Cyberattack On German Steel Factory Causes 'Massive Damage'

An anonymous reader writes: In a rare case of an online security breach causing real-world destruction, a German steel factory has been severely damaged after its networks were compromised. "The attack used spear phishing and sophisticated social engineering techniques to gain access to the factory's office networks, from which access to production networks was gained. ... After the system was compromised, individual components or even entire systems started to fail frequently. Due to these failures, one of the plant's blast furnaces could not be shut down in a controlled manner, which resulted in 'massive damage to plant,' the BSI said, describing the technical skills of the attacker as 'very advanced.'" The full report (PDF) is available in German.

Comments

Krupp will rise from the ashes

[Anonymous Coward]

And conquer your fatherland.

yeah right

[Anonymous Coward]

"sophisticated social engineering techniques"

So they got some pizza delivery before this all started.

Re:yeah right

[Anonymous Coward]

I spent 4 years working very hard to get a classing "engineering" degree that I can use to build things. I can't believe I am the only one who takes offense at scammers and con artists also being called "engineers"?

Re: yeah right

[Anonymous Coward]

Engineers are so pretentious. Why does it matter what term is used? What a silly thing to be offended about. Every time the title of software engineer gets thrown around, the other engineers make a fit about it too. Can't change my job title. Sorry.

Re:yeah right

[kruach aum]

Did they teach you what to call someone who drives a train during your education?

Re: yeah right

[Anonymous Coward]

Yeah, its a bit silly. Software engineers have to shovel code into the compiler like regular engineers shovel coal into the engine.

Re:yeah right

[Anonymous Coward]

Well, in good English they're called engine driver.

Re:yeah right

[AK Marc]

You use your degree to build things? What, did you go to Lego University?

Re: yeah right

[Anonymous Coward]

They did. It's called a train driver.
Sorry I don't get your point.

Re:yeah right

[Anonymous Coward]

Move to Canada. We're a little obsessed about who can be called an engineer here.

Re:yeah right

[Anonymous Coward]

Yes, a "Train Driver".
https://nationalcareersservice.direct.gov.uk/advice/planning/jobprofiles/Pages/traindriver.aspx

Is the American education system that flawed they use "engineer" to mean "driver"?

Re:yeah right

[0100010001010011]

If there is anything I learned in college it's that you can walk into about anywhere with a stack of pizzas.

Just walk towards a door and fumble with it and someone will badge you in.

Re:yeah right

[K. S. Kyosuke]

to engineer, v.: 2.b fig. To arrange, contrive, plan, superintend. Also (U.S.), to guide or carry through a measure or enterprise; to manuvre, (occas.) to ‘shepherd’.

Re:yeah right

[K. S. Kyosuke]

No, an engineer, among other things, is a person in charge of a steam engine. It just so happens that some trains happen to use a steam engine, too.

Re: yeah right

[Anonymous Coward]

"Shovels coal"

Who designed the road you use every day? The treatment system for the water you drink? Wastewater collection and treatment? Building structure you work in? The airfoils, ships, planes, trains, etc.? It must be the person who shovels coal, right? Get with the program and have some respect.

Re:yeah right

[Anonymous Coward]

Honestly said, back in the noble age of steam, engineers were more or less expected to repair any fault emerging in the field, thereby needing to know how to pick apart their locomotives blind-folded and re-assemble it. It is a shame to compare that with some nigerian semi-simian trying to strip the baka palaface of their money.

Re: yeah right

[Anonymous Coward]

I was a coward long before posters here at /. Copped the term

Re: yeah right

[slashdotwannabe]

Ummmm

Sophisticated social engineering, right...

[Anonymous Coward]

"The attack used spear phishing and *sophisticated social engineering techniques* to gain access "

You won't believe these 12 crazy facts about Kim Kardashian!

Captcha - Unopened

Re: Sophisticated social engineering, right...

[RivenAleem]

*Angela Merkel

What took them so long?

[Archtech]

About 20 years ago I used to lecture on the topic of computer security. Taking my cue from UK government experts whom I had met back in the 1980s, I used to point out that the only secure computer system is one that cannot be accessed by any human being. Indeed, I recall one expert who used to start his talks by picking up a brick and handing it round, before commenting, "That is our idea of a truly secure IT system. Admittedly it doesn't do very much, but no one is going to sabotage it or get secret information out of it".

I still have my slides from the 1990s, and one of the points I always stressed while summing up was, "Black hats could do a LOT more harm than they have so far". To my mind, the question was why that hadn't happened. The obvious reason was motive: why would anyone make considerable efforts, and presumably put themselves at risk of justice or revenge, unless there was something important to gain?

Stuxnet was the first highly visible case of large-scale industrial sabotage, and I think everyone agrees it was politically motivated - an attack by one state on another, and as such an act of war (or very close to one). This looks similar, and apparently used somewhat similar methods.

The article tells us that "...hackers managed to access production networks..." The question is, why was this allowed? If "production networks" cannot be rendered totally secure, they should not exist. Moreover, if they do exist they should be wholly insulated from the Internet and the baleful influence of "social networks" and the people who use them.

Re:What took them so long?

[burni2]

1.) "is the one that cannot be accessed by any human being"

- virtual or physical -

So the answer what real secure system (composed of human, machine or both) you have in mind is. none.
You need people or machines to built things, there you go again, you implement the human factor from the start.
And your approach just points out the fact that nothing is 100% safe. This thought is so utterly flat as it is true, but it does not offer any train thought which steps to undertake to at least increase the security.

2.) We will see more failiures that big in the future as the buzzword "industry 4.0" is coined. Due to the approach of interconnecting each and everything, all your lamenting does not stop anyone from doing it.
If you cannot stop or deflect a movement, at least try to alter the movement.

3.) "Why was this allowed?"

Because your typically ERP System SAP & Oracle to name the big to be frail twins does exactly this. It interconnects production, accounting, document maangement, it can control your whole material workflow.
All on the same system.
Yes, this is a weakness, gain access to SAP-accounts with acting power and you can make a factory start order and producing tons of bullshit.

4.) "Black hats could do a LOT more harm than they have so far"
Good lord, another one of those general thoughts.
- suicide bombers certainly don't fear the death, so death penalty for suicide bombers is a bad idea.

5.) the best approach to in an insecure world is to start asking the "what can possibly go wrong" and "how can we prevent the risk" and "how can we mitigate the consequences" questions
In engineering this is called an FMEA(1) and this works for computer security too. Because it does take the human factor into account.

(1) http://en.wikipedia.org/wiki/F...

Re:What took them so long?

[WoOS]

The article tells us that "...hackers managed to access production networks..." The question is, why was this allowed?

When I was in university we wrote an optimizer in "Operations Research" for a still-mill as a practise which determined optimum cutting lengths of steel 'bars' based on customer orders.

Orders probably arrive in the office network. I can well understand people don't want to walk with a USB stick (if that would survive the environment at all) from their office to the plant to feed instructions into the industrial control units. So probably some network connection was introduced and thought to be sufficiently secured. And then the Windows on the "safe" side was never updated because it couldn't connect to the internet anyway. Wind forward 10 years and you have a Windows full of completely unimaginable holes (which are easy to exploit because Windows is the same everywhere) which is indirectly accessible from the internet.

Re:What took them so long?

[oodaloop]

I still have my slides from the 1990s

How much clip art was there?

Re:What took them so long?

[JaredOfEuropa]

Sure, information needs to be passed back and forth between the office and the plant. The first step in security is to assume that your office network is the same as "the Internet": you don't know what's on there, it is full of malware and hackers, and they are actively out to try and get you. Assume your office network fully compromised, and secure the production network accordingly.

Re: What took them so long?

[Anonymous Coward]

Most importantly, in both cases it appears analogue backup systems didn't exist.

Iran could have figured out why their centrifuges were blowing with a cable driven analogue tachometer from the 70s.

Germany could have shut down the blast furnace in a controlled manner with a hand valve.

It's bonkers to completely trust electronics.

Re:What took them so long?

[amorsen]

Moreover, if they do exist they should be wholly insulated from the Internet

Systems which are insulated from the Internet rarely get security updates and security reviews often miss them. Yet all it takes is a compromised laptop on the wrong network or a USB stick inserted into the wrong machine, and suddenly the whole "secure" network is up for the taking.

Critical systems should be designed to function despite FSB, Mossad, and the NSA all have having direct access to every LAN. Alas, that is practically impossible to achieve today, industrial systems and management functions do not have the necessary security features to work in such an environment.

Re:What took them so long?

[amorsen]

It is difficult to think of something LESS secure than plugging USB sticks into production equipment. I will take ethernet over that any time. At least the ethernet controller and driver is likely to be fairly secure, unlike the USB host and driver.

Re:What took them so long?

[Archtech]

"This thought is so utterly flat as it is true, but it does not offer any train thought which steps to undertake to at least increase the security".

Precisely! The purpose of such statements is to focus the listener's mind on the highly unwelcome (and perhaps unfamiliar) idea that security is utterly antithetical to everything else we seek in a computer system.

Good security usually means lower performance, slower response time, greater cost, far less user-friendliness, and very noticeably less convenience in general. But if you want security, that's part of the price.

Since most people - including senior decision-makers - have little or no understanding of the issues and tradeoffs, this means that security will normally be severely neglected. So attackers have a fairly easy task and a target-rich environment. Until something really bad happens, when there is suddenly an outcry and a witch-hunt.

Re:What took them so long?

[Entrope]

On the one hand, you have to worry about security holes in the USB driver and file system.

On the other hand, you have to worry about security holes in every piece of software that talks to the network.

If I really wanted to reduce exposure for a network, I would probably use single-session CDs to cross the air gap, and make sure to pack any extra space with random data.

Re: What took them so long?

[Anonymous Coward]

Electronics is fine. It's *software* you can't trust.

Re:What took them so long?

[burni2]

In his generality he simply missed the opportunity to project his view and understanding of the problem onto his audience. Which in contrast to some /..ers back then might not have been aware of certain threats and criminal intents. Interpreting his statement, he did that again.

This is what I criticised, to say it with a metaphor:
Sometimes a statement is like a fart in the air, it stinks, but when its gone nobody cares.

Re:What took them so long?

[Anonymous Coward]

the hell is a "still-mill"?

Re:What took them so long?

