Slashdot Mirror
Researchers Discover Critical Security Flaws Found In Nuke Plant Radiation Monitors (securityweek.com)
wiredmikey writes from a report via Security Week: Researchers have discovered multiple unpatched vulnerabilities in radiation monitoring devices that could be leveraged by attackers to reduce personnel safety, delay detection of radiation leaks, or help international smuggling of radioactive material. Ruben Santamarta, a security consultant at Seattle-based IOActive, at the Black Hat conference on Wednesday, saying that radiation monitors supplied by Ludlum, Mirion and Digi contain multiple vulnerabilities. There are many kinds of radiation monitors used in many different environments. IOActive concentrated its research on portal monitors, used at airports and seaports; and area monitors, used at Nuclear Power Plants (NPPs). However, little effort was required for the portal monitors: "the initial analysis revealed a complete lack of security in these devices, so further testing wasn't necessary to identify significant vulnerabilities," Santamarta explained in his report (PDF). In the Ludlum Model 53 personnel portal, IOActive found a backdoor password, which could be used to bypass authentication and take control of the device, preventing the triggering of proper alarms.
I have a classic book in front of me published in the year 1868, titled âoeGOD IN HISTORY and GOD IN SCIENCE,â authored by London Pastor John Cumming (1807-1881).[1] May I say kindly, there's no such thing as an atheist! Some of the world's wealthiest celebrities have the stench of Hell on them, which is where they are all going, blaspheming the very God Who is kind to them. Luke 6:35b, âoe...for he is kind unto the unthankful and to the evil.â
Legendary singer Billy Joel is a professed atheist...
âoeI gradually decided that just because I didn't have or couldn't find the ultimate answer didn't mean I was going to buy the religious fairytale. As an atheist you have to rationalize things.â â"Billy Joel
On page 139 of his book, âoeGOD IN HISTORY and GOD IN SCIENCE,â Pastor John Cumming makes a brilliant observation concerning professed atheists...
Atheism is folly as much as wickedness. But suffer me, before I show this, to say, that it is absolutely impossible that any man can be an atheist, in the strict sense of that word. All that any can say is this: âoeNo spot that I have searched does reveal a God; every organization I have examined does not show traces of wisdom, goodness, and design:â but that individual cannot say; âoeThere is no God;â because he cannot say, âoeI have soared to the farthest star, I have descended to the deepest mines, I have swept all space, and searched all time, and in the realms of infinite space I have not detected any traces of a God.â In other words, to be able to say, âoeThere is no God,â you must yourself assume to be God, which is a reductio ad absurdum, an utter and a complete absurdity.
SOURCE: âoeGOD IN HISTORY and GOD IN SCIENCE,â p. 139; by Rev. John Cumming, D.D.; New York: Published by Carlton & Lanahan; 200 Mulberry-Street; 1868.
What a brilliant observation. How can any man claim to be an atheist unless he has traveled to the farthest place in the universe? The nearest star to the earth (after our own sun) is Alpha Centauri, which is 4.37 light-years away (28,200,000,000,000 miles away!). This is just one star, being the closest to earth besides our own sun, which is 93,000,000,000 miles away. My friend, the Hubble Space Telescope has discovered that there are at least 200,000,000,000 galaxies in the universe. And each of those galaxies contains BILLIONS of stars! It is anticipated that when the James Webb Telescope is launched in 2018 from NASA, that it will discover over ONE TRILLION GALAXIES!!!
The Word of God teaches that God made the stars. I love how Genesis 1:16 is written... âoeHE MADE THE STARS ALSO.â It's like the Bible is saying, âoeOh, by the way, God also made all the stars!â Genesis 1:16, âoeAnd God made two great lights; the greater light to rule the day, and the lesser light to rule the night: he made the stars also.â God is amazing, Who knows the exact number of stars that He created, and he calls them each by their own name. Amen! Psalms 147:4, âoeHe telleth the number of the stars; he calleth them all by their names.â I have just briefly discussed the stars. The world that exists under a microscope is even more amazing, complex and a mystery to mankind. How can anyone reasonably claim to be an atheist when man hasn't even discovered what's in 90% of the earth's oceans? Pastor John Cumming is so right... For anyone to say, âoeThere is no God!,â you must yourself assume to be God! No human being has traveled to the ends of the universe. In fact, no human being has ever even left the Milky Way Solar System. Psalms 145:3, âoeGreat is the LORD, and greatly to be praised; and his grea
You're a nutcase.
