Slashdot Mirror
Malware Infects US Power Facilities Through USB Drives
angry tapir writes "Two U.S. power companies have reported infections of malware during the past three months, with the bad software apparently brought in through tainted USB drives, according to the U.S. Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). The publication (PDF) did not name the malware discovered. The tainted USB drive came in contact with a 'handful of machines' at the power generation facility and investigators found sophisticated malware on two engineering workstations critical to the operation of the control environment, ICS-CERT said."
...If they have them installed and actually recording. Find out which ones were inserting the USB drives in question, fire them and ban them from ever being hired at any infastructure facilities. Train the remaining employees in security best practices and run random scans of any equipment they bring into the premises.
More often than not security breaches are a result of an oversight, but far too often, it's laziness and incompetence.
If computers were people, I'd be a misanthrope.
1. It is stuxnet
2. it is something else
Patents Drive Free Software as Hurricanes Drive Construction Industry
... would any machine running Windows be attached to or associated with anything that was critical to the operation of a power plant?!
Whoever made that decision needs to be FIRED and not be allowed anywhere near anything like a power plant ever again.
I can't help but laugh at the infantile levels of thinking and planning which goes into building secure infrastructure systems. Here's how I would do it:
1. First, insulate critical infrastructure systems from the rest of the World. Don't install 'secure' routers or 'secure' firewalls. Simply insulate them. End of.
2. Do not install any software (OS, database or application) that needs to be activated from the outside, or auto-updated from the outside.
3. Do not ALLOW any USB based access to any of the networked machines, ever. If at all, the USB drive needs to be connected to a Linux machine, that does not auto-mount or run any auto-magic stuff. Then, any files that need to be sent to the server need to be quarantined prior to updating.
4. Same goes for WiFi. Only allow mahcines with known, registered MAC addresses, after pre-auditing and authorising them.
Dealing with the aftermath of such insecure architecture, without Solving them once and for all, is a criminal offence by the IT admins and must be prosecuted as such. Irrespective of the outcome or lack of any infections despite insecure architecture.
If you keep throwing chairs, one day you'll break windows....
Good, if USB's are the infection route, then it probably means they've been smart enough to not connect these systems to the internet.
Good, they're not screaming 'cyber war' and conflating script kiddies with the country of the p0wned PC that sent the infection.
Bad, However, why have they left the USB ports open? And why are the ports autoexecuting this malware? I mean, even my Dad (82 years old) has the auto execute registry flag turned off. He can plug malware infected keys till his hearts content and it won't run. It's just really sloppy! You pay people to secure critical systems like this and they don't do their job, so you need to sack them and hire competent people instead.
Well at least as competent as an amateur 82 year old.
What a long ass name for such a useless agency. Who gives a fuck about their opinions? What, do you think the government knows more about power plants than the fucking people who actually build them?
To all the orifices of the employees who plug random usb stickies to supah secret guberment computators... ...and to the admins of the said machines.
I run IT security for an entire country for an aerospace company, the most prevalent virus that we've detected is some unsophisticated and annoying worm that spreads via removable media and network file shares, it's based off AutoIT. Lucky for us sensitive areas don't even have USB controllers or have them disabled at BIOS level so it's only prevalent in low security areas and they've all been caught by our IDS & IPS.
When firing him, make him walk past all the other employees lined up at the front doors, who turn their backs one by one as he passes them. And as he walks to his car, the slow-clap chant of "unclean, unclean, unclean" should be encouraged. And a hail of out of date McAfee trial disks thrown at his car as he drives away.
No. It's not to punish him further, it's to reinforce acceptable group behaviour on those who remain.
"We don't do this to you if you steal a laptop or a roll of copper wire. We don't do this to you if sneak out at noon every day. This is the thing we do this for."
...running Windows at all? Seriously, that's just asking for trouble.
I've heard the infection spreads more easily if you stick it in the port on the backside. I know for most people, its a PITA to do that. you might have to get down on your knees an so on, though there are those who prefer it and for them it's especially important to use adequate protection.
Hackers know that if you leave a dozen or so thumb drives around the parking lot of a target company, at least one person will be unable to resist looking to see what's on it.
Thank’s for information. I in significance enjoyed reading this post.
www.ukmobilebusinessdirectory.com provides mobile business listing services in UK
Malware infects Windows OS through USB drives.
Headlines like this are why we have the majority of our boxes running linux scanning for windows viruses. It's why we aren't allowed to stick USB drives into the Linux machines.