[itzly]

An air gap is not very useful if it needs to be crossed on a regular basis. If you write your single session CDs on a compromised network, the instructions on the CD itself can also be compromised. Also, when you make it too inconvenient for the operators to do their jobs, they'll undermine your security plan by installing a hidden access point somewhere.

Re:What took them so long?

[Entrope]

The point of an air gap is to make data transfers much more controlled. Some can be crossed regularly (with appropriate control), and some should not. One should only adopt any security measure after a cost-benefit analysis. The depth and rigor of that analysis should be determined by the expected costs (ongoing/operational) and potential costs (from a successful exploit).

Thus, I said "If I really wanted to reduce exposure", not "Everybody should do this to reduce exposure". If the productivity costs are very high, you had better impose enough oversight to deter or catch any policy violations... or choose a security policy besides "air gap". My basic points stand: much more software regularly talks to a network than regularly reads from CDs, and the protocols involved are much more complex for network communications; and USB sits in between those two.

FWIW, industrial control instructions can be made much more regular than arbitrary data, making it easier to detect a compromise before it reaches its ultimate target. For example, if the usual file size is 1 MB, you had better have a good reason for it to suddenly be 3 MB. If you are really paranoid, you might have a format checker or sanitizer to act like a very application-specific antivirus.

Re:What took them so long?

[Bob9113]

If "production networks" cannot be rendered totally secure, they should not exist. Moreover, if they do exist they should be wholly insulated from the Internet

There's always a connection to the Internet. Sometimes it is sneakernet, sometimes it uses photonic information dellivery to bio-ocular scanning device, which uses cranial data storage and processing, and meatfingers to transmit the data through an array of buttons commonly called a "keyboard"; but there is always a connection. Hacking airgapped networks (which are still networks, just with some strange hops through biochemical computers) is just another stop on the path. If we can trick a computer into accepting a "dangerous" value, we can do the same for humans. If we can train humans to reject those values, we can train computers to do the same.

Humans are just another kind of programmable machine on the network we call Earth, with different kinds of exploitable flaws. Right now we trust the machines more than we should so their security is weaker than the humans in many cases, and so the machines are the targets. But that will change though hard experience.

Not trying to contradict you, just noodling on the nature of being a node on a network.

Re:What took them so long?

[TheCarp]

Well hindsight is always 20/20. Few people look into securing their houses what haven't been robbed or known someone who was. Nobody benefits from this sort of attack; like you say, its a motive issue. Why does the production network need so much proection? Up until now it hasn't. There was nothing of any value there for anyone....only of theoretical value.

The only people who carry out this sort of attack are the ones who work for armies because they don't have to worry about personal reprisal and they are not interested in any sort of profit. Its just a game to them; and they will work to whatever goal they are told to.

Its the rise of this "cyberwar" bs that creates the danger in the first place. The only result is going to be to hurt some insurance company that is going to pay, or the steel factory, but more will be built. However, within the context of a cyber war group this is a demonstration of effecitveness or even a win for some petty head of state.

This is one more area where I was happier with the old threat of money hungry gangs and the occasional rambunctious kid than the massive politically directed machine that is supposed to protect me from them but ends up just being bigger, badder, and more capricious versions of the same.

Re: What took them so long?

[F.Ultra]

A really secure air gap that would work with continous data streams should be built somewhat like this. 1. Define a simple protocol for the instructions. In the case of this steel mill it should be "produce x amount of class y steel". Thus there is limited ways of compromising the system via the protocol since there is no detailed instructions to fuck up the mill as in the article. 2. Air gap it by having the computer connected to the internet print out the order to paper. The the operator moves that paper to the production machine where it is scanned and ocr:ed

Re: What took them so long?

[Entrope]

Sure... if.

1) If you can define the protocol to be simple enough, and
2) if you can be sure that only the intended application will process the data stream on the secure side, and
3) if you actually test that application enough to be confident it is secure, and
4) if you can ensure that sensitive information will not (improperly) leak back down the other direction, and
5) if you use it often enough to pay for that development cost, and
6) if you can resist the pressure to add features or "generality" to the protocol that makes it more costly to ensure secure processing...

then maybe such a protocol makes sense. Maybe somebody somewhere has satisfied all those ifs, but I would suspect not. For your simplified example, it is probably cheaper -- and just as secure -- to have an operator enter the dozen or so keystrokes to order "produce x amount of class y steel" than to design, build, install and support a more automated method. Human involvement has the added bonus of (nominally) intelligent oversight of the intended behavior for the day.

Re: What took them so long?

[Hognoxious]

Electronics is fine.

Until the power goes off.

Re:What took them so long?

[Anonymous Coward]

The red flag is of course the fact that the hack started from the office network. The factory simply didn't follow best practices in securing the control network for convenience sake. The cost is measurable, as they have now discovered.

Re:What took them so long?

[Bengie]

The enemy of good is perfect. It's better to design your security around best practices and have recovery modes. My immune system doesn't stop me from getting sick all of the time, but it does a good job recovering. That should be the goal.

Re:What took them so long?

[Hognoxious]

He must get confused at hockey matches. Every time someone gets sent to the sin bin he expects to see Boromir from LotR.

Re:What took them so long?

[hey!]

You can turn that question around. Given the manifest possibility of such a act, why haven't more organizations taken steps to prevent them?

We keep hearing from the companies attacked and the press that these attacks are "sophisticated", but this attack started with a simple spear phishing attack. People use "sophisticated" to mean "more trouble than we were prepared for."

Comparisons to Stuxnet seem overblown and (in some cases) self-serving. Stuxnet was designed to undermine systems the perpetrator had no access to; it would work even if the administrators of the target system successfully locked the attacker out. In this case the administrator failed to secure the network from the attacker.

Not every persistent threat is an advanced one.

Re:What took them so long?

[dkf]

The first step in security is to assume that your office network is the same as "the Internet": you don't know what's on there, it is full of malware and hackers, and they are actively out to try and get you.

Unfortunately, the office network is also definitely full of managers, and prizing a bit more convenience at the cost of "a little" more risk is a classic thing that managers order. They are also usually able to find people who will carry out the orders.

Re:What took them so long?

[dcollins117]

People use "sophisticated" to mean "more trouble than we were prepared for."

Well, it's partly that and part face-saving spin. No one wants to admit they were duped by a simple attack. Only a fool would fall for something like that.

Re:What took them so long?

[AK Marc]

Moreover, if they do exist they should be wholly insulated from the Internet and the baleful influence of "social networks" and the people who use them.

And even if they are, they are still vulnerable. Air gap doesn't work. Security through obscurity does. Especially when "obscurity" means "renders unusable".

Re:What took them so long?

[AK Marc]

What people fail to account for is someone willing to spend $1B to break a $1M machine. This type of insanity is ignored. But, if someone did want to break your toy, you couldn't stop them.

Step 1, they buy your $1M machine (duplicate from the manufacturer). They use it. They find the USB port. They determine the exact signature sent by it.

Step 2. They make USB drives with firmware that looks for that signature and sends different drivers if detected. So the USB drive will serve good drivers and work properly when put in a computer to load the files on. But when you put it in the industrial machine, it will not share the files, but serve up the custom-buit virus.

Step 3. Go to the plant you want to break as a visitor. Drop 10 of the USB drives (all in different colors, styles and sizes, so nobody thinks they are 10 of the same thing). Someone will grab one from the Lost and found when needed. Drop a few in the parking lot. If you are really spending $1B, then sell them too them at a good deal, as anyone using USB for a critical function will be buying USB drives often. Sell them in the stores near where the workers live.

Then wait. Someone will plug you trojan horse into the right gear eventually. Unless they manufacture their own USB drives, they will be vulnerable to this attack.

Security only exists to deter. It can never be both secure and usable.

Re: What took them so long?

[osu-neko]

A lot of my electronics keep working. Indeed, one of my most important electronic devices is the one I'll subsequently use to call the power company to complain that the power is off.

Re:What took them so long?

[DerekLyons]

3.) "Why was this allowed?"

Because your typically ERP System SAP & Oracle to name the big to be frail twins does exactly this. It interconnects production, accounting, document maangement, it can control your whole material workflow.
All on the same system.
Yes, this is a weakness

Yes, it's a weakness - but it's also the whole point of having an integrated system in the first place. The armchair sysadmins here on Slashdot keep missing that point... these systems exist for a reason.

Re:What took them so long?

[Entrope]

If you have a air-gapped system, you don't let people plug either random USB devices or random Ethernet devices into it. You help enforce this by disabling USB ports, MAC-locking switch or router ports, making it clear that only specific authorized people can import data, and making sure those authorized few use hygienic practices. It's IT security, not brain surgery.

Re: What took them so long?

[Kjella]

For your simplified example, it is probably cheaper -- and just as secure -- to have an operator enter the dozen or so keystrokes to order "produce x amount of class y steel" than to design, build, install and support a more automated method. Human involvement has the added bonus of (nominally) intelligent oversight of the intended behavior for the day.

Do you have any idea what the error rate for manual data entry is? Typically about 0.5% of the entries will be wrong. Retyping information is a very error prone process.

Re: What took them so long?

[Entrope]

Do you have any idea what the error rate for manual data entry is? Typically about 0.5% of the entries will be wrong. Retyping information is a very error prone process.

Do you have any idea that there are known good practices for checking entered data before committing to it? And that most people would want to apply this kind of check before kicking off a production run, of just about anything, regardless of how the order was sent to the system?

What is it about this topic that makes people forget basic engineering practices?

Re:What took them so long?

[AK Marc]

So social engineer someone to place a compromised single-session CD in the unsecure network. Again, you are thinking small. I can think of hundreds of ways to breach a "single session CD" security. You can't make security that can't be breached. You just hope to make it harder to get in than the value of getting in.

Re:What took them so long?

[omglolbah]

Except things that we regularly bring to oil rigs and plug into the 'secure' side of the network: .xlsx and .docx files containing installation instructions and checklists .pdf files with 'red markups' of changed logic .exe files fetched from manufacturer websites with firmware upgrades
A ton of files in proprietary file formats we have no actual way to check the contents of other than trusting the software which created the files.

We essentially have to trust that McAfee and MS endpoint protection will keep stuff out... (office net scans with endpoint, secure side with mcafee)

It is far far faaaar from perfect, and the staff there make it less so by putting usb sticks on their KVM boxes so every time they hop from office->secure and back they re-mount the drives automatically... it is cringeworthy for sure, but nobody sees the issue, or they plain dont care.

