the world isn't full of perfect ideals.
I have determined that my sig is indeterminate.
But "Windows for Warships" has such a great ring to it - much better than "Linux for Landlubbers".
Hackers know that if you leave a dozen or so thumb drives around the parking lot of a target company, at least one person will be unable to resist looking to see what's on it.
Malware infects Windows OS through USB drives.
Headlines like this are why we have the majority of our boxes running linux scanning for windows viruses. It's why we aren't allowed to stick USB drives into the Linux machines.
I don't know why the people making standards for security never mention the elephant in the room: Windows.
Almost every security restriction is due to how WINDOWS does things "for" you.
Welp folks, here's another "PROBLEM" story queued for the problem, reaction, solution machine.
Fuckers are borrowing 42 for every 1 dollar and we have the DHS in opposition to the constitution stamping their name on mission creep everywhere they can find it.
ICS-CERT didn't get any better by having DHS stamped in front of the name
And so the psyop goes
shouting down the street, "malware's in the primary control grid" until the jouralizts get ahold of it on ABC, BBC, CBS, FOX, PBS, NBC and get public out cry, oh we can't have these malware's in the primary control grid so we have to spy some more, and take away more rights, charge more, and degrade the existing services, More smart meters, that way we can tell which house had the USB stick they'll trot out complete fucking fantasy to get to the end of their means.
is the only organization to succesfull shut down the power grid - and it did it with the help of the US government
most of the people in it kept their profits and many went on to work in the subprime mortgage industry.
http://www.techrepublic.com/blog/datacenter/disable-removable-media-through-windows-server-2008s-group-policy-configuration/452
Really easy and simple. No need to script anything or to remove files from local systems.
How would you do that in Linux (which has had *many* vulnerabilities in USB drivers in *kernel* space)
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
When the Germans used poison gas with success, but couldn't advance because they haven't invented gas masks yet. If you release a virus, you should be damn sure that you can defend yourself against it.
Do these handful of tainted machines run on Windows?
AccountKiller
Isnt this is similar to the time when Stuxnet invaded Iranian nuclear power plant and was also infected through its PLC's. man i thought that would be warning enough.
accessing someones open account on facebook is not hacking
Seen several cases of this across several different companies. I would think that the power/utility company admins are subject to the same oversights that most are. This has been seen in several different variants, and the major AV vendors have trouble identifying it accurately.
Main route of infection is via autoplay.inf. It also spreads to all available drive letters, including external drives and network shares. Easy prevention would be to disable autoplay.inf across the forest with a GPO. Windows XP machines are usually the ones the culprit that allows the first infection. It goes through and hides and sets system attribs on folders (and sometimes changes permissions) on the network share (and any accessible drive letter) using the (domain) credentials of the currently logged in user. If that user has more access, more things get screwed up.
Pain to clean up; to do it thoroughly, each machine must be scrubbed clean while disconnected from the network. Also, all usb drives should be scrubbed as well.
Can't be sure that's what they were hit with, but I would not be surprised if this was it.
Why does the SCADA systems even HAVE accessable USB ports? What moron bought Dell PC's instead of rackmount systems with locking face plates?
All of this is the fault of the Managers and upper managers of the facilities as well as the project manager that did not specify the PROPER EQUIPMENT for the systems.
You can set up windows to ignore USB memory devices, it's really easy if you have competent staff on hand that can do it.
Do not look at laser with remaining good eye.
Based on all of the other articles posted on /. regarding compromised corporate and military networks, it's amazing that these guys have limited the infection to only two computers. That's amazing! Way to go guys! Way to show up your peers! Bonuses for everyone (or at least the executives who I'm sure are the real heroes of this story)!
</sarcasm>
...failure to follow simple best practices. Nothing new here. Move along... move along.
what about not useing outside technicians.
So they can have more control over over there work / pay for all hardware / software costs to make security right.
Don't fire / ban the tech who may be just following a script that may of just been to go X website and download this file to a usb key that will be used for the updates.
Also that malware may of even came from a different system that was being updated with the same usb key at a different place.
This is something new?
I was working as a developer at a nuclear power station (S.O.N.G.S.) in the early 90's. The developer across the cubicle from me had a persistent "beeeping" problem with his PC, which he ignored. I asked him about it, and he said "the damn thing just beeps every now and then". He was pretty unconcerned about it. Like "yea, it beeps, so what?"
Turns out it was a virus.
The vendor that provided the PC was always very helpful. They were so helpful, that when a new BIOS update came out for the video cards they were using in some of the PCs, they helpfully went from desk to desk installing the BIOS upgrade - from an infected floppy disk.
No idea if the virus ever made if off of developer PCs and onto more critical systems. I suppose the "if it goes in it doesn't come out, except in a barrel" policy for the Red Zone helped contain it. (I worked in Health Physics, so potentially this could have affected systems that measure and track worker dosage.)
And more often than not the message that is actually recieved is "Dont do whatever you have to do to make this backwards shithole actually operate on the outdated, broken, kluge of a system that's been cobbled together by hogtied engineers over a generation of mismanagement. Just sit back, and watch it collapse under its own wait and tell the bosses, 'I told you so....'."
"But we have to pass the bill so that you can find out what is in it,..." - Nancy Pelosi
USB drives can't be put in to Linux PCs beause Windows uses Autorun on them.
I don't know if they're afraid of pointing out Windows being insecure (therefore have to say "Don't use Windows" and get in a whole shitload of trouble because Microsoft doesn't like it) or whether they're just writing it that way because it isn't their problem.
We fill the USB ports with epoxy
For an all-too-real but fiction take on this in a near future corporate world...
http://www.amazon.co.uk/A-joy-serve-company-ebook/dp/B004YTSZ5A/ref=sr_1_1?ie=UTF8&qid=1358450275&sr=8-1