I don't know why the people making standards for security never mention the elephant in the room: Windows.
Almost every security restriction is due to how WINDOWS does things "for" you.
The global economy is reviving and soon prosperity will be abundant. We will be frugal yet happy and sustain small families with less of a draw on resources and the environment. The internet is opening up and will continue to be more free - only being regulated to a limited scale according to people personal wishes. There are no missing laptops and there will soon be no reports of it again. Peace is in and soon there will be world peace. There will be 3 competing global business models and people will be free to live under whatever system they prefer - socialism, communism, and free market capitalism. These systems will be sand-boxed from each other and ripple through all nations. The major banking dynasties will retire into luxurious gulags, and their funds will be used for the above reforms. Everything is great. The free market capitalists are going back to the moon to establish permanent settlements with the aid of the Communists and the Socialists are developing plans for an inter-stellar drive. They are at peace as they are free to move between their respective systems at will. All is well. People all over the world will have the right to carry and possess firearms, but they have to give up their right local law enforcement protection. Federal and global law enforcement is a thing of the past because of the above unions. The dark sarcasm in the classroom is dissipating and civic classes will return again soon. Schools are becoming more workshop orientated, and artists are starting to become more valued as professionals, and soon they will be more in demand than IT professionals as mankind embarks on a neo renaissance. There is also a spiritual revival as people return to simple religions and faiths like paganism and buddhism are thriving. Strong agnosticism is dieing out and only it's weaker variant is surging. Safe nuclear fission and fusion is becoming abundant. There are very few paranoid people abounding but everyone is vigilant and safeguard the new world we live in. Almost everyone has a garden, even is it's indoors, or on roof tops. People who do not grow at least some of their own food consumption are looked down upon. There are multiple competing internets, but more of them are derived from the Socialist and free-market systems. The most popular are ones that only allow e-ink technology that is not a strain on the eyes and a whole series of protocols have been developed that integrate directly with e-ink devices. All manned space vehicles and space stations feature e-ink displays, though most are in color now. GMO food is used mainly in labs and is clearly labelled.It is mainly harmless with such offerings as giant pumpkins, strains of marijuana are cross-bred with prehistoric plants from Australia. There are underground parks and sky parks in blimps as well as several zero g orbital parks. People are free to eat the food in these parks but most are trying to find ways to grow more than consume more plants. TV has been replaced by telepresence, especially in the free market locals. People explore the internet as if they were a part of it. In the socialist locals, people mostly use the internet to test and operate interactive machines spanning vast distances, and for science experiments. In the communist locals, people carry the internet only with them using Google glass and other competing products. The leaders of the 3 dominant systems collaborate also, working on new telesopes in search of extrasolar planets. There are already treaties underway to share the resources and land of any new planets they discover so that one day they can continue to prosper in peace on those worlds as they do here on Earth, though the Earth is known by many names, and nicknames nowadays.
Welp folks, here's another "PROBLEM" story queued for the problem, reaction, solution machine.
Fuckers are borrowing 42 for every 1 dollar and we have the DHS in opposition to the constitution stamping their name on mission creep everywhere they can find it.
ICS-CERT didn't get any better by having DHS stamped in front of the name
And so the psyop goes
shouting down the street, "malware's in the primary control grid" until the jouralizts get ahold of it on ABC, BBC, CBS, FOX, PBS, NBC and get public out cry, oh we can't have these malware's in the primary control grid so we have to spy some more, and take away more rights, charge more, and degrade the existing services, More smart meters, that way we can tell which house had the USB stick they'll trot out complete fucking fantasy to get to the end of their means.
is the only organization to succesfull shut down the power grid - and it did it with the help of the US government
most of the people in it kept their profits and many went on to work in the subprime mortgage industry.
http://www.techrepublic.com/blog/datacenter/disable-removable-media-through-windows-server-2008s-group-policy-configuration/452
Really easy and simple. No need to script anything or to remove files from local systems.
How would you do that in Linux (which has had *many* vulnerabilities in USB drivers in *kernel* space)
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
When the Germans used poison gas with success, but couldn't advance because they haven't invented gas masks yet. If you release a virus, you should be damn sure that you can defend yourself against it.
Do these handful of tainted machines run on Windows?
AccountKiller
Isnt this is similar to the time when Stuxnet invaded Iranian nuclear power plant and was also infected through its PLC's. man i thought that would be warning enough.
accessing someones open account on facebook is not hacking
> If the malicious code was embedded in the software which was intentionally installed, then exactly how would the choice of OS have fuck-all to do with it?