Re: What took them so long?

[AK Marc]

If there exists no power on the planet, I have more to worry about than the steel factory in Germany. Also, many of the functions can't be done mechanically (at least not practically). I'm not steel worker, but the small exposure I have had with it, they don't use mechancial thermometers. That's impractical, so they use electronic temperature sensors. And so many other things. So, kill the power to a plant, and you do "massive damage" regardless of what you do to the software.

Remember, Nuclear plants are designed such that 12 hours without power will cause a meltdown. You don't need software if there exists a simple mechanical cause to all problems. Kill the power and watch them fry. I expect that would work in a steel plant too.

Re:What took them so long?

[omglolbah]

With sufficiently 'annoying' security practices, people stop following them.

We were issued password-protect usd sticks for secure use at work, and a month later we got ones without passwords. Why?
People found the encrypted and protected sticks "too cumbersome" and just went out and bought a cheap 16 gig stick for themselves....

I bet the procedures will not be properly followed until one of the oil rigs get taken down. It pains me to know the issues and have zero ways to affect it....

Re: What took them so long?

[omglolbah]

A safety valve -should- go into a safe position when power is lost. Virtually all such valves will be hydraulic anyway (at least in the oil/gas business where I work anyway) and can be operated manually with stored pressure.
The issue in the case of the steel plant is knowing what a 'safe' state is for the valves. That requires a proper consequence analysis with a resulting "cause and effect" matrix for executing safe shutdown. It is tedious as fuck, and expensive as all hell, but mostly worth it. Alas people tend to overestimate the rarity of such events and go or the "save us a bit of money now" solution :(

Re:What took them so long?

[omglolbah]

Virtually all oil and gas rigs in the North Sea are connected (through firewalls of course) to the corporate office network.

Most of them are now moving to "Integrated Operations" which is a buzzword they came up with for "remote control room and maintenance" where the network is extended to vendor locations so that we do not have to send people out to the rig to look at stuff. We just call the rig and ask them to open the 'gate' so to speak and we get full raw network access to the secure network from a dedicated switch at our offices.
This is of course all tunneled across the internet... *sigh*

It is going to go horribly wrong at some point, I just hope I am on-shore when it happens.....

Re: What took them so long?

[Hognoxious]

There might not be one safe position. It might need to be fully closed for X minutes until dial Y reads less than Z, then opened halfway until blayada yadablabla.

This is why you need wheels & handles and a hardcopy monkey sheet. Hans! Turn that one clockwise ... stop. Wait ... Fritz, pull that lever!

Re:What took them so long?

[Entrope]

The single-session CD is supposed to come from an unsecure network. What good will putting it back there do an attacker?

I am not thinking small, I am thinking rational. You are assuming an "insan[e]" attacker, which is rather silly. I'm not claiming that single-session CDs will make a system unbreachable, or that you should try to. My claim is simply that using single-session CDs (in a controlled, hygenic way) makes the cost to breach a system much higher than the alternatives that were suggested (network and USB) -- not even that single-session CDs are always the right solution.

Re:What took them so long?

[AK Marc]

I'm assuming an insane attacker because they are the worst type. Someone willing to spend $1B to break a $1M network will never be kept out. When you are looking at state actors, the price is not as important as the results.

Re:What took them so long?

[thegarbz]

Then the problem is the people carrying out the orders. The worst thing that can be done is putting engineers in charge of process control network security. They know just enough to be really dangerous (and I say this as one of them).

There are ways of hooking two networks together safely such as using the equivalent of a datadiode (I hate that term) between two different machines to sit them on an intermediate network which can then be accessed via some database connection or Citrix for native apps.

Connecting the office network to the process control network should NEVER involved a little blue cable between two routers.

Re:What took them so long?

[gr8dude]

Hi, I teach computer security today and I am curious about what was being discussed in lectures two decades ago. Can you please share your slides?

If you're interested, you can find recordings of my classes by looking for `information security course moldova` on Youtube.

Re: What took them so long?

[F.Ultra]

Since most orders are probably faxed or mailed in via some simple order sheet you have your simple protocol right there. If it's a complicated order then you could have a human operator manually enter it since that should be the rare exception.

Re:What took them so long?

[gzuckier]

On the other hand; long ago, in the early days of electronic hospital records, some executive from one of the companies told of how, when giving a presentation at a hospital and being asked the inevitable question about security, he would excuse himself, go to the closest nurses' station, pick up a fistful of the charts always piled up there, and bring them back to the meeting room and place them on the table.

Re: What took them so long?

[gzuckier]

Do you have any idea what the error rate for manual data entry is? Typically about 0.5% of the entries will be wrong. Retyping information is a very error prone process.

Do you have any idea that there are known good practices for checking entered data before committing to it? And that most people would want to apply this kind of check before kicking off a production run, of just about anything, regardless of how the order was sent to the system?

What is it about this topic that makes people forget basic engineering practices?

Did some analysis for a survey once; they did double entry of the data, i.e. two separate keyboarders read and entered every response and if they didn't match somebody looked at that item.

Re:What took them so long?

[gzuckier]

as in https://en.wikipedia.org/wiki/...

"sophisticated social engineering techniques"

[kruach aum]

What, like, extra-lying? Doubleplusgood lying? I don't get it. There is only one way to not tell the truth.

Re:"sophisticated social engineering techniques"

[Anonymous Coward]

Corroboration works out because you fool a sufficiently large connected set of people using a sufficiently large number of players. Classical training movie: "The Sting". Spoiler, spoiler, spoiler!: There is, for example, one ingenious scene where the victim wants to check upon one purported compromised worker, and a set of people takes hold of the office rooms under a pretense of renovation (again corroborated using fakes), switches all name tags and personal items in the office, has a short encounter, switches everything back and leaves a half-renovated office in their wake.

Re:"sophisticated social engineering techniques"

[Entrope]

There are techniques like "Hello my name is Solicitor Darren White, my client has just deceased and left you a sum of $1,000,000,000 (ONE BEEELLION DOLLARS)...". There are also techniques like "Registration is now open for [industry-relevant convention], please visit [malware-infected site] to sign up so you can keep up with new developments." Beyond that are very individualized attempts to gain the target's confidence, perhaps involving apparently independent contacts -- persona A contacts the target over a job board, persona B uses some of that information to ask for a supplier reference, eventually culminating in executable code delivered directly to the target in hopes that it will bypass virus checks and be executed on a sufficiently privileged computer. More sophisticated social engineering techniques will usually be more narrowly tailored and more costly for the attacker to use.

Re:"sophisticated social engineering techniques"

[AK Marc]

The difference between some guy showing up at the door with "Pizza delivery for the CEO" and placing a mole at the cleaning company. The "simple" stuff should be easily caught. Very few companies vet all the employees of all the subcontractors. But getting a human planted on-site would be a form of social engineering. Just more "sophisticated" than someone walking in off the street with no additional substantiation (other than a pizza and a Dominos hat).

Why would they do this?

[Anonymous Coward]

Easy - ransom.

Now they can point to this and say 'you are next - unless you pay'

The one thing driving hacking now is monetising hacks - from crypto ware to bigger things.

Re:Why would they do this?

[Opportunist]

I have to admit, it could hardly come at a better time. Budget talks are due.

(this is me doing my happy dance)

Re:Why would they do this?

[Anonymous Coward]

Too bad no manager thinks "we'll just shut the plant down an secure it because we'll lose less money that way than if we have to teat it down and build a new one". They'll probably think "this ransom is less than the two above" and leave the system vulnerable and trust the extortionist to not mess with it after getting the money. And fingers crossed no other guy is lurking about.

On the plus side, have enough of these and maybe "code monkey" will fall off the books sooner rather than later, since they'll need people who actually understand what they are doing.

Fundamental failure of process design

[thegarbz]

Ok everyone is going to leap into the whole world of control system, cybersecurity and what not, but I have a far deeper question.

What kind of a plant is designed in a way that a full failure of their control system would result in being unable to shutdown in a controlled manner. Where is the safety instrumented systems that can shutdown processes at a push of a button? Where are the manual overrides? Where is the big-arse power switch, and if that can't shut down the plant safely then where is the system that drops the plant to a safe state in the advent of loss of power.

This scenario to me sounds like cybersecurity was the lease of their problems.

Re:Fundamental failure of process design

[Anonymous Coward]

This. With a proper fault tree analysis or similar you'd think that they would have covered this scenario.

Re:Fundamental failure of process design

[Shimbo]

Uncontrolled is not necessarily the same as unsafe. If you pull the power to a steel plant, you have have steel set in all the wrong places, and it will be a devil's own job to return the plant to working order.

Re:Fundamental failure of process design

[AmiMoJo]

You have to differentiate between a safe but damaging shut down, where there is no risk to human life, and an unsafe shutdown. You use a car analogy parts of the body work are designed to fail in a way that destroys them, but keeps the occupants of the car safe. Industrial systems are often designed on the same principals.

More over, it is very difficult to design any kind of complex machine that can never fail in a way that damages it. Even if it can be done, often it doesn't make economic sense to since the cost of a very low number of failures is likely to be lower than the cost of preventing them. Insurance is a better option, and in this case if their security had been up to scratch it wouldn't have happened in the first place.

Re:Fundamental failure of process design

[Anonymous Coward]

big arse power switch for a big arse furnace is going to fuck up big furnace big time, which may be just what has happened.

Re: Fundamental failure of process design

[Anonymous Coward]

Safety includes property as well as people.

When my employer was designing a land mine detector for the US government (which used a partially automatic hydraulic mount), we were explicitly required to consider and address the risks of damage to people, the system, and third-party objects/property in our safety analyses. Even in case of system faults, it was crystal clear that we were expected to avoid, or failing that minimize, collateral damage.

Of course, that didn't stop drivers from using the system to push things around, probably doing damage to both the sensors and whatever they were pushing. We didn't have input into that control process...

Re:Fundamental failure of process design

[Anonymous Coward]

Uhmm, it was a blast furnace. I'm not sure that it *can* be 'shut down'. Once going, you got to keep it going, or pour the melt out. Shutting the fan off will cause the melt to run down onto the floor, which is probably what happened. That being said, the plant should be designed to handle a runout event. Basically, the melt should run into a concrete pit. Cleaning up the solidified melt and getting it back into a blast furnace would be damn hard though. That is probably what they are referring to as the 'massive damage'. Point is, *everything* in a foundry is bloody massive and anything takes weeks to cool down.

