Slashdot Mirror
Hacking Group Linked To Chinese Army Caught Attacking Dummy Water Plant
holy_calamity writes "MIT Technology Review reports that APT1, the China-based hacking group said to steal data from U.S. companies, has been caught taking over a decoy water plant control system. The honeypot mimicked the remote access control panels and physical control system of a U.S. municipal water plant. The decoy was one of 12 set up in 8 countries around the world, which together attracted more than 70 attacks, 10 of which completely compromised the control system. China and Russia were the leading sources of the attacks. The researcher behind the study says his results provide the first clear evidence that people actively seek to exploit the many security problems of industrial systems."
The plant is real and the headline is a cover up/reverse sneak - because panic. But hey, if it turns out to be a honeypot, don't expect it to work twice :)
Why are critical systems on the 'net?
They functioned perfectly 30 years ago without the internet...
CAPTCHA = 'yourself'
Spoof the interface to make the attackers believe they are attacking a foreign industrial plant.
In reality, they are attacking the utility plant located down street based on WiFi location.
The main purpose of the honeypot system is to obfuscate the true location of the target (the attackers own infrastructure).
Then watch hilarity ensue.
Defense systems would be great. You could get countries to nuke themselves using their own cyber ops team.
"The researcher behind the study says his results provide the first clear evidence that people actively seek to exploit the many security problems of industrial systems."
Uhhhhhh Stuxnet was an exploit of Siemen's industrial control systems which regulated the RPMs of centrifuges....
In part, perhaps because 30 years ago the advantages of/needs for large scale efficiency and coordination weren't so great as today? Isolated systems may have higher operations costs and may not efficiently integrate into big systems, but they tend to have few or no remote attack vulnerabilities. Bottom line: economics favor connected systems, and anything on the net can be pwned.
This just one more example of why critical systems should never be connected to the internet. The should always be an air gap.
"The researcher behind the study says his results provide the first clear evidence that people actively seek to exploit the many security problems of industrial systems."
The first eh? I guess he hasn't heard of the tools included in such common distros as Back Track, why do you suppose SCADA exploitation apps are in there?
"If any question why we died, Tell them because our fathers lied."
RTFA. Yes, IP addresses are easily spoofed, and provide essentially no information on the target. That is, in fact, why more information than that was gathered, using the nature of the honeypot in question to gather additional data from the attacking machines. I suspect that it would be possible to configure your system and network in such a way as to spoof the nature of your own local network configuration so that a counterattack of this nature would reveal misleading information about your locality... but the nature of the attacks, and the response to them, make this exceedingly unlikely. tldr; yeah, it was people in China and Russia, and there's proof. Still doesn't mean that their governments were involved, of course.
Pooh sets up a honeypot; finds most attacks come from himself and bees. Oh bother.
As somebody who left the network / sysadmin business before the attacks started from the inside (send enough malware to everybody inside a company and you will get lucky at a certain moment), how would you protect it best?
Airgap it (or properly firewall it), and people will complain about the costs of duplicate infrastructure, remote support from vendors will be a pain etc.
Monitor the network and spot anomalies, it's a hard task but could be the way to go. Except that you need skilled people there (not saying that there aren't, my experiences in a TAC shows that there aren't many).
Letting the attackers waste time in a honey-pot while your own network is isolated? At least you learn from it and you give them a false sense of victory.
What is wisdom, any thoughts?
bash$
How many people have been damaged by the acts of out of control politicians who answer to anyone that has the price to pay? When do the voters get their chance to be heard?
The mind conceives, the body achieves, the spirit manifests.
http://articles.latimes.com/2012/aug/03/nation/la-na-cyber-security-20120803
U.S. Chamber of Commerce leads defeat of cyber-security bill
Why is Snark Required?
I'm not trying to defend WiGLE but it isn't really identifying by IP or any other stock measure. I understand about the geolocation data based on IP addresses but the WiGLE site is mostly user generated by war drivers along with GPS data built by programs like Kismet and netstumbler. It refines the locations by averaging the latitudes and longitudes of the SSIDs gathered using the signal strength (squared) as a weight.
In other words, it relies on users- not out dated published materials who have visited the field and location. Try it yourself and see how accurate it is. Click on the map page, zoom out enough until you can click and drag it to your area, look at the available networks to your computer and then try to zoom in to where you are at and see if they are listed. Someone, or more likely several people, have been at or near your neighborhood and posted their finds. There are aps that run on phones and people can turn them on while driving home from work, riding the bus or subway or while doing anything else too. Imagine the Google street view car mapping access points and making all the information searchable.
Well, it looks like their site might have been slashdoted. It's not showing the SSID's any more and has replaced it with a plot error message. It might take a while for them to get it back up properly. I found my area and it was accurate within football field range. The Chicago example I posted was a random look up trying to be as neutral as possible.