Slashdot Mirror
Research: Industrial Networks Are Vulnerable To Devastating Cyberattacks
Patrick O'Neill writes: New research into Industrial Ethernet Switches reveals a wide host of vulnerabilities that leave critical infrastructure facilities open to attackers. Many of the vulnerabilities reveal fundamental weaknesses: Widespread use of default passwords, hardcoded encryption keys, a lack of proper authentication for firmware updates, a lack of encrypted connections, and more. Combined with a lack of network monitoring, researchers say the situation showcases "a massive lack of security awareness in the industrial control systems community."
default, and hardcoded, and authentication, Oh My!
-- Iran nuclear program
We've seen any numbers of articles over the last couple years concerning this subject. The only thing not often mentioned is lack of network monitoring, but given the rest of the foolishness going on I always figured that would be a given.
I hate sigs, and refuse to have one.
I work in a multiple plant system with geographic separation. Each plant operates independently. But its the geniuses on top that believe we need to some day run all plants from one location. (They also want to be able to see all the plants from anywhere). So we can very secure by keeping each industrial network separated and completely disconnected from each other and the outside world, OR we can make all plants vulnerable by interconnecting them and allowing big shots to see the plant operation from their phone.
Every time some industrial networking vulnerability gets posted, people ask: "why are these connected to the internet to begin with?", so I'll get it out of the way: Why are these connected to the internet again? If you do need some sort of external access to them, it should be through some sort of application-level gateway so that access can be carefully controlled.
I think this was even brought up in a hotels.com ad by Captain Obvious.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
... it's everything.
Security will continue to be a low priority until we assign blame and litigate.
It little behooves the best of us to comment on the rest of us.
Does it make anyone else uncomfortable that this story about industrial networks being vulnerable to cyberattacks follows immediately after a story about robotic surgeons?
You are welcome on my lawn.
#noshitsherlock
This is why Cloudflare got four of its routers wiped out during that last October DDoS. As soon as the network infrastructure was known and exploits located, it was the attack point. Security failure.
And this is only going to get worse.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
look, none of this is a problem as long as nobody asks about the worst case scenarios.
Anons need not reply. Questions end with a question mark.
Since nearly everything connected to a network nowadays seems to have some manner of easy-to-exploit vulnerability due to lax security design, maybe it would be easier for the /. editors to publish articles on devices and systems that are secure instead of those that are not.
"Backdoors also exist in the form of hidden accounts originally created for maintenance that can provide cover for attackers. In particularly insecure facilities, antiquated and unencrypted connections to the Internet that allow engineers remote access to their networks act as pathways an attacker anywhere in the world can take toward the network in her crosshairs."
Air gaps as much as you can, air gaps between you control networks, and your mail/office/facebook network. Don't trust vendor kit, its riddled with backdoors (example below from 2013).
http://www.news.slashdot.org/story/13/07/11/2349201/hp-keeps-installing-secret-backdoors-in-enterprise-storage
When networking of smart devices was still on a relatively small scale, a cyberattack wouldn't have done much harm, but afterwards, manufacturers, and more importantly, their customers, might have wised up. Stuxnet was a warning, and I think it has to some extent been heeded, but already by then the existing infrastructure was so vast that a major overhaul would have required a commitment and leadership that isn't there.
In theory, theory and practice are the same; in practice they're different. (Yogi Berra & A. Einstein)
I work in a small manufacturing company, all it would take is one malicious person to get on the network, send some specially crafted EIP packets to some of our PLC's and production is fucked. I keep saying we need to segment and isolate the industrial network from our poorly managed corporate network, but it gets ignored because "3000 is a lot of money to spend on some computer stuff."