Re:Fundamental failure of process design

[drinkypoo]

What kind of a plant is designed in a way that a full failure of their control system would result in being unable to shutdown in a controlled manner.

Pretty much all of them. At best, you can lose a batch of something if the process fails in the middle. If Sunsweet loses power in the middle of cooking a batch of fruit paste, the batch not only fails and has to be trashed but cleaning the system is far more difficult than if the batch succeeds. At the point where factories become complex enough to need digital automation, you cannot reasonably create a failsafe mechanism which will prevent an error from losing a batch. The best you can hope for in some situations, probably most, is to create mechanical interlocks which will prevent immediately catastrophic combinations of inputs and outputs.

Re:Fundamental failure of process design

[amorsen]

That is pretty much how industry works. There is a right way to shut down a plant, and it involves a lot of things done in the right order. You can do an emergency shut down, and that will not kill anyone, but you will at minimum have to throw a lot of the stuff away that was going through the plant at the time.

Steel works are about a worst-case example of this. Lose power at the wrong time and you have no-longer-melted steel stuck in all the wrong places with no way to remove it. Removing this risk is impossible.

Re:Fundamental failure of process design

[Anonymous Coward]

What kind of a plant is designed in a way that a full failure of their control system would result in being unable to shutdown in a controlled manner.

The kind that exists only in the imagination of people that don't understand such systems. If you know what you are doing you can bring this stuff down manually. I am absolutely certain, however, no one involved with this incident was qualified to attempt it. Typically, the cost of keeping sufficient expertise on hand at all times is too high, so you end up trying to cope with 2nd and 3rd string stand-ins that can't cope with anything the deviates from "normal" operation.

Re:Fundamental failure of process design

[140Mandak262Jamuna]

Where is the big-arse power switch?

It is a bloody blast furnace. They could hold anywhere between 20 and 120 tons of liquid molten iron. They are designed to hold that much of liquid metal continuously for five to 10 years. They keep adding raw materials, keep pouring batches and batches of it out. But it always 50% to 100% full of liquid metal. Once in 10 years, they drain, and essentially dismantle the lining of the furnace, and relay the refractory bricks. A three to six month process typically. I don't know the details, I am sure they have a safety pit lined with refractory bricks to drain the furnace in an emergency, like earthquakes, floods or factory fire. It is possible that process was triggered in this instance.

Re:Fundamental failure of process design

[cryptolemur]

For three hundred years people were able to run them furnaces without the aid of computers just fine. But after the 'puter takes over, you can't do anything without it, even if the damn thing goes south... I'd say it's not a very good design.

Re:Fundamental failure of process design

[Anonymous Coward]

You can't shut down blast furnaces. Once they are on, they are always on. If they are allowed to cool then the walls will crack and break and you have something that was once a blast furnance.

Re:Fundamental failure of process design

[Anonymous Coward]

For three hundred years people were able to run them furnaces without the aid of computers just fine. But after the 'puter takes over, you can't do anything without it, even if the damn thing goes south... I'd say it's not a very good design.

For 100 years, there was a human judging how much of the molten steel to pour off into a batch. Sometimes a little too much, sometimes not quite enough, resulting in waste. Put the pour under computer control, and you increase efficiency. Corrupt the computer, so it leaves the pour running continuously (or have a failure in the manual gate), and you have an emergency. There's nothing magic about the computer control here: it's just one more critical piece of equipment that might fail.

Re:Fundamental failure of process design

[Mal-2]

For three hundred years people were able to run them furnaces without the aid of computers just fine. But after the 'puter takes over, you can't do anything without it, even if the damn thing goes south... I'd say it's not a very good design.

If by "just fine" you mean having a small fraction of the throughput of the modern machinery. The automated systems can be (and thus are) run at damn near peak capacity at all times, which means that when they do fail, it will inevitably be at the worst possible time -- because it's always the worst possible time. The trick lies in determining whether this increased cost of failure is offset by the increase in production. From the widespread adoption of such processes worldwide, it would appear the answer is a resounding "yes".

Re: Fundamental failure of process design

[Anonymous Coward]

There's no way to stop a high-energy process without the risk of property damage. For example, your freight train is going 60mph and needs to stop. If you just hit the brakes, it will be several miles before you stop, which is a problem if you're trying to avoid an obstruction on the tracks ahead of you. But if you hit the emergency stop button, the train stops quickly but may derail, causing untold damage (hazmat leak in an urban area?).

The problem with your blast furnace is that it contains tons of molten steel. If you need to shut it down, you either have to run the plant long enough to dispose of that molten steel, or you just cut power. If you cut power, that molten steel will turn into solid steel, requiring you to get a new blast furnace.

MRI machines have a similar problem. They have powerful permanent magnets, created with the help of many liters (say, 1000l) of liquid helium. If somebody is pinned to magnet by a large metal object, you have to eliminate the magnetic field. All the energy from that magnetic field has to go somewhere, and that place is the liquid helium. Of course that makes the helium evaporate, expanding in volume by a factor of 750. You can vent the helium to prevent suffocating everybody in the room, but removing all that energy from the magnet that quickly may destroy it. Then you have to spend the next few weeks commissioning the MRI (stabilizing the magnetic field, recalibrating, etc.). This process probably costs $100k, not counting the lost revenue from the machine being down.

dom

Re:Fundamental failure of process design

[thegarbz]

They are one and the same when process safety is concerned. In the industry we grade issues on risk and implement safeguards against those risks. It doesn't matter if the risk is environmental, commercial, or safety. The standards for safety instrumented systems talk about a Safety Integrity Level of the systems. Every company I have worked at will also talk about Commercial Integrity Level, and some even have Environmental Integrity Level.

Ultimately it's still a question of process design. I currently work at a plant where a power outage would cause a complete destruction of refractory inside a vessel. They knew this when they built it so part of the project was a small natural gas co-generation powerplant that will keep that unit, and only that unit operational when the grid connection was lost.

Re:Fundamental failure of process design

[thegarbz]

You have to differentiate between a safe but damaging shut down, where there is no risk to human life, and an unsafe shutdown.

No you don't. The principles to process safety apply to both personal risk and commercial risk to a company. Any company that focuses on one and not the other is a fool which probably deserves the cost of replacing equipment. I have personally installed many safety systems that have nothing to do with personal safety at all, and everything to do with companies either not damaging equipment or not getting a fine from a regulator.

The only thing you really need to differentiate is the chart that your figures are displayed on because if in an incident a lawyer gets there hands on something which puts a dollar value on human life the day would get very interesting.

You use a car analogy parts of the body work are designed to fail in a way that destroys them, but keeps the occupants of the car safe. Industrial systems are often designed on the same principals.

More over, it is very difficult to design any kind of complex machine that can never fail in a way that damages it. Even if it can be done, often it doesn't make economic sense to since the cost of a very low number of failures is likely to be lower than the cost of preventing them. Insurance is a better option, and in this case if their security had been up to scratch it wouldn't have happened in the first place.

You're right about this, but not about the scale. Components designed to protect people at the expense of equipment or components designed to protect equipment are often cheap and have a facility to easily replace. Two examples of what you're saying would be bursting disks (designed to pop at a set pressure and prevent vessel rupture), and sheer couplings which come in all sorts of types and will break under stress before something else does. I have never seen a plant designed with the view of protecting occupants during a complete destruction which didn't also have many systems in place to prevent this. Just because for instance the local gas plant buries their vessel in a giant pool of sand, doesn't mean they don't also have other systems to prevent vessel rupture from occurring in the first place.

Now they may have thought about this and applied a value as you said, in which case I'm going back to fool who deserves the cost of equipment replacement and won't shed a tear about this incident.

Re:Fundamental failure of process design

[thegarbz]

Removing this risk is impossible.

You can't remove such a risk but you can reduce it dramatically. But reducing any risk may be impractical. A company may happily operate with the risk and it may bite them (like maybe in this case) but you most definitely can reduce the risk.

One similar example is the plant I currently work at. Sudden loss of power would result in severe refractory damage. When they built the plant they took this into account and built a small natgas fueled co-generation plant next to the process unit specifically so they could ride through the loss of power.

In any case this problem doesn't look like external issues, but rather appears to be process and control system related, which leads me back to my first question, where was the independent system that prevented the plant from getting into a state where a problem occurs? If your risk is sudden stop of the process then your safety system should be designed in a way to keep the process going.

Re:Fundamental failure of process design

[thegarbz]

Read the rest of the sentence, especially the bit about safe state.

Safety systems aren't designed only to keep people safe and to shut places down at cost. Safety systems are also designed to keep things running and sometimes to prevent equipment damage.

Please don't get hung up on 4 words with your process wisdom. Instead read the full paragraph and realise the intent was to say: Where was the independent system that would maintain a safe state at the loss of a control system which you can only take credit for working 90% of the time.

Re:Fundamental failure of process design

[thegarbz]

The trick lies in determining whether this increased cost of failure is offset by the increase in production.

No the trick lies in analyzing the process from a reliability and safety point of view and ensuring individual failures are mitigated. i.e. pump interlocks so if a control system accidentally stops a pump another kicks in to keep things going, valves which fail in the open state to keep the process going.

The goal is that equipment failure should safely reduce rates or safely and without equipment damage shut the place down. If you can't do that you've failed your process safety design, or done something weird with your risk calculation if you want to keep running in that way.

"very advanced"? More likely...

[Opportunist]

I'd rather not call the average attack "very advanced". I'd rather call the average security situation in the average company "very crappy".

And I have little reason to assume this being different.

Re:"very advanced"? More likely...

[itzly]

Maybe this wasn't an average attack ?

Re:"very advanced"? More likely...

[jones_supa]

How do you know?

Re:"very advanced"? More likely...

[Opportunist]

I've audited enough crappy systems to say with some faith that there are VERY few systems out there that would stand their ground against an at least halfway organized assault.

And I'm not really disclosing anything that is under tight NDA or similar bull. Anyone who has an inkling of a clue about IT security will come to that conclusion by the hacks that get public alone. Take the Anonymous/LulzSec (or whatever that was called) hacks of some time ago. Now, I don't want to belittle their effort, but when you look at how high profile the targets were and what simple tricks were involved, you can't help but wonder.

