Slashdot Mirror
Hacking Group Linked To Chinese Army Caught Attacking Dummy Water Plant
holy_calamity writes "MIT Technology Review reports that APT1, the China-based hacking group said to steal data from U.S. companies, has been caught taking over a decoy water plant control system. The honeypot mimicked the remote access control panels and physical control system of a U.S. municipal water plant. The decoy was one of 12 set up in 8 countries around the world, which together attracted more than 70 attacks, 10 of which completely compromised the control system. China and Russia were the leading sources of the attacks. The researcher behind the study says his results provide the first clear evidence that people actively seek to exploit the many security problems of industrial systems."
The plant is real and the headline is a cover up/reverse sneak - because panic. But hey, if it turns out to be a honeypot, don't expect it to work twice :)
Why are critical systems on the 'net?
They functioned perfectly 30 years ago without the internet...
CAPTCHA = 'yourself'
They should stop hooking these systems up to the fucking Internet.
So... the dummy systems that are sufficiently realistic in mimicking real systems to fool enemy hackers have been thoroughly breached a total of ten times?
That's not good.
Spoof the interface to make the attackers believe they are attacking a foreign industrial plant.
In reality, they are attacking the utility plant located down street based on WiFi location.
The main purpose of the honeypot system is to obfuscate the true location of the target (the attackers own infrastructure).
Then watch hilarity ensue.
Defense systems would be great. You could get countries to nuke themselves using their own cyber ops team.
"The researcher behind the study says his results provide the first clear evidence that people actively seek to exploit the many security problems of industrial systems."
Uhhhhhh Stuxnet was an exploit of Siemen's industrial control systems which regulated the RPMs of centrifuges....
Have gnu, will travel.
While I personally think that's awesome, how is that legal?
In part, perhaps because 30 years ago the advantages of/needs for large scale efficiency and coordination weren't so great as today? Isolated systems may have higher operations costs and may not efficiently integrate into big systems, but they tend to have few or no remote attack vulnerabilities. Bottom line: economics favor connected systems, and anything on the net can be pwned.
We need redundant fake infrastructure to prepare for just this type of attack. A "New Deal" scale of fake spending, creating thousands of fake jobs, to build fake dams, bridges, highways and subways.
Gently reply
This just one more example of why critical systems should never be connected to the internet. The should always be an air gap.
"The researcher behind the study says his results provide the first clear evidence that people actively seek to exploit the many security problems of industrial systems."
The first eh? I guess he hasn't heard of the tools included in such common distros as Back Track, why do you suppose SCADA exploitation apps are in there?
"If any question why we died, Tell them because our fathers lied."
Just a suggestion but 'exempt' has consequences. If these jobs there were 'non-exempt', then might not have happened. It seems government is looking for reasons for a physical war to be waged.
RTFA. Yes, IP addresses are easily spoofed, and provide essentially no information on the target. That is, in fact, why more information than that was gathered, using the nature of the honeypot in question to gather additional data from the attacking machines. I suspect that it would be possible to configure your system and network in such a way as to spoof the nature of your own local network configuration so that a counterattack of this nature would reveal misleading information about your locality... but the nature of the attacks, and the response to them, make this exceedingly unlikely. tldr; yeah, it was people in China and Russia, and there's proof. Still doesn't mean that their governments were involved, of course.
and now the PHB saves big by remoteing it out to one office.
Pooh sets up a honeypot; finds most attacks come from himself and bees. Oh bother.
RTFA. Yes, IP addresses are easily spoofed, and provide essentially no information on the target. That is, in fact, why more information than that was gathered, using the nature of the honeypot in question to gather additional data from the attacking machines. I suspect that it would be possible to configure your system and network in such a way as to spoof the nature of your own local network configuration so that a counterattack of this nature would reveal misleading information about your locality... but the nature of the attacks, and the response to them, make this exceedingly unlikely. tldr; yeah, it was people in China and Russia, and there's proof. Still doesn't mean that their governments were involved, of course.
Could you say "nature" a few more times, please?
As somebody who left the network / sysadmin business before the attacks started from the inside (send enough malware to everybody inside a company and you will get lucky at a certain moment), how would you protect it best?
Airgap it (or properly firewall it), and people will complain about the costs of duplicate infrastructure, remote support from vendors will be a pain etc.