Because if the fucking OS wasn't Windows, then the fucking OS wouldn't get infected by plugging in a fucking USB device into the fucking machine ..
Seen several cases of this across several different companies. I would think that the power/utility company admins are subject to the same oversights that most are. This has been seen in several different variants, and the major AV vendors have trouble identifying it accurately.
Main route of infection is via autoplay.inf. It also spreads to all available drive letters, including external drives and network shares. Easy prevention would be to disable autoplay.inf across the forest with a GPO. Windows XP machines are usually the ones the culprit that allows the first infection. It goes through and hides and sets system attribs on folders (and sometimes changes permissions) on the network share (and any accessible drive letter) using the (domain) credentials of the currently logged in user. If that user has more access, more things get screwed up.
Pain to clean up; to do it thoroughly, each machine must be scrubbed clean while disconnected from the network. Also, all usb drives should be scrubbed as well.
Can't be sure that's what they were hit with, but I would not be surprised if this was it.
Why does the SCADA systems even HAVE accessable USB ports? What moron bought Dell PC's instead of rackmount systems with locking face plates?
All of this is the fault of the Managers and upper managers of the facilities as well as the project manager that did not specify the PROPER EQUIPMENT for the systems.
You can set up windows to ignore USB memory devices, it's really easy if you have competent staff on hand that can do it.
Do not look at laser with remaining good eye.
Back in the early days of the web most of the machines connected to it ran some form of *nix, yet the MSDOS machines and Win95 machines had close to a monopoly on malware. Now most of the things directly connected to the internet once again run some form of *nix (ADSL modems, servers, wifi access points, now even TVs) and malware is now entirely restricted to MS platforms. If you'd spent some time on thought instead of mindless cheering you would have realised how utterly stupid your "attacking the most common platform" argument is when it's not the most common platform that has the malware monopoly.
Based on all of the other articles posted on /. regarding compromised corporate and military networks, it's amazing that these guys have limited the infection to only two computers. That's amazing! Way to go guys! Way to show up your peers! Bonuses for everyone (or at least the executives who I'm sure are the real heroes of this story)!
</sarcasm>
...failure to follow simple best practices. Nothing new here. Move along... move along.
what about not useing outside technicians.
So they can have more control over over there work / pay for all hardware / software costs to make security right.
Don't fire / ban the tech who may be just following a script that may of just been to go X website and download this file to a usb key that will be used for the updates.
Also that malware may of even came from a different system that was being updated with the same usb key at a different place.
writing is on the rotting corpse 4arties). At THE
This is something new?
I was working as a developer at a nuclear power station (S.O.N.G.S.) in the early 90's. The developer across the cubicle from me had a persistent "beeeping" problem with his PC, which he ignored. I asked him about it, and he said "the damn thing just beeps every now and then". He was pretty unconcerned about it. Like "yea, it beeps, so what?"
Turns out it was a virus.
The vendor that provided the PC was always very helpful. They were so helpful, that when a new BIOS update came out for the video cards they were using in some of the PCs, they helpfully went from desk to desk installing the BIOS upgrade - from an infected floppy disk.
No idea if the virus ever made if off of developer PCs and onto more critical systems. I suppose the "if it goes in it doesn't come out, except in a barrel" policy for the Red Zone helped contain it. (I worked in Health Physics, so potentially this could have affected systems that measure and track worker dosage.)
And more often than not the message that is actually recieved is "Dont do whatever you have to do to make this backwards shithole actually operate on the outdated, broken, kluge of a system that's been cobbled together by hogtied engineers over a generation of mismanagement. Just sit back, and watch it collapse under its own wait and tell the bosses, 'I told you so....'."
"But we have to pass the bill so that you can find out what is in it,..." - Nancy Pelosi
USB drives can't be put in to Linux PCs beause Windows uses Autorun on them.
I don't know if they're afraid of pointing out Windows being insecure (therefore have to say "Don't use Windows" and get in a whole shitload of trouble because Microsoft doesn't like it) or whether they're just writing it that way because it isn't their problem.
We fill the USB ports with epoxy
For an all-too-real but fiction take on this in a near future corporate world...
http://www.amazon.co.uk/A-joy-serve-company-ebook/dp/B004YTSZ5A/ref=sr_1_1?ie=UTF8&qid=1358450275&sr=8-1