I can't think of a single published attack vector they used that was not part of the OWASP Top 10, which is pretty much the baseline for IT security. That's essentially the very least of what you have to have "down" when you're at least remotely concerned about the security of your IT assets. We're talking about the equivalent of having your door locked at night or closing your windows. Very basic stuff that makes you wonder just why it was possible for them to overcome.

You stop wondering when you spend a bit of time in the corporate IT security business. The problem boils down to a single factor: money. And that's where security really has a problem: It costs a ton of money, but makes none. Every cent spent on security is gone with no chance to ever see it again. And you spend a lot of cents on it because not only the people who can do it sensibly are quite expensive, but because security is also usually anathema to productivity. Of all the companies I know, only in a single one security trumps productivity and availability in cases where they are mutually exclusive (and they are usually numerous). One. Out of hundreds.

IT security is much like an insurance. And just like with many "unnecessary" insurances, companies have it mostly due to either legal or contractual requirements. And just as with insurances, they will "waste" only the bare minimum of resources on it, just enough to abide to contract or law.

I think it goes without explanation just why such a Potemkin village of security straw huts won't stand a breeze, let alone some dedicated storm.

Redundancy needed and not done

[Anonymous Coward]

The problem is, these companies seem to barely afford one system let alone a backup system. They don't do the primary right, so who should expect a good backup plan? Look at Sony for example, we find open emails exposing primary passwords and users to their main system. Its like handing over a key to your house to a thief. When it comes to this German plant, what appears to have happened was no means to take the furnace control offline and manually shut it down. This is a dangerous decision that was probably made on the promise of the computer designers that the system in itself had backup systems in place. Of course they were also controlled by computers. The danger in play, is we have far too many systems totally dependent on computers, without a real logical way to over ride them.
A perfect example is your car today. If your main engine management computer fails, your car won't run. Not even badly, it just won't run. The big risk today is that for every successful hacking like a Sony, or Target, or this German steel factory. Its emboldens the hackers even more to do more damage.

Why are critical systems connected to the internet

[Bomarc]

I read this type of issue time after time.
Why are such critical systems connected to the internet... and further why are they (these critical systems) allowed to see "foreign" websites?
Start with this story: Why is there critical systems allowed to be in the same network as email? They should be physically separated - and never see the light of the www, Degrade the subject to Target, Home Depot et al, and why do their critical systems see anything (everything) on the www? At BEST the only equipment these computers should be seeing is the ONE system they need to communicate with to transfer their business.
Take it one step further: Why do banks - or email (Yahoo, Hotmail, Gmail) NOT allow me to block access from other countries (and/or identify which country I'm visiting)?
Yes, I know that they can use 'other systems' to attack (right now: someone from IP 185.14.30.79 has been using such an attack against my web server for a couple weeks: It's getting really annoying) however such attacks can also be viewed and guarded against.
Leaving the barn door open (by connecting critical systems to the www) for such attacks seems very short sighted.

English translation

[WoOS]

Translation to English to the best of my abilities:

3.3 Incidents in private enterprises
In contrast to governmental offices there is no duty up to now for private companies to report grave security incidents to the BSI.
[.... ]
3.3.1 APT attacks on plants in Germany
Issue
Targeted attack on a steal plant in Germany
Method
Using spear-phishing and advaced social engineering the attackers gained initial access to the office network of the plant. From there they gradually penetrated into the production networks.
Damage
Failures of individual control units or complete facilities occured increasingly. The failures prevented the controlled shut down of one blast furnance and brought it into an undefined state. As a result the facility sustained heavy damage.
Targets
Operators of plants
Technical capabilites
The attackers showed very advanced technical capabilities. Several different internal systems up to industrial components were compromised. The know-how of the attackers did not only cover IT-security very thoroughly but also included detailed technical knowledge on the running industrial control units and production processes.

Re:English translation

[stefffm]

That's precious little information on the actual event. I would not call this a "full report".
Plus, consider the source ...

Re:English translation

[Anonymous Coward]

Thanks, dude. My german reading comprehension is not bad, but not up to this.

Re:English translation

[Anonymous Coward]

The report is titled "State of the IT Security in Germany 2014".
It's not a report about that single incident.

Re: English translation

[Anonymous Coward]

Thanks. From what you posted I read...they got to the PLC's. (Programable Logic Controllers)
Not a easy task and was possibly the first question that needed to be answered in designing this attack.

Re: English translation

[Deadstick]

From what you posted I read...they got to the PLC's.

Likewise Stuxnet.

hopefully germany will get revenge

[tandavanadesan]

They have to be stopped and if the USA won't do it then I hope Germany will.

Re:Why are critical systems connected to the inter

[burni2]

Because, like it or not, the "modern" production works or is at least wished to work with small human interaction.

The general wish is that you can do Enterprise Resource Planning(1) (SAP/R3 & Oracle for example). That you can modell your whole value added chain into such a system.

Also these ERPs can do a process simulation with alteration of certain factors, this helps the "gold collars" to make a choice not soley based on their gut feeling.

- yes many times these models are far from reallity and SAP & Oracle is a pain in the ass if you have dumb integrators -

(1) http://en.wikipedia.org/wiki/E...

Stux

[Anonymous Coward]

Is it just me, or does it smell like someone modified stuxnet to do apply to more models and just tricked someone to installing it?

First Cyberweapon?

[The Walking Dude]

I wish news reports and articles would stop calling Stuxnet the first known cyber weapon. I can understand why they don't count DDoS or website defacements, because those don't cause permanent or physical destruction. Yet, other worms have caused computers to become permanently inoperable, or required computers to be replaced, because their integrity could be no longer be trusted. I suppose those could be excluded, because they didn't cause a bang or create smoke. But, what about the Siberian pipeline explosion in 1982? That infection was not transmitted over the Internet, yet apparently neither was Stuxnet. There must be other examples as well.

Why Germany? They sell anything to anyone.

[Nutria]

I can understand attacking a plant in the US, but Europeans sell anything to anyone with the cash (and then bitch at us for being hypocrites).

Russians, maybe, since Merkel wanted to stay tough on sanctions?

Re:Why are critical systems connected to the inter

[Anonymous Coward]

Why do banks - or email (Yahoo, Hotmail, Gmail) NOT allow me to block access from other countries (and/or identify which country I'm visiting)?

Some do. E.g. my banks do. My banks use two step authentication, which I can disable on a computer by computer basis. (And, e.g., I don't disable it on my phone.)

Since my BYOD laptop usually only travels between my house and my office I have disabled it on that, but whenI take my laptop in another country, or even just another state, the two step auth is automatically reenabled.

And gmail at least has noticed that someone had signed onto my account from another location – one it hadn't seen me sign on from before – and notified me.

About time

[Anonymous Coward]

Good show Vladimir,

I recommend going after a power plant next. Extra bonus point for nuclear.

Eventually, they'll understand....

Re:About time

[SwabianEngineer]

Any proof for this allegation ?

giant germany factory

[Z80a]

Looks like the hackers did hit the weak spot.

Re:giant germany factory

[Anonymous Coward]

Looks like the hackers did hit the weak spot.

How much damage are we talking here? ... $599 US dollars worth.

Maybe not the only one

[WoOS]

Googling for "steel furnance shutdown" finds more reports on unexpected shutdowns this year.
Two in Ashland, Ky, and one or two somewhere in Indiana and one in Bhopal, India. Note that they all seem to have occured in June/July.

Maybe some competitor trying to up his margin by reducing supply?

Re:Maybe not the only one

[burni2]

Interesting thought.

But there is another explanation at hand, India has a bad grid, plagued with outages and "variable" frequency. So big factories have their own power plants. These can fail too, they have also cooling requirements which can be difficult to satisfy during june/july in India. Also during June & July the normal grid is under heavy load from air conditioners.

A grid fault sometimes bears the property of being able to affect such backup units. The swtich over from grid to island operation is critical - anytime some big supplier or consumer "jumps" from the grid or connects to it is critical.
Process control is not instantly reacting, you have delay and rise times, originating from slow physical processes (coal plants), and also a delay through the grid itself, as the grid is due to the long cables a form of energy storage.

If the grid leaves it's sweet spot (in india something around 50Hz +/- 2,5Hz, you will see 37Hz also, your hair dryer will tell ;) ) some machines disconnect from the grid. A power grid is capable of propagating this event as a power grid is ment to level out those uncertainties.

Re:Maybe not the only one

[Anonymous Coward]

Holy crap! Steel furnaces in the US?? Quick! Someone call the EPA!

Re: Maybe not the only one

[Anonymous Coward]

More like someone call an MBA. Obviously there's something some corporate creeps haven't outsourced yet!

Re:Why Germany? They sell anything to anyone.

[burni2]

Your numbers are not existent:

compare the numbers in steel production from germany & U.S. to for example china, US ranks No 3 germany ranks No 7, but they do play in the same league. (1)

Also if you take a look at this map(2) you will recognize China, US and Germany on all exported goods do play in the same league.

according to the table from (3) which is based on data (4)

1.) China - 1.898.600
2.) US - 1.480.646
3.) Germany - 1.473.889

Conclusion:
IRONY_ON
Yeah, it's totally transparent to me, germany does really not sell anything!
IRONY_OFF

Germany does export many things, however not much on such low level things like raw steel.

Further conclusion, divide the export numbers and the amount of population, and you will recognize the efficiency gap.

1.) China - 1.366.040.000
2.) USA - 317.238.626
3.) Germany - 80.760.000

(1) http://en.wikipedia.org/wiki/L...

(2) http://de.wikipedia.org/wiki/D...

(3) http://de.wikipedia.org/wiki/W...

(4) http://stat.wto.org/Statistica...

Sometimes 'air gap' is impossible

[Anonymous Coward]

As an industrial consultant I get into many factories large and small

Many of the smaller factories, particularly those in the 3rd world countries, are actually 'safer' from the attack from hackers --- mainly because their production equipments are mostly older models, their lack of 'up-to-date-ness' means those production machines are not online

Not so for larger plants in more advanced countries !

Nowadays new crops of machines all equipped with MEMs which measure everything from the temperature of such and such part of the machinery to pressure gauging to whatever that's important for the function of the machinery ... and all those MEMs must be linked up to some kind of network in order for the control system to obtain near real-time information, many of those plants got their production machinery hooked up not only to their local network, but also to the Internet as well !