Monitor the network and spot anomalies, it's a hard task but could be the way to go. Except that you need skilled people there (not saying that there aren't, my experiences in a TAC shows that there aren't many).
Letting the attackers waste time in a honey-pot while your own network is isolated? At least you learn from it and you give them a false sense of victory.
What is wisdom, any thoughts?
bash$
People still haven't learned to keep these vital systems disconnected from the internet and its not like our government is going to say "ah HA! We caught you China RED handed!" because China will just say that we did something similar to them, which may or may not be true, and in the end we get no where with people still not caring about any of this except for maybe a day on CNN in between spots for a tropical storm and a celebrity baby.
So yeah, yay. We caught someone doing something we already knew they were/would do.
http://articles.latimes.com/2012/aug/03/nation/la-na-cyber-security-20120803
U.S. Chamber of Commerce leads defeat of cyber-security bill
Why is Snark Required?
Like there was proof that Iraq had weapons of mass destruction? Forget it, there is no proof, and given the current anti NSA climate, it is much more likely that this is a false flag operation to remind people of their fears.
Hard lines and 0 networking, from the physical layer on up, to the outside world. Anything else should be considered exploitable, stealable, readable, and sabotagable from anywhere on earth.
You failed in life so hard people are laughing at you. You should have marked the anon box because now we all you know your name and think you are a fool. Have a nice day failure.
This is exactly the kind of thing western foreign intelligence agencies should be working on.
Rather than collecting data from their citizens, hacking friendly governments and corporations for profit, they should be working to actively defend against intrusions.
If they suspect an IP address of relaying hostile traffic, can't they be proactive about tracking attack vectors and warning friendly infrastructure managers about vulnerabilities?
If I root a computer in China, and then attack a computer in the US, how can the person in the US identify the location of the attacker (me), without rooting the computer in China? They just really really want it to be in China, so it is?
Learn to love Alaska
In the old days, you might need a person at each site monitoring a console. You'd run a daily report of any incidents. If the site was small, it might be checked once a WEEK. I learned about some water systems like this in California that are on the 'net and being monitored all the time now. Small systems up in the hills where you need 4wd to get to them. Old days == once a week to make sure it's OK. Now == all the time to make sure the water is there if you need to put out a fire or make up for the drought.
Unless you put somebody on each site and/or reduce your monitoring frequency dramatically you can't take it off the 'net.
During a certain Goldilocks period in tech you might, "run a POTS line there and talk to it with an acoustic modem". The problem with that is that even what you think is a POTS line is routed over IP today.
That said, probably is more secure to connect via "POTS" line because even though it's routed it's not addressable. They'd have to root a telco switch or something and intercept your control signals, which seems a lot less likely.
Yeah, I can not imagine why the enemy would want to stop our water supplies and destroy our crops.
Why are water plants, utilities, etc placing their systems on the Internet? I can see loads of advantage to using the backbones for communication, but a vlan or even just a VPN should be used. And any system that is connected to it, should NEVER be allowed to touch the internet. Ever. In fact, the computer should be checking to see if it does and if so, then it records that it has, and will not connect to the utility vlan/VPN.
You do not need something which is connected on normal net line. You close all ports whatsoever, put a hardware router and firewall before and do all transaction on SSH. Cost difference ? Minor. Hassle difference and higher security.
I used the service (and others similar for example for geolocation) all over the world. Once you are in the US the accuracy drop by hundred of miles litteraly. Unless you ask the real provider, your location is pretty much fucked up. My Wifi card is for example located ion FfM, and I am located by IP in Berlin, and located by Wifi card in Bonn. That's hundred of Km. The problem is at some point many provider outside the US are NATing. So service like wiggle and so forth , while getting right what your wifi card is connected to or its neighbors, almost always place it at the wrong geographic location. Pretty much due to NATing only my ISP knows where I am. Otherwise for everybody else, the BEST they can come up with is : "germany".
I've never heard of anyone using city water for large scale crop irrigation. A greenhouse or two might use city water, but not a field of corn. Farmers will dip a pipe into a creek, river, pond, or lake, and pump the water to the fields. They will drill into the aquifer. They will hire trucks to haul in water. But they will not pay the city to pump the water. And the city probably wouldn't let them even if they wanted to, because they use so much water they'd drain their towers, leaving them nothing to fight fires.
