Slashdot Mirror
Hackers Could Blow Up Factories Using Smartphone Apps (technologyreview.com)
An anonymous reader quotes a report from MIT Technology Review: Two security researchers, Alexander Bolshev of IOActive and Ivan Yushkevich of Embedi, spent last year examining 34 apps from companies including Siemens and Schneider Electric. They found a total of 147 security holes in the apps, which were chosen at random from the Google Play Store. Bolshev declined to say which companies were the worst offenders or reveal the flaws in specific apps, but he said only two of the 34 had none at all. Some of the vulnerabilities the researchers discovered would allow hackers to interfere with data flowing between an app and the machine or process it's linked to. So an engineer could be tricked into thinking that, say, a machine is running at a safe temperature when in fact it's overheating. Another flaw would let attackers insert malicious code on a mobile device so that it issues rogue commands to servers controlling many machines. It's not hard to imagine this causing mayhem on an assembly line or explosions in an oil refinery. The researchers say they haven't looked at whether any of the flaws has actually been exploited. Before publishing their findings, they contacted the companies whose apps had flaws in them. Some have already fixed the holes; many have yet to respond.
Oh look, it's the hackers can bomb you with you own computer headline again.
This time featuring smartphones and apps oh boy that changes everything!
My dumbphone can blow up a factory with a mere SMS message.
All I need is some C4 and a remote trigger.
OK let's say you have enough knowledge to do this remotely. Even if you can manipulate process automation through a smartphone app, it's a sure bet you can't change most of the limits or permissives. There are specific reasons why process and power are designed to prevent this and covered by ASME or API codes. It's not random or arbitrary design. And while there are industrial accidents they are usually a chain of multiple failures or unforeseen problems in the design no one anticipated.
This article is FUD. You may be able to trip the plant or shut down production, but unlikely to cause a malfunction that results in a catastrophe.
A few people shot out some PG&E transformer oil reservoirs in California a while back. It tripped the substation, and PG&E routed around it. That is more likely than a hacker gaining enough knowledge to cause damage remotely.
1st rule of internet security: Only hook something to the net if it must be hooked to the net to do its job.
2nd rule of internet security: If a system is hooked to the net to allow monitoring, make it only capable of transmitting onto the net, and not recieving from the net.
3rd rule of internet security: Do not hire morons who will plug a memory stick into a unit that's not on the net, after that stick has been in a unit that is on the net.
4th rule of internet security: Disable any wireless connectivity on systems you are not intentionally hooking to the net.
5th rule of internet security: Do not hire anybody who would violate the preceeding four rules.
If your CEO is a moron he/she will make it less than a fireable offense to violate any of the above, and then your company deserves to have its factories explode.
Unplug the things that you can't afford problems with, you fucking convenience salesmen.
Anyone remember the oil refinery scene at the beginning of Red Storm Rising? Now the fundie engineer doesn't even have to go near the refinery to cause chaos.
Some nice fictional movie script could go like this:
Someone preppy who is photogenic has a modem and a new computer.
They had the phone number of their local power plant.
They created a script to dial every extension and only keep the number of any phone number extension that responded to a modem.
A day later they got a direct line to a modem in the power plant and could interact in computer ways with the local power company...
Black helicopters, federal law enforcement in suits swarm the local town looking for the computer owner.
In 2018 the movie has to have an app. The messages to and from the power plant are now are all on social media and have a pretty GUI.
Domestic spying is now "Benign Information Gathering"
Security in automation controls is an absolute joke. In the world of Rockwell Automation (if you're not familiar, roughly 70% of the US automation market), with network access to a single device anywhere on the automation network, you can go in and upload an entire controller entire program and see the full source. Their only 'security' is easily bypassed by a program on sf. Once you have said program, there is nothing, literally nothing, from stopping you from changing the program logic to do whatever you want. If you like you can even make temporary 'test' changes until poop hits the fan, then cancel them, returning things to normal. There's no logging of any of these changes and no security to prevent you from doing it. This is scarier than Meltdown/Spectre and i'm utterly amazed we haven't seen more disasters due to the simplicity of access and modifying these systems.
Scott
Phewww - that was close! But thanks to the diligent bi-partisan efforts of our legislators and the brilliant patriotic leadership of our businesspersons, the United States is safe from this threat. We have no factories left for anyone to blow up.
If you allow remote access to factory systems with anything else but special purpose laptops with hardware VPN and zero Internet access, you're doing it wrong. Any data crossing between from internet to intranet should require red tape, any software mountains of red tape (all on physically archived paper). Any data from intranet to internet should be across busses verified to be strictly unidirectional (ie. not tcp/ip with some ungodly complex stack written in C).
Almost everyone is doing it wrong ... the only place you should BYOD is the unemployment line.
The only way we are going to see any change in the industry is if it starts costing them money because simply continually cleaning up the messes of careless companies isn't going to change their attitude toward security. The reality is that you are actually enabling them to continue on with their poor security practices.
Anons need not reply. Questions end with a question mark.
I don't know what you're really getting at.
So you broke a conveyor line, so then the workers are going to just use pallet jacks to manually shuttle things around the floor.
So you broke a machine, oh, we'll just truck everything to the other plant.
So you broke the plastic wrapper, oh well, we'll just have to manually wrap the pallets in plastic.
So you broke the automatic labeler, oh well, we'll just have somebody manually label the product.
So you break all of these things at once... okay, now we'd better start an investigation for prison time and/or hefty fines.