It's a dilemma for many plant owners

On one hand if they do not hook their machines up to the network they can't obtain instant feedback

On the other hand when their machines are networked, and when their network are linked to the Internet, it opens up a big fucking backdoor for hackers to get in

Re:Sometimes 'air gap' is impossible

[Entrope]

What compels the management to hook the control network up to the Internet? If a vendor told me that their safety-impinging product needed Internet access to run -- for a license check or for any other reason -- I would tell them to go pound sand, and I'd be happy to take my business to a competitor. If Internet access is not mandatory, you are describing "sometimes an air gap is inconvenient", not "sometimes an air gap is impossible".

Re:Sometimes 'air gap' is impossible

[thogard]

It is a result of the stupid and outdated firewall model of "Trust/Untrust/DMZ" when applied nearly anywhere.

Modern production networks should be firewalling everything from everything else. Nothing should be on the "Trusted" side. Get something like an SSG-140 and load it up with a bunch of 8 port cards which will give you 42 ports and 42 zones for things to talk to. That way you can allow the CNC machine to talk to its support site for its update but it can't ever talk to the laser cutter or other CNC machines.

The sad thing is the SSG is EOL and I don't know anyone else that makes a low cost multi-port firewall and most switches with firewall capability just don't do proper intrusion detection and malware detection.

No big red button?

[Hognoxious]

Sure. But software shouldn't be able to make hardware damage itself.

Also, designing something like a steelworks without some kind of hardware-level override is so stupid it borders on criminal.

Re: No big red button?

[Anonymous Coward]

I don't think you know what you are talking about. Are all motor controllers from now on going to be ASIC devices? Are you paying for them?

Re:No big red button?

[Shinobi]

"Sure. But software shouldn't be able to make hardware damage itself.

Also, designing something like a steelworks without some kind of hardware-level override is so stupid it borders on criminal."

As long as software can make the hardware do something, it can make it damage itself.

As for the damage, it was probably the emergency shutdown that caused the damage(i.e, what you incorrectly label hardware-level override), since it does a direct quick stop, without following the proper, slower and safer procedures for shutdown.

Re: No big red button?

[Archtech]

"Are you paying for them?"

Aha! And there we have the central issue, in the simplest possible terms.

It's a matter of foreseeing and predicting risk, and then defending against it in a cost-effective way. Trouble is, there are very few other domains of expertise (if that is the right word) that so glaringly expose our human weakness at estimating risk. (See Nassim Nicholas Taleb's books, passim). Typically, a token effort at assessing risk is made, and then when some entirely unforeseen disaster strikes out of left field, we mutter about "black swans". The fact is that we are not nearly as clever as we think we are, which often leads us to bite off far more than we can chew.

Another relevant saying is "the left hand knoweth not what the right hand doeth". One person or team does the risk analysis, while other - completely unknown - people pile up unseen risks, which thus cannot be defended against. Presumably the people who designed those systems had no inkling that they would be attacked by technically expert enemies who deliberately set out to do as much damage as possible. I imagine that a resolute inquiry would eventually discover who upset whom, leading to this outcome.

Re:No big red button?

[burni2]

blast furnace:

You intermix iron ore and coke (not the drug! it's processed coal)
and then you start an exothermic reaction, what you then do is process control, you blow in Oxygene to react carbon to CO2 to a certain percentage and when the steel is ready you poke a hole into the furnace and then molten steel poures out.

This is a reaction that is ongoing.

We are talking here about huge amounts of energy.

A smaller example: ever been test running inside a wind turbine of +1,5MW megawatt class, during nominal power operation ?

Push the red button and you will realize what energy is - rollercoaster ride - and how long the rotor will need to come to a full stop.

Bigger Bigger example, push the red button in a nuclear power plant, yes the control rods will react, but if you don't cool the heat from radiactive decay away, you will get a Fukushima.

I hope you are not a pro nuke, because keeping that in mind (the virtually non 100% hardware red button) you would now have ruled operators of nuclear power plants as stupid that it borders on criminal.

Also there were hardware level overrides and they worked, however if you leave the molten mass inside the furance it will solidify == damaged beyond repair

Which happend there, you have then to rebuild the furnace and beforehand have to cut the wrecked furnace open with a many ton heavy steel clump (happy cutting)

Re:No big red button?

[GNious]

As long as software can make the hardware do something, it can make it damage itself.

So data-invariance is not an option on a hardware level?
it should be possible to design hardware, where critically-dangerous input is filtered or rejected, such that most attempts to willfully bring it into a dangerous scenario will fail.
Yes, emergency-shutdowns should remain possible, though I'd question why that would be something controlled by a computer, and not a big red button that needs to be physically pressed somewhere in the office.

Re:No big red button?

[Shinobi]

Data invariance, even if you can somehow implement it properly on a hardware level, does not protect you if it's the execution pattern that is the attack method for example.

As an example, rapid power cycling/power state change due to a program swiftly being shunted between CPU intensive and idle threads, etc can cause power surges that can damage the PSU or the motherboard or even the CPU(as voltage regulators etc move onboard, they become ever more vulnerable to this), and for all intents and purposes the data input to the program will be fully valid and unchanged. Excessive head parking on a mechanical HD can cause the HD to become faulty. Frequent standby/active cycles on monitors can kill them fairly rapidly.

As for the emergency shutdown, nowadays, with modern equipment, the big red button and the emergency shutdown button in the control program do the same thing: Send a signal to the correct circuit and halt all operation. In some heavy machinery that means just cutting all power, in others it disengages pneumatic valves and thus engaging mechanical brakes etc etc. It depends on what kind of machinery it is.

Re:No big red button?

[Anonymous Coward]

"ever been test running inside a wind turbine of +1,5MW megawatt class, during nominal power operation ?"

Duh. Who hasn't.

Re:No big red button?

[itzly]

Or... power down the Large Hadron Collider, and see what happens :) http://lhc-machine-outreach.we...

Re: No big red button?

[itzly]

It's a matter of foreseeing and predicting risk, and then defending against it in a cost-effective way.

How do you know that it wasn't done properly in this case ?

Re:No big red button?

[Hognoxious]

As long as software can make the hardware do something, it can make it damage itself.

I don't think they were using a Commodore 64.

what you incorrectly label hardware-level override

I didn't incorrectly label anything.

By hardware level override I mean physical valves or switches that can be directly operated by humans on the premises. One would hope said humans are trained to do this in the right sequence etc.

Re:No big red button?

[Hognoxious]

And that contradicts what that I said how?

Re:No big red button?

[Shinobi]

Even with emergency shutdowns, you can still get massive damage

Re:No big red button?

[beelsebob]

The problem is, by making systems where software is the last line of defence against damage, you typically can make much more efficient systems. Note car engines that use variable valve timing can damage themselves (e.g. by opening the valve during combustion, and allowing exhaust/plasma to back flow into the injectors), but they're much much more efficient than engines with a cam rod.

Re: No big red button?

[Anonymous Coward]

Software shutdowns for hardware are in violation of all code. You never have a software controlled safety shut off on its own. The hardware requirements removes all power from the system and cannot crash, short, or continue unwanted behavior if the main control software locks up.

There is a huge difference in underlying functionality from a big red button on an HI versus a big read physical button.

Re: No big red button?

[Anonymous Coward]

But, what does a software engineer know of building construction? Or steel plant controls? Or medications? And what is the reciprocal collary? Or poetry? Except they are connected to a wire going somewhere? You are blaming the muffin for the chef's incompetence.

Re:No big red button?

[Anonymous Coward]

Ah, the armchair experts are here to faithfully solve the problem and tell everyone else they are idiots, even though they themselves don't know anything about the system involved, or the costs and effort associated with risk mitigation for all possible scenarios.

Ever hear the phrase, "hindsight is 20/20"?

Re:No big red button?

[mikael]

The problem is that blast furnaces aren't simply switched on and off, but have feedback software systems that adjusts fuel feeds, cooling systems and exhaust extraction to achieve the desired temperature while minimizing fuel consumption, cooling and pollution. Much the same way as electronic car ignition. The operating temperature would have to be ramped up and down slowly to avoid any damage through thermal stress.

It's the hardware overrides that would allow the cooling system to be reduced or switched off while the fuel feeds remain on.

http://www.acspit.com/papers/d...

Re:No big red button?

[mjpvirtual]

Actually, a blast furnace is used to produce pig iron from coke, iron ore, and limestone: not steel. Pig iron has a high carbon content, about 4%. A basic oxygen furnace or an electric arc furnace is used to turn pig iron or scrap steel into new steel by burning the carbon down to 1% or less, removing impurities, and creating the desired alloy (by adding Mn, Cr, Ni, Mo). A blast furnace runs in a continuous process, with raw materials loaded at the top and pig iron and waste removed from the bottom. Shutting one down is complex; there is no off switch. Loss of control would make for a very bad day.

Re:No big red button?

[AK Marc]

Sure. But software shouldn't be able to make hardware damage itself.

So you want the third rule of robotics above the first two?

Seriously, you should work at Airbus, but not Boeing. One of the fundamental differences between the companies is the order of the Three Laws (specifically #2 and #3). Airbus will guess what the pilot wants, then give it in a controlled manner. Boeing will let a pilot shake the controls until he damages the plane.

We have software that lets the hardware damage itself, when it's trivial to do otherwise. And that's accepted in a higher-safety environment than a steel plant. So you are making assertions without proper foundation.

Re:No big red button?

[Shoten]

Sure. But software shouldn't be able to make hardware damage itself.

Also, designing something like a steelworks without some kind of hardware-level override is so stupid it borders on criminal.

This is like saying "Sure, but car's shouldn't have anything that propels them forward...that's how car crashes happen."

The sole and entire point of control systems (aka SCADA, DCS, or ICS) is to make it possible for software to control hardware. And it's impossible to make *anything* that can't be broken or cause damage if it's abused. When you factor in things like blast furnaces, substations, or other real-time applications that involve massive amounts of energy (kinetic, electrical, thermal or otherwise), you're harnessing one hell of a big thing, and that means careful balances and lots of risk. You can't have a situation where there's thousands of degrees of heat and gigantic crucibles of molten steel and yet have it impossible for something to be done wrong.

