Slashdot Mirror
Hackers Modify Water Treatment Parameters By Accident (softpedia.com)
An anonymous reader writes: Verizon's RISK security team has revealed details on a data breach they investigated where some hackers (previously tied to hacktivism campaigns) breached a payments application from an unnamed water treatment and supply company [PDF, page 38], and also escalated their access to reach SCADA equipment responsible for the water treatment process. The hackers modified water treatment chemical levels four different times. The cause of this intrusion seems to be bad network design, since all equipment was interconnected with each other in a star network design, and the payments app contained an INI file with the administrative password for the central router, from where the hackers reached the water treatment SCADA equipment. Of course, the hackers had no clue what they were modifying. Nobody got poisoned or sick in the end.
That's a good one. Serious CYA
“He’s not deformed, he’s just drunk!”
Who designed that network? Marty McFly in the 80s?
Go away!
If somebody had have died or gotten sick, the hacking party would be the ones to get in shit, not the asshat that put the admin password in a text file...
I got rather sick when I read that the admin password was in the ini file.
wow... admin password in an INI file for your network's central point... just wow
This is simple best informatics practice when to doing the needful are happily.
- Raj "H1B" Subramanadanajab
Admin passwords in an INI file... no wonder that "hacktivists" breached their network
When these groups try to do their attacks, they don't realize what other fallout which may be happening. Is that Bank using the same data center of a hospital you don't know. Is the budget system going to affect other systems?
Normally the places with the worst security are not that way due to lack of IT Talent, but because the integration of legacy systems is so connected that it becomes a major undertaking to correct.
1980's Mainframes were expensive computers, most organizations could normally afford one, and they write all kinds of software on them, from managing their billing to controlling the factory. If you remove one component you can cause all others to have the same problem. Trying to fix the infrastructure will cost millions. For organizations that support the public, usually are under tight budget anyways so fixing them is very difficult.
So those hackers who think they don't hurt anyone. You are wrong.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Problem is, this is a lot more "just the beginning" than "in the end".
How many such systems do you suppose have been penetrated by folks who do know what they're doing, and are just sitting on their access until the next political party convention, or major sporting event, or...?
I've rarely seen a classic "control system" (HVAC, security, wet and dry lab systems, anything with modems and 9600kbps transmission, ANSI screens, etc) be configured in anything BUT 1980's architecture. These industrial control systems are so old and embedded no one has the money or incentive to remove them and install modern tech. And most of them are archaic, and so incredibly vulnerable it can make a person lose sleep. Think yet another "tip of the iceberg"moment. Think water control, sewage control, electrical control, alarms control, traffic light control. NOT ALL, but the majority are hopelessly insecure and controlled by people who use FAX machines. Anything installed before 2000 or so (the majority) are childlike in design and harbor absolutely no notion of security.
"They also informed the water treatment company that the hackers had access to over 2.5 million customer personal and financial records and provided technical expertise on how KWC could fix their IT system to prevent similar incidents."
You know, every time I have encountered anything this moronic I've raised bloody hell over it.
Why the hell would a fscking payment app need the administrative password for the damned router, and what idiot allowed this on their network. On at least three occasions I've said "no way in hell I'm going to put a plaintext password into an INI file, and if you want me to do it you're going to have to send me an email and CC a lot of other people demanding it". (Reading TFA, it wasn't the actual payment app, but they got it off a web server they compromised which had it in an INI file, so bad job in the summary).
I swear, security is often either non-existent or written by idiots.
And that's before you even get to the epic stupidity of having your SCADA stuff to your normal network. I've been in places that had SCADA stuff, and NOTHING was on that network which wasn't fully vetted.
This whole article reads like "what happens when unqualified people run critical systems" -- right down to the fact that they also had access to "2.5 million customer and financial records".
I'd like to say I'm astonished, but that would imply that I keep being surprised at just how bad companies suck at fairly basic security.
Lost at C:>. Found at C.
I think most people forget that their SCADA is connected to their network. Seriously. I've rarely seen one of these networks that's NOT connected to the Internet.
Honestly, the article contains even more gems. These KWC guys were geniuses... real geniuses
The persons who approved and connected critical infrastructure devices to Internet accessible networks should be hung. Air gap this stuff, people. It doesn't belong on the Internet.
I'm sorry, but fucking around with water systems isn't really part of saving the world, is it?
Public Service Announcement to all script-kiddie "hacktivists":
If you don't know what you're doing once you're inside a live industrial system, FFS DON'T DO IT.
Equipment of this sort should be air gapped from the wild wild west of the internet. Frankly anything that is safety related (hospital equipment, elevators, and even HVAC systems) should be unreachable without badging into a building. While there are still ways to propagate things in via USB stick, it would keep clowns from pulling this kind of stuff.
Is this the reason for Flint water fiasco?
Now we pin each death in flint MI on them.
Better plead down to life.
>no one has the money or incentive
Sounds like the incentives are approaching very quickly.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
http://www.bbc.co.uk/news/uk-e...
Fits the bill
So tell ell me why screwing with the process controls in a chemical plant counts only as an "accident."
and also escalated their access to reach SCADA equipment responsible for the water treatment process. The hackers modified water treatment chemical levels four different times
There's only one security that counts with a SCADA system: air gap. Plant-controlling systems must not talk to any other network. ...and then a year or two later you find them trying to quietly slip two network cards into the same machine so they don't have to change chairs to go from corporate-network-with-Internet-access to SCADA.