Just damaging a few pumps and valves would shut down a city. Last year Minneapolis had a 20 block area shut down for a day due to a single burst water main, leaving many downtown buildings without potable water. Businesses sent the employees home because they couldn't provide sanitary facilities. Restaurants couldn't cook. The physical damage was minor flooding of a street and a construction site, but the financial damage was large.
John
all hail the true and righteous in the land of the free and the home of the brave!
is MIT the new NSA?
FTFS:
"The decoy was one of 12 set up in 8 countries around the world, which together attracted more than 70 attacks, 10 of which completely compromised the control system. China and Russia were the leading sources of the attacks"
OK, so where did the other attacks come from?
You see, this is why the "Oh, yeah, we do, but so does everybody" falls down. When it comes to pointing out proof of danger (if you can call it that) from hacking on critical infrastructure, "everybody is doing it" NEVER includes those who use that "defence" of their spying and hacking.
Was it something like China, Russia, USA, Europe in the top 4 order?
Not that the headline says so, it only wants to say China and Russia are doing it most.
But everyone does it, don't they?
Apparently not as important when it;s someone else doing it, only when it's YOUR country doing it...
Why is it that you place unionised workers as being paid $150k?
That is what an engineer would be paid, unionised or not.
Remember: you pay the CEO high value to get the best CEO. Why do you demand the worst engineer to do the work?
it is much more likely that this is a false flag operation to remind people of their fears.
The US State Dept. travel alert is more likely to be a false flag operation as that is something that significantly more people will understand and relate to than this relatively 'geeks only' topic which at best only will earn a few paragraphs in most media. At risk of placing myself in the tinfoil hat category I have to admit that my very first thought when I read about the alert were, "this is very conveniently timed with the XKeyscore leak a few days earlier ".
"I have downloaded hundreds and hundreds of records, why would I care if somebody downloads ours?" Robin Pecknold
The sensors can absolutely be designed to give out and not recieve information and duplicated sensors can be used to display state but not affect those items that read that state for operation.
So why must the monitoring be read/write and not readonly?
If you are monitoring a plant and see something that looks odd, you go there and modify locally. No need to do it remotely.
My breakfast is better, up yours. My breakfast is better, eat yours.
"The researcher behind the study says his results provide the first clear evidence that people actively seek to exploit the many security problems of industrial systems."
Because what our alies do with other countries' industrial systems (like p.e. centrifugues) is not evidence.....
1 Every nation war games every scenario and as a part of securing the ability to realize those scenarios should they have to, they carry on things with potentially sinister applications. News at 11.
2 Just saying this so no one gets drummed up into the idea that "this means they're going to attack!" or "this is totally outrageous !!" It is outrageous, on PlanetNice where humans are banned. Back on Earth, where humans are what they are ...goto 1
as for trolls the parent was actually quite informative and for me non-native speaker of english it was an intere4sting read. Still a troll as it should be but a nice one. At least something positive to think about on lazy sat afternoon.
Siding with General Alexander on this one (I personally object to their scanning US citizens via xKeyScore + prism though, bigtime)! Why? Well, I see, & have seen, daily for the past 15++ yrs. now just how much malware or malscripted sites that infest folks occurs is how/why. I get a range of roughly 200-5000 a day on those (& other 300-400 a day on bogus things advertisers put into page you don't see like trackers too). I know what I'm about here, via my application for building custom hosts files (that adds more security, speed, reliability, & also anonymity to an extent):
APK Hosts File Engine 9.0++ 32/64-bit:
http://start64.com/index.php?option=com_content&view=article&id=5851:apk-hosts-file-engine-64bit-version&catid=26:64bit-security-software&Itemid=74
Most folks wouldn't believe how much goes on from "cracker/malware makers" daily - it's unreal! They must be profiting by it, and then you take what security sites like ThreatPost, Dancho Danchev, sophos & others puts out too ontop of it which we only see a fraction of here in news articles? You get the picture, pretty fast, as to "what's-what" on that account.
APK
P.S.=> This happening almost makes you *think* the idiots want to leave 'backdoors' in their systems - a "good excuse" imo, for one of their own to 'hack in' from either the outside or even inside internally to say "Oh, it was hacker/crackers' that did it". Seriously! Don't they realize they set customers @ risk & when you do that, class-action lawsuits can harm a companies' profitabilty/bottom-line even with insurances vs. it which by them leaving the side windows open & unlocked for lack of a better analogy, but they are triple locking the front door only to their business set themselvse wide open to negligence suits + other damages).