A rubber-padded room is where you belong.
By the way, Russians if weren't the problem would honestly not be a security concern if the systems were compromized.
Stick that in your pipe and smoke it.
Automated radiation detection equipment that basically measures how big fines companies will pay when managing nuclear materials, back doors and no security, now that shit never happens by accident. Only question needed to be asked, how much money can be saved by not alerting the authorities of mismanagement, of letting them know investigations and prosecutions should occur and of opening up a cheating company taking stupid short cuts to civil suits. This device and the company need a proper investigation as does every single place that has that device fitted for undisclosed radiation leaks. This should be a major red flag.
Chaos - everything, everywhere, everywhen
I work alongside a team that maintains and repairs these things, and they certainly aren't made for high levels of digital security. If you know the right place to stick a flash drive in a portal monitor sure you could do damage to it, I can attest it isn't fancy. But it doesn't have to be.
For one, a portal monitor is a last line of defense against radioactive contamination being tracked around. We aren't talking about huge levels of radiation, the contamination is managed by good safety practices (work plans, electronic dosimeters, maps of potential loose contamination, etc.). But there is a responsibility to ensure that a worker doesn't accidentally drag anything home with them to the general public, no matter how insignificant. Which is really what the monitors are for.
For two, there are usually multiples of these things in a row, inside a heavily fortified concrete area surrounded by unfriendly looking men with machine guns (at least at any nuclear facility, a school or small lab that has one would be different). Combine those two things, and an attempt to "hack" monitors would be about the most moronic waste of resources any government would ever spend. You couldn't do any real damage, you couldn't hurt anyone... at best you could get a radiation protection manager fired for allowing a small uncontrolled release of radioactivity, or a miscalculated dose rate to a worker.
I'm all for security, but there needs to be a little perspective. Standalone portal monitors that are airgaped don't need to be a digital fort knox. The level of effort is extreme to screw with them, and the payback would be insignificant. The truth is most specialized lab/nuclear equipment isn't extremely secure unless it serves an actual security function (a CDA, critical digital asset, which are almost always network isolated and have more robust security). Quite the opposite, most of it is very simple and made to be maintained almost indefinitely by moderately skilled technicians. Cost, usability, and maintainability is more important.
This is imporant arguement! Russian hacked into American servers and do people to change votes to Donald Trump (pay by Russia) instead of Hillary (purchase by some Americans). Trump will cause nuclear war with Russia over this. Hillary woold not have cause war.
That was until I saw "Microsoft Windows" mentioned on page 10.
No wait, it's page 8 in the PDF. My bad.
We do not need to have every detector and monitor out there to be secure. That would detract to their strength namely monitoring, would add another point of failure namely that the security of those would need to be updated periodically. Why spend a lot of money which could be done better spent by having better detector ? No. The problem is if the monitor are left as-is naked to the internet. But so is also the problem with any devices for which the primary usage is industrial environment intranet and not being open to the wide wild internet. What you should always do, is put those behind firewall and secure shells, in their own intranet. That way the monitor and detector can do the best job : detecting, while the firewall and secure shell can do their best job : namely protecting the detector. And those security can be updated against vulnerability. A all-in-one device sometimes is not the best idea.
Some information about the status of Fukushima NPP:
A billion tons of triated water to be dumped into the pacific ocean
Unit 3 core elements found in the bottom of the pressure vessel
More pictures of melted fuel
My ism, it's full of beliefs.
Good content i see ever
www.techfines.com
You don't protect your nuclear assets with a swiss cheese.
I can't understand the fanboyism I see for nuclear on Slashdot. There are better, safer and more cost effective technologies out there now. Nuclear is dying and Slashdot should realize that.
Those systems are largely air gapped in a physically secure environment. What I'd be more concerned about is that when I was working with the International Atomic Energy Authority (UN) about 4 years ago the entire outfit was still being run off an old IBM Series 360 Mainframe. I hadn't seen one of those since the mid 90's
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.
Am I wrong? Didn't they just recently raise the amount of "safe" radiation levels? The rise in bone cancer Sarcoma - is this a coincidence?