It always makes me crazy when assholes (yes, that's my word for a novice who pontificates about the "incompetence" of actual professionals without citing anything concrete or meaningful) who don't have any experience whatsoever with control systems put forth their idolized version of reality that somehow means that everything can be simple and as safe as a Fisher-Price toy, despite the fact that these environments have never been foolproof in all of human history. Trains crash, pressure vessels explode, chemicals leak, boilers beer-can, transformers flash...it's always been that way, and always will be. Control systems make them less likely to do so for accidental reasons, but also allow an attacker to force it to happen for deliberate ones. That's the trade-off, and to this day it's still a trade-off that's had a positive outcome. It makes no more sense to back out these systems than it did for banking to go back to using adding machines, just because there were cyber security incidents early on in the financial sector. The next step forward is better security for these environments, which is in the process of happening as we speak.

Re:No big red button?

[mikael]

Unfortunately for Airbus, it didn't quite work out when an airshow decided to have an aircraft do a low fly-pass in front of the crowds. The combination of low altitude, low speed with flaps and landing gear lowered made the AI think that the pilots wanted the plane to land. So the flight control system cut the engine power in preparation for landing.

Re:No big red button?

[BronsCon]

Do you know at all how VVT works? There are 2 distinct types of VVT systems I have encountered and both use cam rods. One has different sets of lobes (the most I've seen is 3) for discreet, still hardware-limited, valve timing, while the other uses an adjustable gear at the end of the camshaft, allowing maybe 15-20 degrees of adjustment in total; still hardware-limited. The VVT systems I've seen have all been configured such that the earliest and latest physically possible timings were still well within safe operating parameters.

Did you think the valves were individually operated by servos? Pull your valve cover and take a look sometime; it's at most a dozen bolts, most likely all 10mm.

Re:No big red button?

[sjames]

As I understand it, the damage was indirect. The software was left in such a state that the furnace was at the time undamaged but could not be properly shut down. That left only the emergency shutdown procedure which was the cause of the damage.

The real failure was not being able to physically operate the controls to at least manage a clean shutdown.

Re:No big red button?

[AK Marc]

The pilots also made some actual pilot errors. They underestimated the response of the engines for throttle-up. The plane would never "force" a landing. Go-around is common, and would be allowed for.

In that case, the pilots were "landing" 50' below ground (as they were executing an actual failed approach at ground level, and aborting the landing too late), 50' below ground because they didn't account for the trees. They should have simulated landing 50' above, not below ground, but that wouldn't have been as cool. They didn't strike the ground first, they struck the trees. Had they had a full runway of space to work with, they'd have been fine. The pilots guessed what would have happened, and guessed wrong. Crash.

Re:No big red button?

[TarPitt]

I have this mental image of Clippy popping up on the flight control monitor saying, "It looks like you are trying to land. Do you need help?"

Re: No big red button?

[Anonymous Coward]

You're talking about a process that operates 24/7, never shutting down and a quantity of metal that takes weeks if not more to cool. There is very likely no way to halt without causing extensive "damage", or cleanup work at the least.

Re:No big red button?

[ras]

Bigger Bigger example, push the red button in a nuclear power plant, yes the control rods will react, but if you don't cool the heat from radiactive decay away, you will get a Fukushima.

During WWII, the major target of bombing runs was the infrastructure used to make the weapons. That means blast furnaces were damaged far more than they were by these hackers. It ditto the electricity generation infrastructure - which was coal fired power plants at the time. They were all rebuilt.

Next time it will be the nuclear power plants, which are effectively nuclear bombs with a big red target painted on the top. Had Europe been using nuclear power plants during WWII there would be places in it still uninhabitable now.

Re:No big red button?

[rtb61]

Surely that is dependent upon how you design your shut down. This being a balance of risk and loss versus capital outlay. Generally speaking management cheats like mad on risk and loss where big bonuses are in the offing and minimise capital outlay and blame everything on the new guy. So repeated failures, improper security to save capital expenditure on computer systems, failure to manage and audit security and failure to implement a proper balance to mitigate losses from production risks in the event of failure. What this all really points to is that all executive bonuses should only be paid as an annuity, so that all bonuses are paid over the life of the impact of decisions and where minor short term gain results in major long term losses those bonuses earned under fraudulent circumstance are eliminated and used to pay for remediation of company profitability.

Re:No big red button?

[thegarbz]

Even with emergency shutdowns, you can still get massive damage

Only if your emergency shutdown is the equivalent of pulling the plug.

Proper emergency shutdown systems are managed systems that control the process safely. One such system I worked on, emergency shutdown involved shedding load from 4 other process units to ensure that enough power was maintained to slowly shutdown a large reactor, while at the same time venting the product to flare. Push the button and whoosh, 40m high flame for approximately 4 hours until the reactor is cool enough to actually cut feed.

Just because something is an emergency doesn't mean it needs to be done instantly or in one step.

Re:No big red button?

[Neil Boekend]

A nuclear reactor and a nuclear bomb are as different as cola and coffee.
If you bomb a nuclear reactor you have made a dirty bomb. Not an atom bomb. Dirty bombs are not nice but not as destructive as atom bombs.
Add to that that the fact that all nuclear reactors have massive concrete and steel walls. Those are meant to keep the radiation inside but also keep bombs outside.
I can't find it now (corporate filters) but there is a film clip of a jet fighter crashing into a reactor wall as a test. Watch it and guess if a bomb is going to damage that.

Re:No big red button?

[burni2]

Blast furnaces in WWII are "different" in contrast to today the size was smaller, and in WWII they were constructed from bricks.

Re:No big red button?

[gzuckier]

which brings us to the recent questions re drive by wire cars, toyotas, etc......

Re:No big red button?

[gzuckier]

just anecdotal evidence, but the graphics board on my old media center died one day; autopsy revealed that immediately before the expiration Windows had just done an automated update of the graphics board driver. A wise person pointed out to me that said driver covered a wide spectrum of the manufacturer's graphics boards, and that any updates at this late date were probably oriented more to the current offerings than ancient boards, such as mine; replaced the board with the current equivalent but turned off the automated driver update. It was rumored in the days of the original IBM XT/AT that there were programs which would cause the color graphics board to die.

Re:No big red button?

[gzuckier]

Do you know at all how VVT works? There are 2 distinct types of VVT systems I have encountered and both use cam rods. One has different sets of lobes (the most I've seen is 3) for discreet, still hardware-limited, valve timing, while the other uses an adjustable gear at the end of the camshaft, allowing maybe 15-20 degrees of adjustment in total; still hardware-limited. The VVT systems I've seen have all been configured such that the earliest and latest physically possible timings were still well within safe operating parameters. Did you think the valves were individually operated by servos? Pull your valve cover and take a look sometime; it's at most a dozen bolts, most likely all 10mm.

the occasional camless system, not on production autos though. https://en.wikipedia.org/wiki/...

Re:No big red button?

[BronsCon]

Interesting info. I've only encountered production automotive and small marine engines, which explains why I've never seen it. Looks like someone decided it would be a good idea to add yet another somewhat fragile hydraulic system to our vehicles while, at the same time, removing a safety feature (physical timing restrictions) and sought out to develop this after all.

It'll be interesting, when these hit the market, to see how they fare in terms of longevity. I'm sure they perform great, but what good is that if you have to rebuild it every few thousand miles?

Re:Why are critical systems connected to the inter

[Anonymous Coward]

Because everything is connected to the internet. There isn't a computer that can't be reached from the internet, directly or indirectly. Even airgapped systems are eventually in contact with maintenance systems which have previously been connected to the internet. If your security model involves perfect anything, it's a failure. Perfect separation, perfect code, perfect employees: All unachievable.

Re:Why are critical systems connected to the inter

[ljw1004]

Why is there critical systems allowed to be in the same network as email?

Email from operations to the shop floor: "Hey Klaus, we've determined that for the following job we need parameters set at P=123.79 and Q=119.11". Klaus prints out out from his email-connected computer. Picks up the printout, walks across to the control computers, and starts typing in the parameters from the printout. Unfortunately he has a typo that causes the entire batch to be not quite up to spec.

Solution: come up with a way for the parameters to be taking precisely from email into production, without the error-prone act of typing them out again.

Re:Why Germany? They sell anything to anyone.

[Anonymous Coward]

and then bitch at us for being hypocrites

and be right about that.

Re:Why Germany? They sell anything to anyone.

[Anonymous Coward]

Grandparent made no statement about the scale of business. Grandparent expressed the perception that Germany will sell whatever is in demand to whomever is demanding it, as long as the money is right.

Re:Why are critical systems connected to the inter

[Zontar The Mindless]

Why do banks ... NOT allow me to block access from other countries (and/or identify which country I'm visiting)?

A: You need to change banks.

My online banking allows me to block the use of my card to make in-store purchases or ATM withdrawals within and/or outside the country and/or EU. I can also enable or disable the use of my card for online purchases. I can also enable or disable any use of the card for other than logging into online banking from within the country--that last item takes a call to the bank. (Not sure whether not being able to lock yourself out unless you're overseas is a good or bad thing.) I can also set and change separate limits on in-store purchases, cash withdrawals, and online purchases. Doing any of these things takes about 2 minutes, and I can do any of them any time that it suits me.

Banking online with my bank also requires multiple factors--the card, a card reader issued by the bank, a government-issued personal ID number, and the PIN--and uses multiple challenge/response to confirm login and any monetary transactions, with a time limit of 4 minutes before the codes become invalid and you must start the authentication process over from scratch. I'm aware that there's no such thing as perfect security, but this seems to run pretty close.

Re:Why Germany? They sell anything to anyone.

[Anonymous Coward]

I can understand attacking a plant in the US, but Europeans sell anything to anyone with the cash (and then bitch at us for being hypocrites).

Russians, maybe, since Merkel wanted to stay tough on sanctions?

Believing propaganda much?

I think you'd be surprised if you knew who the US exported to. Of course there is no official papers proving anything. American goods just happened to show up there.

Re:Why are critical systems connected to the inter

[jtownatpunk.net]

You can have electronic communication on an isolated network. And there are plenty of ways to input data accurately with error checking. Add CRC to the input. If they don't match, find the error(s). Or dual/triple/quad entry so that it's only accepted if the fields match. Like when you're creating a password for a new account. Or print a QR code and scan it on the isolated system. You can pack a lot of data and error correction into QR codes.

Of course, this all assumes that the input is legitimate.

From the report....