Comment removed based on user account deletion
Comment removed based on user account deletion
It's not a case of lack of awareness, it's a case of mostly not giving a shit. We don't use most of the encryption features or hardening available between control systems on our site either because quite frankly we don't expect to and we don't need to. Actually I was quite critical at the last Schneider conference where they were talking about the encryption they are adding allowing you to connect multiple SCADA systems together directly via the internet. My comment to the presenter was "Why should I care at all about your encryption? Why should I trust you to do something out side your competency? We buy your gear because it's good at controlling equipment, we buy Juniper or other networking gear because they are good at networks. Your lack of encryption has never stopped me from connecting disperse systems. "
In all installations I have worked on we consider the network the device itself. If you touch the network then it's already game over, hardcoded passwords or not. Equipment is setup within private LANs, behind very strict firewalls. Physical access is prevented by means of lock and key, as well as privilege to even be in the same room as equipment. Where a connection is made over an outside network it is done only via an approved firewall / VPN method. We are aware of the security issues, we just work around them.
Now on the flip side this makes it incredibly hard to bring data onto or off from the network, but physical security is one of the best defenses. And no hardcoded passwords / encryption keys are not a good idea. But even if they didn't exist the industry has a lot to prove before I would trust any of them to create a secure system that I wouldn't lock down physically.
Read past the headline, you need to first backdoor the PC, the airgap reference is just a reference to how to transmit data *out* across an airgap AFTER you've already installed your hack on it.
And upgrade everything to Red Star Linux.
Comment removed based on user account deletion
Beating a dead horse.
The article gives stuxnet blowing up centrifuges as an example. Fair enough, it is scary, but looks at some of the facts. It took 4 zero-day exploits to get to the centrifuge control systems. If anything this proves that industrial systems are well designed.
Now to influence the control systems of a nuclear reactor is at least an order of magnitude more difficult than centrifuges. For example even if the main control systems were somehow taken under control, there are completely separate safety critical systems, most likely in triplicate w/ diverse technology and design, that are continually monitoring the health of the reactor ready to snap it into a safe state at a moments notice.
This sort of safety system is an absolute requirement of current standards, being IEC 61508/61511 for general industrial and IEC 61513 for nuclear.
So you -might-, with extraordinary effort, be able to shut down a power plant. That sucks, but it isn't exactly a nuclear catastrophe.
Personally, I'm far more worried about a big wave, a bloke with a fake badge and some explosives, an asteroid or a bomb dropped from a plane...
And the US weaponized the internet first. Thank you World Police for keeping us safe!
"New research into Industrial Ethernet Switches .. showcases "a massive lack of security awareness in the industrial control systems community."
New research - new research ? - this has been known about for at least a decade ref. and the solution is, don't connect your switches directly to the Internet, connect them through VPNs running on embedded hardware.
Why all the sensationalist click bait?
Are Industrial Networks also Vulnerable To non-devastating Cyberattacks?
-- A good compromise leaves everyone mad. --Calvin and Hobbes
This has been true for at least 20 years.
The industrial controls industry is the most backward corner of the tech world, inhabited by an old guard that mostly doesn't even understand networking, let alone security. The newer recruits generally come from an EE background, so they also generally have no knowledge of how to secure critical infrastructure. Most started in the era where inter-device/machine communication was via serial and all these systems were simple air-gapped (not for security, but because there was no way or reason to connect them).
The reason this situation has changed is that more and more businesses want to be able to see what is happening in real time, so the engineers just connect them to other relatively-insecure networks, which ultimately leads to breaches. The suits don't care as long as they can see what they want to see.
It would be very expensive and difficult to correct this problem, between the extra manpower, retraining, and delays this would cause.
between negligent complacency and paranoid hysterics. Especially where terrorism of any kind is involved.
Look back up at my post, now look back down, you're on the Internet. Now look back up. I'm a signature.
....then it can be broken by man.
Is something I live by.
That's because a lot of these places don't hire anyone competent anymore to fix or repair this stuff. You have plants with a maintenance staff that doesn't know a thing other than knowing how to tighten a bolt but the management expect miracles from them. I don't see any plants that will hire seasoned engineers for such cases anymore. There's no more engineering teams at these plants. Owners want the cheapest nowadays and if they can find the word "Maintenance" and "Minimum wage", they're hired expecting him to be a miracle worker like a 20 year experienced engineer.
Then when shit hits the fan, you get what you get.