Slashdot Mirror
DDoS Attack Halts Heating in Finland Amidst Winter (metropolitan.fi)
A Distributed Denial of Service (DDoS) attack halted heating distribution at least in two properties in the city of Lappeenranta, located in Eastern Finland. In both of these events, the attacks disabled the computers that were controlling heating in the buildings. An anonymous reader writes: Both of the buildings were managed by Valtia, the company which is in charge of managing the buildings overall operation and maintenance. According to Valtia CEO, Simo Ruonela, in both cases the systems that controlled the central heating and warm water circulation were disabled. In the city of Lappeenranta, there were at least two buildings whose systems were knocked down by the network attack. According to Rounela, the attack in Eastern Finland lasted from late October to Thursday -- the 3rd of November. The systems that were attacked tried to respond to the attack by rebooting the main control circuit. This was repeated over and over so that heating was never working.
I know it's cold in Finland this time of year, but the first day of winter is still a month and a half in the future.
This time last year, I had my boiler replaced. While shopping around for a new one, a number of companies attempted to flog me cloud-based heating solutions.
"You can control it from your mobile phone."
"It knows you've left the house and turns itself off."
"It can be made to learn when you're coming home, and to switch on so that the house is warm when you get in."
"You can have them installed in your elderly relatives' homes, and control their heating for them, remotely."
My first thought was, well, if I can control all this shit remotely, so could someone else. An intranet solution would've been cool, though.
1. Why are these infrastructure computers reachable from the Internet?
2. Why this system doesn't fail safe if the controller is taken down?
Yet another cautionary tale of IoT woe, but also some seemingly bad design...
My eyes reflect the stars and a smile lights up my face.
Why, oh why, do software engineers (or maybe just coders) allow external access to mission critical processes?
Insanity: doing the same thing over and over again and expecting different results. Albert Einstein
http://www.channel4.com/news/ukraine-cyber-warfare-russia-attacks-georgia
Do you remember the DDNS cyber attacks on Georgia and Ukraine? Lots of little hacks that preceded an invasion.
Putin's also been flying jets violating Finnish airspace.
https://theaviationist.com/2016/10/06/this-armed-russian-su-27-flanker-has-probably-violated-the-finnish-airspace-today/
Putin really is counting on Trump getting elected. But surely Republicans wouldn't sell out their country to get a leader they didn't like into power simply because he's "red team"? You do realize that's Putin red not GOP red??
Sorry but if your heating system is 100% cloud based so that a DDOS attack or internet outage will stop heat control, then it was designed by the worlds biggest morons.
Cloud based is great for toys, for anything important it's 100% shit.
Do not look at laser with remaining good eye.
Turn off the heating in a critical office building to shut the office down. Even heating systems are critical in cold countries.
Even heating should be hardened and not available to Putin attack.
2007 Russian cyber attacks Estonia, blocking banking, government, newspaper headlines and Estonian Reform Party head quarters. This was after Russia tried and failed a propaganda attack during that years elections. Does that sound familiar? They failed to get their stooge into power.
https://en.wikipedia.org/wiki/2007_cyberattacks_on_Estonia
https://en.wikipedia.org/wiki/Estonian_parliamentary_election,_2007
"The Centre Party, led by the mayor of Tallinn Edgar Savisaar, had been increasingly excluded from collaboration, since his open collaboration with Putin's United Russia party, real estate scandals in Tallinn,[1] and the Bronze Soldier controversy, considered as a deliberate attempt to split Estonian society by provoking the Russian minority.[2]"
Putin tried to get his puppet elected. The people rejected the Putin puppet, so Russia did widespread cyber attacks on the country. Latvia has electronic voting, it is at the biggest risk of a Putin hacker rigged election. Estonia is more aware about the risks. Finland is very glib, but they were once under Russian control and should be more careful.
Never underestimate the power of a Russian puppet leader to undermine the security of a country. Never underestimate a cyber attack on critical systems, or worse, election systems.
How dare you deny the GLORY of Global Warming as foretold by the holy prophets of Hockey Stick!
Global Warming means that heat is not necessary and this story is obvious heresy by the denialist infidels!
AntiFA: An abbreviation for Anti First Amendment.
Sorry, but if you have hooked your important infrastructure systems to the internet you are an idiot. A moron. A fool. IMHO the person or persons at Valtia responsible for the decisions that led to installation of inherently vulnerable systems should pay the price of any retrofitting necessary to install isolated systems and compensation to any persons or companies that lost productivity due to this problem. We need to start holding responsible the persons making decisions like these so that, hopefully, at some point down the road installations like this one no longer occur. Critical systems need to be isolated. Yeah, that means you might have to hire an actual person to go and change settings when something goes wrong, rather than doing it across the net, but too damn bad.
Someday, we'll figure out that it's not a good idea to subject critical infrastructure to Internet control.
They could've turned off the heating at a polling location in the United States. Everyone would be blaming Putin even if he didn't do it.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The solution is simple. For some reason the people responsible don't take action. Maybe we are waiting for the big one? Like an explosion in a nuclear electricity facility?
GET. ALL. CRITICAL. INFRASTRUCTURE. SYSTEMS. OFF. THE. INTERNET.
If there's one good thing to come out of Trump's games, its that everyone suddenly takes cyber security of election and computer infrastructure seriously.
Suddenly when you're facing annexation by Putin's puppets, you finally decide you need to protect your computer systems from attack. Suddenly the need for unbreakable encryption becomes clear. Suddenly the terrible idea of backdoors becomes clear.
