Slashdot Mirror
Industrial Control System Firms In Dragonfly Attack Identified
chicksdaddy (814965) writes Two of the three industrial control system (ICS) software companies that were victims of the so-called "Dragonfly" malware have been identified. ... Dale Peterson of the firm Digitalbond identified the vendors as MB Connect Line, a German maker of industrial routers and remote access appliances and eWon, a Belgian firm that makes virtual private network (VPN) software that is used to access industrial control devices like programmable logic controllers. Peterson has also identified the third vendor, identified by F-Secure as a Swiss company, but told The Security Ledger that he cannot share the name of that firm.
The three firms, which serve customers in industry, including owners of critical infrastructure, were the subject of a warning from the Department of Homeland Security. DHS's ICS CERT said it was alerted to compromises of the vendors' by researchers at the security firms Symantec and F-Secure. DHS said it is analyzing malware associated with the attacks. The malicious software, dubbed "Havex" was being spread by way of so-called "watering hole" attacks that involved compromises of vendors web sites. According to Symantec, the malware targeted energy grid operators, major electricity generation firms, petroleum pipeline operators, and energy industry industrial equipment providers. Most of the victims were located in the United States, Spain, France, Italy, Germany, Turkey, and Poland.
The three firms, which serve customers in industry, including owners of critical infrastructure, were the subject of a warning from the Department of Homeland Security. DHS's ICS CERT said it was alerted to compromises of the vendors' by researchers at the security firms Symantec and F-Secure. DHS said it is analyzing malware associated with the attacks. The malicious software, dubbed "Havex" was being spread by way of so-called "watering hole" attacks that involved compromises of vendors web sites. According to Symantec, the malware targeted energy grid operators, major electricity generation firms, petroleum pipeline operators, and energy industry industrial equipment providers. Most of the victims were located in the United States, Spain, France, Italy, Germany, Turkey, and Poland.
I hadda look this one up.
3D Printing Tips and Tricks at Zheng3.com
The only reason this is an issue is because we have a centralized power grid.
if we could provide energy with energy from our own backyard this wouldn't be an issue,
read more here:
http://insitenrg.com/energetic-bear-malware-targets-us-power-plants/
Good luck with securing that as a protocol. Might as well tape a 'kick me' sign on your back. When you are controling things that can kill people why is ease of use/development even a consideration?
So the Belgian and German companies can be named, but not the Swiss one? That seems strange.
Having only RTFS, this is what I can glean:
1. Three European companies were hit with malware.
2. Two of them are named, the third name 'cannot' be shared.
3. Symantec & F-Secure found the malware, then notify DHS.
Very, very strange sequence of events.
Peterson has also identified the third vendor, identified by F-Secure as a Swiss company, but told The Security Ledger that he cannot share the name of that firm.
Well, HELLO there, internets!
It'll be interesting to see why that company could not be named. Banking, perhaps?
Coffee-driven development.
It's a good thing none of these industrial controls require IE 6 with an unsupported OS with updates turned off requiring a live internet connection or anything stupid. For a minute that would imply mass incompetence
http://saveie6.com/
My employer had SCADA sent via a telephone line to some engineer at another location Walt had no idea how the plant operated or what the info he could see meant and could have started or stopped some equipment remotely. One of the telemetry techs allowed a contractor to shut down a 9 million gallon/day lake pump, not a good thing. There wasn't even a password.
Some industrial-control systems simply should not be on the Internet at all.
If you need to control them remotely, do so with dedicated networks that never touch the Internet. You know those old copper wires that used to run the phone lines? Well, they still go to the telco's switching office. If you aren't using them for anything else, get with the phone company and have them directly-connected to another pair of wires at your remote-control facility. Then run your own encrypted/authenticated communications on top of that dedicated connection.
Back things up by using a secondary channel to authenticate certain commands. This secondary channel might be something as simple as having two responsible on-site employees turn two physical keys at the same time, with instructions not to turn the key until they are satisfied that the command was ordered by someone with the proper authority, much like they do (or used to do) in nuclear missile silos to prevent an accidental start of World War 3.
Sure, someone could tap into the physical line and try to listen in or inject commands, but "good luck with that" thanks to your encryption. You will still be vulnerable to a denial-of-service attack, but it's hard to stop a fiber, er, I mean copper-wire-seeking backhoe that is obeying Murphy's Law.
Oh, and yes, I'm aware that an "air gap" doesn't stop all attacks (*cough* Iranian centrifuges *cough*) but it makes things much harder on an adversary.
14 comments on one of the nerdiest stories this side of Snowden. And what do we have next, a story about how fireworks work with over 100 comments. Pack it all up people, slashdot is officially dead for any sort of intelligent discourse.
... the gods themselves, contend in vain. The first time I heard of this, my instant thought was that it was utter stupidity to connect any industrial process to the Internet. Since then, every comment I've heard or seen from every source follows the same idea, so why is anyone still doing it?
The cost argument really doesn't fly. Can you imagine the firestorm of compensation claims when (not if) the first major disaster takes place?
The EWON part is O-l-d?
As in January 30? And they have already addressed it?
As EWON users, we have had no trouble with it.
You came here for, what....INTELLIGENT DISCOURSE?!
In fairness, it DOES sometimes happen. But, Mack, quit crying. There are humans involved.