Slashdot Mirror
Malware Infects US Power Facilities Through USB Drives
angry tapir writes "Two U.S. power companies have reported infections of malware during the past three months, with the bad software apparently brought in through tainted USB drives, according to the U.S. Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). The publication (PDF) did not name the malware discovered. The tainted USB drive came in contact with a 'handful of machines' at the power generation facility and investigators found sophisticated malware on two engineering workstations critical to the operation of the control environment, ICS-CERT said."
...If they have them installed and actually recording. Find out which ones were inserting the USB drives in question, fire them and ban them from ever being hired at any infastructure facilities. Train the remaining employees in security best practices and run random scans of any equipment they bring into the premises.
More often than not security breaches are a result of an oversight, but far too often, it's laziness and incompetence.
If computers were people, I'd be a misanthrope.
1. It is stuxnet
2. it is something else
Patents Drive Free Software as Hurricanes Drive Construction Industry
I can't help but laugh at the infantile levels of thinking and planning which goes into building secure infrastructure systems. Here's how I would do it:
1. First, insulate critical infrastructure systems from the rest of the World. Don't install 'secure' routers or 'secure' firewalls. Simply insulate them. End of.
2. Do not install any software (OS, database or application) that needs to be activated from the outside, or auto-updated from the outside.
3. Do not ALLOW any USB based access to any of the networked machines, ever. If at all, the USB drive needs to be connected to a Linux machine, that does not auto-mount or run any auto-magic stuff. Then, any files that need to be sent to the server need to be quarantined prior to updating.
4. Same goes for WiFi. Only allow mahcines with known, registered MAC addresses, after pre-auditing and authorising them.
Dealing with the aftermath of such insecure architecture, without Solving them once and for all, is a criminal offence by the IT admins and must be prosecuted as such. Irrespective of the outcome or lack of any infections despite insecure architecture.
If you keep throwing chairs, one day you'll break windows....
Good, if USB's are the infection route, then it probably means they've been smart enough to not connect these systems to the internet.
Good, they're not screaming 'cyber war' and conflating script kiddies with the country of the p0wned PC that sent the infection.
Bad, However, why have they left the USB ports open? And why are the ports autoexecuting this malware? I mean, even my Dad (82 years old) has the auto execute registry flag turned off. He can plug malware infected keys till his hearts content and it won't run. It's just really sloppy! You pay people to secure critical systems like this and they don't do their job, so you need to sack them and hire competent people instead.
Well at least as competent as an amateur 82 year old.
To all the orifices of the employees who plug random usb stickies to supah secret guberment computators... ...and to the admins of the said machines.
When firing him, make him walk past all the other employees lined up at the front doors, who turn their backs one by one as he passes them. And as he walks to his car, the slow-clap chant of "unclean, unclean, unclean" should be encouraged. And a hail of out of date McAfee trial disks thrown at his car as he drives away.
No. It's not to punish him further, it's to reinforce acceptable group behaviour on those who remain.
"We don't do this to you if you steal a laptop or a roll of copper wire. We don't do this to you if sneak out at noon every day. This is the thing we do this for."
... would any machine running Windows be attached to or associated with anything that was critical to the operation of a power plant?!
Just in case you are scared about power plants failures - don't! There are much better things to be worried about.
For example - only a bit more that 4 years ago, the UK Navy finished retrofitting its nuclear subs with... Window XP and 2000! For sensors and weapons control no less. At the time, /.ers coined a new meaning for the BSOD.
Questions raise, answers kill. Raise questions to stay alive.
I've heard the infection spreads more easily if you stick it in the port on the backside. I know for most people, its a PITA to do that. you might have to get down on your knees an so on, though there are those who prefer it and for them it's especially important to use adequate protection.
Well I'm not advocating this specific agency but
a) Companies will not publish incident details, unless forced to in one way or the other. It is not in their, or their shareholders best interest to be open about mistakes. The systems used are probably not unique and are in use by several other companies as well. So if a flaw/known attack vector exists, others should be warned, so they can secure them.
b) A single incident is not a big deal, but what about ten, or a hundred? Power is a strategic resource in this country and must be treated as such.