I recently retired from a much-larger utility and we did struggle with the human factor. The plant guys heard all the lectures from their design consultants that put in the system and the IT people who checked the design over. They understand that they must not interconnect.
Emotionally, it's hard to believe anybody would *want* to break in; it's not like there's money to be made. Hollywood-movie scenarios where "hackers take over" are ludicrous; every device in the plant has an "On/Off/Auto" switch where only "Auto" leaves SCADA in control at all; the most junior operator could run around the plant hitting those switches in five minutes, restoring manual control. (Then we'd have to bring in a dozen folks with cell phones to run the plant manually; no sweat).
And as I posted above, it's not like you can kill anybody with a water treatment plant: the worst water you could put out would either be untreated (please boil water) or absolute max chlorine the system could insert (still less than a swimming pool).
It's going to be the same as "safety"; you can pound safety lectures into people's heads all day, but it seems to take a generation or two for the message to really sink in; hard hats and visibility vests were strenuously avoided as well. We're just going to have to make it a standard, like safety standards: firing for disobedience, regardless of whether anything went wrong.
... what if something like this was left deliberately weak so that a part of the population could be disposed of, should it become necessary, and then hackers are the convenient scapegoat for blame in the eyes of everyone else.
They don't need to use a water plant for that. They've got Obamacare.
(bud-a-boom TISH!)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
How do we know, what the mid- and long-term effects will be? There is no one obviously poisoned by tap water in Flint, Michigan either.
Should we apply the same spin to people responsible for that, as the submitter applied to hackers because he sympathizes with them?
In Soviet Washington the swamp drains you.
and team.. (embarrassed to admit I watch this show..)
In addition to possibly compromising a public water utility,
"the hackers had access to over 2.5 million customer personal and financial records"
Did Verizon report this to the EPA?
What possible excuse is there for not releasing of the name of this utility?
Considering the current situation in Flint, this is crazy.
If somebody had have died or gotten sick, the hacking party would be the ones to get in shit, not the asshat that put the admin password in a text file...
The rules are no different than if you and your gang of adolescent thrill seekers climbed over the fence or found an unlocked gate and began flipping exposed switches or opening valves just for the hell of it.
There is ZERO..... Z E R O reason for the payment system to have any connection to the SCADA system.
Whoever is the manager of that plant and the engineer of that SCADA system and it's network need to be put in jail for their incompetence.
Do not look at laser with remaining good eye.
Have to be connected to the WAN to bill consumers for the set up.
Cut the wire this is such a bad idea we made it 200 years without it connected we can go another 200 with ease.
This is what happens when systems are left on automatic pilot. I think the technical term is "oops". Fortunately there was yet another system (also left on automatic pilot), that gave people a clue. We all know old systems did things that were just plain stupid (clear text passwords?!?). We've all see and/or done it, but the real problem was there was no review of the system looking for such things. We keep forgetting that security (and reliability) is a process, NOT a technology. And with water treatment, periodic reviews of such system should be mandated by law.
"Imagination is more important than knowledge" - Einstein
Air gapped SCADA systems are for LUDDITES! Modern app appers only use apped apps apping apps, NOT LUDDITE SCADA!
"Yes, the asshole who left the admin password in a text file should get fired"
Assuming, of course, that there were other options and that the application didn't work in such a way as that a password in a text file wasn't required. In the latter case, the blame would be on shitty programmers - often a third party - and not the sysadmin who did the best with what he had.
As somebody who has often had plenty of similar WTF moments with crappy software design, I would not be surprised. In the end though, if one needs to connect to a remote system with credentials saved locally, there's not really a magic bullet for this. Sure, the password could have been encrypted, or it could have been hashed or perhaps key pairs used, but if the system is hacked and owned, even measures like that are really only going to delay the inevitable.
Hackers, therefore guilty
Oh let's be *agile*....oh let's *offshore*....and you'll get the needful alright....better/faster/cheaper -- choose 2..an admin password to a router in an INI file? Are you effing kidding me?? Just because you can code that doesn't make you smart....at all.
I think Slashraj or Sridot has started moderating here because every remark that is hard on india or h1b or offshoring has been modded -1 lately.
Hacking is really no less puerile than going around and smashing windows.
"Of course, the hackers had no clue what they were modifying."
The report discussed the intruders having little apparent knowledge of what they were doing. The anonymous reader assumes this to mean that the intruders didn't know they were screwing with a water treatment SCADA system.
I think it just as likely that they had figured out they had tapped into a process control system, and were figuring out how to manipulate the system... driving by Braille.
The RISK report report authors could have summarized the situation by reaching back to the prophetic words of Simon & Garfunkel: Clowns to left of me, jokers to the right, Here I am, stuck in the middle with you.
Luke, help me take this mask off
The old hackers did it , what happened did they get bored of 'cos terrorists' or 'wont any one think of the children?' classics!
...that we know of.
Glad to hear it. One December I got sick in the end. At one point, the length of my digestive tract, measured in time, became 20 minutes from the time I ate or drank anything to the time I sat on the toilet.
There's no time like the present. Well, the past used to be.