[SlayerofGods]

2.2 Angriffsmittel und -methoden 15
    2.2.1 Spam 15
    2.2.2 Schadprogramme 16
    2.2.3 Drive-by-Exploits und Exploit-Kits 17
    2.2.4 Botnetze 18
    2.2.5 Social Engineering 19
    2.2.6 Identitätsdiebstahl 20
    2.2.7 Denial of Service 20
    2.2.8 Advanced Persistent Threats (APT) 21
    2.2.9 Nachrichtendienstliche Cyber-Angriffe 22

I can understand Spam but Drive-by-Exploits? Social Engineering? Denial of Service???
Surely there are German words for this? I mean 2.2.4 I'm pretty sure is botnet; which I assume should be a lot harder to give its own German translation than Advanced Persistent Threat...

Re:From the report....

[Nutria]

English picks up foreign words; why can't German pick up foreign words?

Re:From the report....

[Anonymous Coward]

Umm, have you noticed Schadenfreude is used in english?

Re:From the report....

[Anonymous Coward]

I can understand Spam but Drive-by-Exploits? Social Engineering? Denial of Service???
Surely there are German words for this? I mean 2.2.4 I'm pretty sure is botnet; which I assume should be a lot harder to give its own German translation than Advanced Persistent Threat...

IT is a field of rapid change. The time one would have to spent coming up with german names for everything and making sure everyone uses the same translation for the same thing is better spent keeping up with current developments (example: there still is no german word for floppy disk ... and it doesn't look like one will be needed, does it ?).

Additionally two of the three terms have a certain pun-like quality ( Drive-by-Exploit is analogous to Drive-by-Shooting (for which there is no good german translation either) and Social Engineering is not a form of Ingenieurswissenschaft that's taught at any university ...) that's VERY hard to translate ...

Also English is taught in most german schools as first foreign language, so most germans working in IT read international news and books as primary sources of information. Computer technology actually is one of the points of origin for the dreadful "Denglish" - a mixture of Deutsch and English which is even worse than the internationally known "Engrish" ...

Re: From the report....

[Anonymous Coward]

I work in the field of security in Switzerland. When writing german-language reports, we often use English words - there's just not a good german word for governance, for example.

Then again, a lot of English words come from other languages, too. Doesn't really matter - it's pretty much only the French that have to have a native word for everything.

Re: From the report....

[Deadstick]

Then again, a lot of English words come from other languages, too.

Well, actually all of them.

Re:Why are critical systems connected to the inter

[peragrin]

Error checking won't catch parameter p.11.23. Vs p.11.32

Qr code isn't a bad idea though.

Uh huh, an advanced hacker, sure

[50000BTU_barbecue]

or maybe they should check who got fired in the last few months... or overlooked for a promotion.

Re:Why are critical systems connected to the inter

[Shinobi]

Actually, bar codes and QR codes are used in some industrial systems to input orders, for larger batch jobs. The problem is when you are in need of continuous feedback etc, or running lots of small custom jobs.

Rant

[Anonymous Coward]

Production networks commonly use poor passwords or even defaults. Computers are infrequently updated with security patches, if at all. Plus your production network should never be connected to any outside network, that's just dumb. But companies in an attempt to save money create a jack-of-all-trades position and fill it with poorly qualified people.

Re:Why Germany? They sell anything to anyone.

[Chris Mattern]

I can understand attacking a plant in the US, but Europeans sell anything to anyone with the cash (and then bitch at us for being hypocrites).

No, they don't. There are currently EU trade sanctions in place against a whole lot of countries: see here. Restriction of goods seems to be mostly arms, but the list on North Korea is pretty extensive, although it apparently still doesn't include raw steel.

For those who haven't

[burni2]

https://www.youtube.com/watch?...

The nacelle goes back and forth about 2-3m (in both directions)

Or this .. (with inside view)

[burni2]

https://www.youtube.com/watch?...

Obligatory facepalm question..

[Anonymous Coward]

Who the heck thought it was a good idea to put multiple network "classifications" on the same network?

*crickets* *crickets*

And the solution being ..

[lippydude]

"Due to these failures, one of the plant's blast furnaces could not be shut down in a controlled manner"

And the solution being to not connect your production networks to the Internet ...

Again...

[koan]

Why weren't the systems separated, furnace control isolated.

Re:Again...

[OrangeTide]

Because it's a steel factory, not a power plant or credit card company?

Re:Again...

[koan]

So you state the obvious as though that's some sort of answer, you are obviously "steel factory computer security" qualified. (That's an insult by the way)

Re:Again...

[OrangeTide]

The nation's economy collapsed because the steel factory shut down? Some equipment was damaged, maybe they should have insurance for that?
Possibly there should be a worry would be injuries or deaths, so in that context security is of an important safety concern.

It's not on the same scale as collapsing the power grid for millions of people, businesses, and hospitals. Or tying up world wide credit processing for weeks, which would have some serious economy consequences.

You are correct, I missinterpreted the text!

[burni2]

Would someone be so kind to mod his post up ?

I guess I'll buy steel from China

[Anonymous Coward]

I mean if these Germans can't operate their factory, what choice do I have.

Re:I guess I'll buy steel from China

[Anonymous Coward]

You can still buy it from Japan, Austria, Sweden or Finland. China is not unlikely to be behind this attack.

Re:Why Germany? They sell anything to anyone.

[u38cg]

Russian non-state hackers, I would posit; I can't see the point of burning state resources on this. And I can't see anyone else with the motivation plus capability. The only other remote possibility is some sort of false flag operation to demonstrate the need for more resources from some Western agency.

insurance companies should require airgap

[mrflash818]

If compananies want their business insured, perhaps the insurance companies can make having an 'airgap' a requirement of having coverage.

Re:Why are critical systems connected to the inter

[CrimsonAvenger]

Why is there critical systems allowed to be in the same network as email?

Because manual entry is likely to see things like "their" spelled "there". Which kinda-sorta looks right, but isn't.

You have little reason to assume...

[Anonymous Coward]

You have little reason to assume *anything*, but it isn't stopping you for some reason.

Stop The Whining

[SwabianEngineer]

100% security has infinite costs. It is all about having PROPER security levels and cost.
Of what us is an unprofitable, yet 100% secure steel mill ???

Also

[SwabianEngineer]

...in this modern world of Hedge Fund Whores, you bet they had the most ineffective security in place you can think of. Probably the DSL router was the only fence between the bad and the "good" world.

Thats what we can assume based on what we know from other el cheapo corporations. This world is run by cheapskates who work for the banksters who build their next country castle bullshit house.

Occams Razor etc.

Why does not anybody get the obvious?

[Anonymous Coward]

Don't be too cheap or too lazy, do not connect critical systems to the internet.

Chernobyl Blew when they pushed the Red Button...

[Anonymous Coward]

It's in the IAEA report; due to a positive void coefficient, and a poor control system, the SCRAM of the reactor is what actually blew it up.

No Shit.

http://www-pub.iaea.org/MTCD/p...

Re:Why are critical systems connected to the inter

[cycoj]

So how would that have prevented the current attack? If the office network is compromised the attackers can change the QR code, so you've made the whole process more complex with only a minimum gain in security.

Re:Chernobyl Blew when they pushed the Red Button.

[cheesybagel]

AFAIK the explosion was a hydrogen gas explosion due to water thermolysis after the core melt down. Nothing like a nuclear bomb blast.

Re:Why are critical systems connected to the inter

[Anonymous Coward]

Because IT workers lack trade unions.

We don't have the authority to say "This is dangerous and violates acceptable practice " without getting fired.

I'm deadly fucking serious. Sure, you can stand up for yourself, get fired, get blackballed by the industry. Hope that whistleblower laws cover your ass against the hordes of well paid lawyers the company hires who are literally trying to ruin your life, reputation, and credibility. All while you have no job, no income, nothing.

With a trade union you can stand up for standards that are important, more important than the authority of your boss. Your fellow workers and their collective power will stand up for you.

As it stands, when some nameless pencil dick middle managers says "I need to be able to send the blast furnace and email" you have to do it. No, that statement is not a typo. It's exactly the sort of assnine braindead shit you face every day and you fucking know it.

Re: Why are critical systems connected to the inte

[phocion]

It would be ideal, and smart, if all production systems like these were on isolated networks and not accessible from the net. But nine times out of ten the reason they aren't is so that corporate IT can manage the systems remotely rather than paying for on site IT support. It's a tradeoff. Is the risk of an attack like this greater because your systems are connected to the net or is it better to have all sites managed locally knowing there won't be consistency in how the sites are managed? Having a good management system in place to centrally manage security and patching and such can keep security holes closed better than fragmented individual networks. So which is better? There is no right answer.

Re: Why are critical systems connected to the inte

[Bomarc]

Actually... I believe there is a right answer: Currently (as noted) management prefers to cut costs - without considering or being held responsible for the consequences. When "my" (personal) information is leaked over the internet, who pays? ME. Solution: crack down on such incidents - the person responsible for holding the information. In short: Improve security. WHEN it happens, pay the person who's information is leaked for potential damages from the company that holds the information -- and allow the door to be further open for (more) actual damages. In short: Put management’s feet to the fire. Wake up to the reality of the so-called savings. If you can't "secure" your data or equipment, you disconnect it from the internet. Pull the (internet) plug - a hacker can't gain access to and download terabytes of data from a physically isolated system.

Re:Why are critical systems connected to the inter

[Bomarc]

Because IT workers lack trade unions.

We don't have the authority to say "This is dangerous and violates acceptable practice" without getting fired.

Irony: I was fired for refusing to use using live customer data (and reported the practice to upper management). I advised that customer data (test) might be mixed with customer data (live) .. and was over-ruled -- the development team said that it could never happen. Just before I was fired, customers were calling and complaining - their (on-line) bills were not right - development had mixed the data connections - and the customers were looking at the "test" database. About six months later - the company was being investigated by the state AG.

Re: Why are critical systems connected to the int

[phocion]

Yeah, I agree. My management asked me after one incident how we could truly lock down one of our systems. I sent them a picture of a power strip with all the cords unplugged. They weren't amused. The truth is any system with users is never 100% secure, but that's not a popular answer.

Re: Why are critical systems connected to the int

[Bomarc]

Yeah, I agree. My management asked me after one incident how we could truly lock down one of our systems. I sent them a picture of a power strip with all the cords unplugged. They weren't amused. .

Ah... should have sent them a picture of a generator!

The truth is any system with users is never 100% secure, but that's not a popular answer.

Yes, agreed. BUT they can be a lot more secure than what is going on right now.

old school

[Anonymous Coward]

Controlled manual shut down. not perfect because it takes 3 days to bring it back online. I guess it it was too modern to implement. If they had, probably did not how to do it?