Best line I heard in years goes something like this in regards to automatic voltage controllers for electrical generators: "inexperienced youngsters write all kinds of so-called features into the control software, most of which you should TURN OFF immediately, and NEVER turn back on - just like all the crap in 'WORD' bloatware".
Find a Vietnam fighter pilot and ask them what they did to the fuse box that powered all the "flight alarms" immediately after leaving the ground.
Recommended reading:
199307 Engineering Times - Will High Technology Bring Engineering Disaster? [unverified software applied by unqualified users]
199409 Scientific American - Software's Chronic Crisis, W. Wayt Gibbs [software is being written but not by programmers]
199409 IEEE Spectrum - Judgment's Subtle Presence [replacing the decisions made by people with pre-programmed ignorance]
199703 IEEE Spectrum - Reflections on Complexity, Robert W. Lucky [just because you can does not mean you should]
199707 WIRED - Digital Obesity, Nicholas Negroponte ["personal computers" have never been people friendly]
199707 IEEE Institute - Software Engineering [accreditation of educational programs for "professional" programmers]
199800 Walking on Thin Ice by Peter de Jager [how the Y2K problem was created by the bureaucrats, not the programmers]
199802 WIRED - Productivity Paradox [the numbers, folks, where are the numbers to back up the continued spending?]
199907 US NRC- 464th ACRS - Commentary by Dr. Graham Wallis on RETRAN-3D [only "real professors" know what is correct way to "engineer"]
199907 No High Tech Training - The Financial Times by Rebecca Christie [a partial explanation of the productivity paradox]
200004 US NRC - Digital Instrumenation Research Plan [the emperor has no software quality assurance program]
200502 US NRC ACRS Sub-C on THP - Commentary by Dr. Graham Wallis on TRACE [user manuals generally suck - DUH! so do most textbooks]
200503 How computers make kids dumb - Andrew Orlowski - San Francisco [the title says it all]
2009?? Bounded Model Checking Using Satisfiability Solving - Edmund Clarke, Armin Biere, Richard Raimi, and Yunshan Zhu[just WOW]
201206 Botched Computer Analysis Does In California Nuclear Plant [Management bonuses will NOT be returned to the ratepayers]
TFA indicates they rooted the attacking computers using holes in the browsers they were attacking with, and then used the visible wifi hotspots to locate the machines. It does not say that they checked to make sure the machine was not being remotely controlled, or itself a honeypot. Using this technique not all the sophisticated attacks came from China, some were U.S., Japan, France, etc. but over half were from China. Also not all the honeypots were in the U.S., so its not only the U.S. being targeted.
refactor the law, its bloated, confusing and unmaintainable.
Per my last post though just prior to/above yours? See subject-line above, this http://it.slashdot.org/comments.pl?sid=4046997&cid=44465451 and of course my agreement with you, to an extent (which I cover in that link)!
PLUS what I have HAD to "re-evaluate" as well that I also pointed out today in that link!
(Yes - I had to "backpeddle" on because up front? It's a GOOD THING not only for security, but job creation, and even for companies vs. insurance coverage denials + customer lawsuits)
Stilll - yes, against PRISM here - mainly for reasons of "big brother" possible misuses/abuses via "absolute power corrupting absolutely" + mortal men, & low "ROI" imo, vs. spying on EVERYONE (especially fellow US citizens)...
However: Yes I am upset about republicans blocking the "cyber security bill" -> http://news.slashdot.org/comments.pl?sid=4046897&cid=44465983 for MANY reasons also!
APK
P.S.=> Again though, for what YOU stated, & what I do now in my subject-line above - I hate when they put up something that yes, sounds good "up front" but *try* to "sneak in" things inside of 100's of pages bill legislations in the "fine print"... what? Nobody will READ them?? Maybe politicians are like that - but it's our money being spent, there WILL be folks checking (especially nowadays)... apk
70 is low, I get 65 a day from my home hunny pot... mostly jest sweeps but there are some e-mail/ftp/php attacks done on it each day.
...arrests or other legal action did it result in? None? Then your experiment did nothing but waste time and money to state the obvious.
It said replace with another word, not with another word and some punctuation.
FAIL.
Pooh sets up a honeypot; finds most attacks come from himself and bees. Oh bother.
thanks
I needed a smile.