Slashdot Mirror
Researchers Discover Critical Security Flaws Found In Nuke Plant Radiation Monitors (securityweek.com)
wiredmikey writes from a report via Security Week: Researchers have discovered multiple unpatched vulnerabilities in radiation monitoring devices that could be leveraged by attackers to reduce personnel safety, delay detection of radiation leaks, or help international smuggling of radioactive material. Ruben Santamarta, a security consultant at Seattle-based IOActive, at the Black Hat conference on Wednesday, saying that radiation monitors supplied by Ludlum, Mirion and Digi contain multiple vulnerabilities. There are many kinds of radiation monitors used in many different environments. IOActive concentrated its research on portal monitors, used at airports and seaports; and area monitors, used at Nuclear Power Plants (NPPs). However, little effort was required for the portal monitors: "the initial analysis revealed a complete lack of security in these devices, so further testing wasn't necessary to identify significant vulnerabilities," Santamarta explained in his report (PDF). In the Ludlum Model 53 personnel portal, IOActive found a backdoor password, which could be used to bypass authentication and take control of the device, preventing the triggering of proper alarms.
too long, didn't read
You're a nutcase.
A rubber-padded room is where you belong.
Automated radiation detection equipment that basically measures how big fines companies will pay when managing nuclear materials, back doors and no security, now that shit never happens by accident. Only question needed to be asked, how much money can be saved by not alerting the authorities of mismanagement, of letting them know investigations and prosecutions should occur and of opening up a cheating company taking stupid short cuts to civil suits. This device and the company need a proper investigation as does every single place that has that device fitted for undisclosed radiation leaks. This should be a major red flag.
Chaos - everything, everywhere, everywhen
I work alongside a team that maintains and repairs these things, and they certainly aren't made for high levels of digital security. If you know the right place to stick a flash drive in a portal monitor sure you could do damage to it, I can attest it isn't fancy. But it doesn't have to be.
For one, a portal monitor is a last line of defense against radioactive contamination being tracked around. We aren't talking about huge levels of radiation, the contamination is managed by good safety practices (work plans, electronic dosimeters, maps of potential loose contamination, etc.). But there is a responsibility to ensure that a worker doesn't accidentally drag anything home with them to the general public, no matter how insignificant. Which is really what the monitors are for.
For two, there are usually multiples of these things in a row, inside a heavily fortified concrete area surrounded by unfriendly looking men with machine guns (at least at any nuclear facility, a school or small lab that has one would be different). Combine those two things, and an attempt to "hack" monitors would be about the most moronic waste of resources any government would ever spend. You couldn't do any real damage, you couldn't hurt anyone... at best you could get a radiation protection manager fired for allowing a small uncontrolled release of radioactivity, or a miscalculated dose rate to a worker.
I'm all for security, but there needs to be a little perspective. Standalone portal monitors that are airgaped don't need to be a digital fort knox. The level of effort is extreme to screw with them, and the payback would be insignificant. The truth is most specialized lab/nuclear equipment isn't extremely secure unless it serves an actual security function (a CDA, critical digital asset, which are almost always network isolated and have more robust security). Quite the opposite, most of it is very simple and made to be maintained almost indefinitely by moderately skilled technicians. Cost, usability, and maintainability is more important.
That was until I saw "Microsoft Windows" mentioned on page 10.
No wait, it's page 8 in the PDF. My bad.
We do not need to have every detector and monitor out there to be secure. That would detract to their strength namely monitoring, would add another point of failure namely that the security of those would need to be updated periodically. Why spend a lot of money which could be done better spent by having better detector ? No. The problem is if the monitor are left as-is naked to the internet. But so is also the problem with any devices for which the primary usage is industrial environment intranet and not being open to the wide wild internet. What you should always do, is put those behind firewall and secure shells, in their own intranet. That way the monitor and detector can do the best job : detecting, while the firewall and secure shell can do their best job : namely protecting the detector. And those security can be updated against vulnerability. A all-in-one device sometimes is not the best idea.
Yeah, but the mangled characters make it look like Welsh. It's a lot funnier when you read it in a Welsh accent.
His ignorance covered the whole earth like a blanket, and there was hardly a hole in it anywhere. - Mark Twain
Those systems are largely air gapped in a physically secure environment. What I'd be more concerned about is that when I was working with the International Atomic Energy Authority (UN) about 4 years ago the entire outfit was still being run off an old IBM Series 360 Mainframe. I hadn't seen one of those since the mid 90's
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.
I'm not sure what you think I'm supposed to take away from this. The is a discussion of nuclear power plant security and the Fukushima site seems pretty secure right now. They have no sign of uncontrolled release of radiation,
What? That is the exact opposite of what is happening. There is seawater exchange in and out of the location where they found the melted fuel. Remember when they were denying that there was even a meltdown? Evey time Tepco communicates, they lie. It's the most reliable force in the universe.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Evey time Tepco communicates, they lie. It's the most reliable force in the universe.
So Kellyanne Conway is working for Tepco now?
Am I wrong? Didn't they just recently raise the amount of "safe" radiation levels? The rise in bone cancer Sarcoma - is this a coincidence?
No, I'm saying you attempt to falsify reality in pursuit of your idealogy.
I'm saying TEPCO are clearly not capable, willfully and criminally negligent. I'm saying the sooner this is resolved with an international effort the lower the overall impact will be.
Everytime you tout your zealotry more of the truth you seek to conceal emerges. Everytime you boast of your ignorance, more fact emerges for everyone else to see. Everytime you fail to acknowledge the situation, more consequences are revealed. Over eight hundred thousand tons of highly radio active water in uncontrolled releases *so far*.
It's clear you see this as a political issue and not a radiological issue that will affect the genome of every species on the planet for the forseeable future. It's clear you are not stupid but willfully ignorant and actively deny fact placed before you. Your comments are so dogmatically skeptical the only logical conclusion to draw is that you are either a paid troll with an adgenda or a useful idiot prepared to pathologize your own perception of reality in pursuit of your idealogy.
Take away that your trolling is so obviously professional it's unlikeley I'm the only one who can see through the bullshit of your agenda.
You are an enemy of freedom because you are an enemy of truth. You are an enemy of truth because you are an enemy of freedom.
I meant to point that out to you last time we conversed however something more important came up. I appreciate you delivering an opportunity to excoriate you and once again be entertained by your display of mental gymnastics around the facts.
My ism, it's full of beliefs.