Now if only you'd thought about that early this year when his hackers began trying to put Trump into power?!
All that US infrastructure, all that mighty army, and it could all be rendered useless by a simple hack of the election system, and a Putin stooge planted in the Whitehouse. It's like a decapitation strike, a strike designed to take out the leadership, only Fox News and the Republican election rigging system help you deliver the fatal blow.
And once he's in power, can you protect those backdoors you put in, from Trump handing them over to Putin? And once you're in power, can you stop Trump giving Putin access to all that domestic surveillance machinery? How would you defend Finland, if the major country head of Nato is a puppet? How would you defend US bases around the world, if President Puppet won't give the order to counter attack?
don't ask Valtia to manage your building, because if there's an Internet outtage, your building freezes over.
Default ought to return to my 80 year old, still working bimetallic thermostat, with no electronics. Never failed in 80 years.
Bob: Who is General Winter Protection Fault and why is he reading the hard drive of our Internet-connected central heating apparatus?
Alice: General Winter supports Mother Russia and our protection has obviously failed!
Bob: I'll give up my soul-warming vodka flask when you pry it from my cold, dead hands!
Alice: Oops, the lights went out and there is no phone either...
Bob: I, for one welcome our novo-russian hacker overlords! Unbreakable Union of freeborn Soviet Republics, Great Russia has welded forever to stand ... la-la-la ...
Let a mechanical thermostat be the default control when the computer fails, regardless of why!
Internet s double-edged, it allows you to watch your favourite film from anywhere in the globe but it also allows anyone from anywhere in the globe to screw whatever you connect to the internet. So, why on earth are strategic sectors (heating no less) connected to the internet??? Months ago it was a hospital, a bloody hospital connected to the internet and hijacked with ransomware. There are things that should never be online. Things that society can't live (properly) without.
How do you Fins keep the polar bears out of your igloos?
It might not be as productive as blaiming Putin for hacking, but if the finnish people DDoSed back they could use the excess heat to heat their homes.
Thats the sound the brownshirts boots will make as they carry the SJWs off for reprocessing.
You realize many are now thinking of voting for Trump, was that your intent?
IoT, Internet of Thermostat
With the attach a couple weeks ago, the more crap that doesn't but gets hooked up to the internet, WITHOUT PROPER SECURITY, it's only going to get worse.
This reminds me of my own experience last winter. My building at work has climate control regions of several offices each. Each region is collectively controlled from simple up/down 1 degree buttons on each of our internal company profile webpages that you can press at most every 10 minutes per person. The page also shows a history of who changed the temperature in which direction.
When I moved into this office, I discovered that two people were fighting between 68 and 72 degrees(mind you, you can only move it one degree every 10 minutes, so this was a slow battle throughout the day). I shot off an email to form a truce of 70 degrees, hinting that the one who wanted it warmer might just put on more clothes. They both agreed and maintained 70 degrees against any other changes for a few weeks. Then the 72 degree person broke the truce, and went even warmer when he could. So in response, I wrote a simple script that every 11 minutes will check the temperature and turns it down if it was above 71. But the enemy caught on when clearly I was either working really strange hours and obsessively checking the page, or was running a script. He wrote his own script(or more likely got someone smarter to do it), that seemed strangely more successful than mine. After a few weeks of automatic back and forth, I got contacted by a maintainer of this internal company server asking if I was running a script. It turns out the enemy didn't use any sort of timer, and his script just constantly pressed the button whether the 10 minutes was up or not(so sometimes he'd slip in two changes before I got my one). This caused 1000s of hits/second on the server and numerous errors. They only realized I had a script because they looked at the history and saw that we fought all night long. My boss thought it was funny and encouraged me to make my script more human like. I ended up just buying a fan for under my desk and stopped caring.
Finnish winters are starting to resemble the summer, but unlike the summer, which was on Thursday this year, the winter is scheduled on Tuesday.
There are no atheists when recovering from tape backup.
I am an HVAC controls Technologist and the product we use used to have an unintentional DOS issue. If there was too much traffic on the controller's network port (including traffic not intended for it), the processor would spend all of its time responding to network interrupts and actual operation would grind to a halt. The fix was simple...the manufacturer made new firmware that would simply ignore network interrupts if the program scan rate got too low. Sure, the controller would quit communicating on the LAN but it was still accessible via rs-232/485.
These controllers have 32MHz processors, 2MB ram, and 10Mb half-duplex ethernet, and cost multiple thousands of dollars.
That is such a clever idea... I wonder at what time the planets engineers became morons?
We are not talking about a remote control that is for some absurd reason controlling your local heating in the house.
We actually are talking about remotely distributed heat, hot water, steam, to heat the houses in question.
Otherwise the owners could simply fiddle with the controls I guess.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
I'm sure that school that has their heating system controlled by an Amiga won't have this problem :P
On a long enough timeline, the survival rate for everyone drops to zero.
Is this on a GSM closed network? Are the meters receiving commands via (signed) SMS messages, or are they actually on the internet (use GSM to go online via an ISP)?
Curso NR 10 online curso NR 10 curso NR 10 online
Was it marketing? Did some MBA dip shit decide they had to include "cloud" technologies in their bullets-on-the-box and, thus, forced engineering to do something stupid.
Or, was it just some dip shit engineer who decided he wanted to create a "cool" design based on the current technology fad?