Because it is the industry standard and they would be fired for suggesting otherwise? Wake up, the world isn't full of perfect ideals.
I have determined that my sig is indeterminate.
But "Windows for Warships" has such a great ring to it - much better than "Linux for Landlubbers".
Hackers know that if you leave a dozen or so thumb drives around the parking lot of a target company, at least one person will be unable to resist looking to see what's on it.
is the only organization to succesfull shut down the power grid - and it did it with the help of the US government
most of the people in it kept their profits and many went on to work in the subprime mortgage industry.
Do these handful of tainted machines run on Windows?
AccountKiller
Isnt this is similar to the time when Stuxnet invaded Iranian nuclear power plant and was also infected through its PLC's. man i thought that would be warning enough.
accessing someones open account on facebook is not hacking
Seen several cases of this across several different companies. I would think that the power/utility company admins are subject to the same oversights that most are. This has been seen in several different variants, and the major AV vendors have trouble identifying it accurately.
Main route of infection is via autoplay.inf. It also spreads to all available drive letters, including external drives and network shares. Easy prevention would be to disable autoplay.inf across the forest with a GPO. Windows XP machines are usually the ones the culprit that allows the first infection. It goes through and hides and sets system attribs on folders (and sometimes changes permissions) on the network share (and any accessible drive letter) using the (domain) credentials of the currently logged in user. If that user has more access, more things get screwed up.
Pain to clean up; to do it thoroughly, each machine must be scrubbed clean while disconnected from the network. Also, all usb drives should be scrubbed as well.
Can't be sure that's what they were hit with, but I would not be surprised if this was it.
Why does the SCADA systems even HAVE accessable USB ports? What moron bought Dell PC's instead of rackmount systems with locking face plates?
All of this is the fault of the Managers and upper managers of the facilities as well as the project manager that did not specify the PROPER EQUIPMENT for the systems.
You can set up windows to ignore USB memory devices, it's really easy if you have competent staff on hand that can do it.
Do not look at laser with remaining good eye.
Based on all of the other articles posted on /. regarding compromised corporate and military networks, it's amazing that these guys have limited the infection to only two computers. That's amazing! Way to go guys! Way to show up your peers! Bonuses for everyone (or at least the executives who I'm sure are the real heroes of this story)!
</sarcasm>
...failure to follow simple best practices. Nothing new here. Move along... move along.
what about not useing outside technicians.
So they can have more control over over there work / pay for all hardware / software costs to make security right.
Don't fire / ban the tech who may be just following a script that may of just been to go X website and download this file to a usb key that will be used for the updates.
Also that malware may of even came from a different system that was being updated with the same usb key at a different place.
This is something new?
I was working as a developer at a nuclear power station (S.O.N.G.S.) in the early 90's. The developer across the cubicle from me had a persistent "beeeping" problem with his PC, which he ignored. I asked him about it, and he said "the damn thing just beeps every now and then". He was pretty unconcerned about it. Like "yea, it beeps, so what?"
Turns out it was a virus.
The vendor that provided the PC was always very helpful. They were so helpful, that when a new BIOS update came out for the video cards they were using in some of the PCs, they helpfully went from desk to desk installing the BIOS upgrade - from an infected floppy disk.
No idea if the virus ever made if off of developer PCs and onto more critical systems. I suppose the "if it goes in it doesn't come out, except in a barrel" policy for the Red Zone helped contain it. (I worked in Health Physics, so potentially this could have affected systems that measure and track worker dosage.)
And more often than not the message that is actually recieved is "Dont do whatever you have to do to make this backwards shithole actually operate on the outdated, broken, kluge of a system that's been cobbled together by hogtied engineers over a generation of mismanagement. Just sit back, and watch it collapse under its own wait and tell the bosses, 'I told you so....'."
"But we have to pass the bill so that you can find out what is in it,..." - Nancy Pelosi