I hate dealing with IT people, as their idea of 'total disaster' or 'hull breach' is really a minor inconvenience that already happens anyway for different reasons (machines break down all the time, people or product don't show up, down for maintenance). So then they aim to make a software developer or engineer's entire existence sad and inconvenient with their draconian rules.
What, clap 3 times before downloading a program, and fill out a useless form? What is your idea of security? I wish IT could work in a positive manner with managers and engineers, the same way that engineers can work together with managers and see the big picture.
Calm your tits there Louis Freeh. You don't name shit under NDAs. You can demand pepperoni all day but forget it. ALL stories are hearsay/heresy, pipe down with your "am I being detained" last minute meth-hiding antics.
You do realize that to make a program change at the level you're asking, you have to have access to the control room or side engineering rooms. This is usually up a secure elevator (keycard) and past workers and security guards that will ask who you are because they've never been introduced to you before.
Yes you could do social engineering to call in and set up a "go to my pc" session. But keep in mind everyone is going to be really skeptical when they hear you want to make remote changes and are being asked to download and install a program, but have never met face-to-face.
You might remotely hack in with modem/vpn access to the office air conditioning system, or business system that handles purchasing fuel and billing. You're not going to be able to make setpoint changes.
Was it the factory that built the Samsung Galaxy Note 7? I don't think that required an app...
Just out of curiosity, do all "security researchers" come from shithole countries?
You are welcome on my lawn.
Damn Slashdot stepped on my joke. The subject line of my above comment was supposed to be,
You are welcome on my lawn.
I'll believe it when I see it.
"Two security researchers, Alexander Bolshev of IOActive and Ivan Yushkevich of Embedi, have been playing WatchDogs 2 way too much."
A few years ago, a not-too-clever politician was horrified to learn a specific chemical caused fires and demanded it be banned. Everyone who took senior-level school chemistry knows he meant KMnO4 (Condy's crystals), once a staple of every medical cabinet.
Surprise, smartphones are small computers now? Don't get me wrong, I've never been one for advocating vital systems to be connected to the Internet, but I do see the benefits of doing so, although the risks are often excessive IMO. Also, with interconnected systems, only one component (weakest link?) in the chain has to be connected for the entire chain to be vulnerable.
And hackers could also not blow up factories.
What what the point of this article again? I'm very confused.
Some /. headlines and summaries are bad, some are misleading, and some are unconscionable. It is hard to imagine that competent companies and engineers can design their systems so stupidly as to allow "hackerZ to BLOW UP FACTORIES USING SMARTPHONE APPS". Yes, incompetence happens. Yes, competent terrorism/vandalism happens. But no, the presumption is that this jump of imagination is simply an unethical sensationalization of GROSS NEGLIGENCE. The fact that this passes on /. is sad. Sadder than typical /. sadness.
Any refinery or chemical plant that is even remotely complaint with HSE rules should have very limited exposure to anything the control system can do to cause a truly major incident.
Sure it is trivial to shut it down or trivial to do something like cause catalyst or product to go to where it shouldn't. But any scenario that could cause something like an explosion should be identified and protected by safety systems independent of control systems and unable to be directly controlled.
Even when you look at oil industry incidents recently you can see the majority of accidents are due to missmanagement or bypassing of safety barriers for abnormal reasons which aren't properly risk assessed.
This potential scenario is one of the reasons the TRITON / TRISIS malware we covered recently got so much interest, and likely one of the reasons why the attacker was attempting to modify the code in the safety system.
Real life "Watchdogs". Nice. Gotta love this IoT nonsense everybody's into lately.
We suffer more in our imagination than in reality. - Seneca
Oblig: http://crazy.codetroop.com/randimg/imgs/computer_bomb.jpg
What a sensationalized title
Fuck this headline
To satisfy the filter, I would like to add fuck this headline.
Anyone old enough to watch the "Mission Impossible" tv series know to well how this goes ...
They fed one single punch card into a card reading machine and suddenly the bad guy's computer (a cabinet with lots of flashing lights) gone totally haywire, and smoke billowing out
Fifty something years later (this is 2018, btw) do we have to continue being bombarded with this kind of bullshit ??
So the guy from Mr. Robot was not that genius?
Yeah, right.
Captcha: revise
3rd rule of internet security: Do not hire morons who will plug a memory stick into a unit that's not on the net, after that stick has been in a unit that is on the net.
Not possible. If you don't want a memory stick plugged in then you will have to physically remove access. Even smart people with the best of intentions make mistakes or sometimes are duped.
4th rule of internet security: Disable any wireless connectivity on systems you are not intentionally hooking to the net.
Wireless (and wired) connectivity systems should be disabled by default and require positive action to enable. End users should not have the rights to enable this functionality.
5th rule of internet security: Do not hire anybody who would violate the preceeding four rules.
And how do you propose to identify these people ahead of time since they don't carry Bill Engvall I'm stupid signs.
SCADA (process control) networks have long been known to have vulnerabilities that can be exploited in the real world. Further, project Aurora proved you could cause a generator to explode with the proper SCADA inputs. Just because they are front ending the mess with apps doesn't change anything.
rule. When I was working with high voltage semiconductor equipment, the rule was that there
had to be 2 electromechanical (i.e. not computer controlled) backup systems to 'safe' things
before they could be accessed. Seemed sensible to me. Is this not followed anymore?
Damn y'all naysayers forgot about Stuxnet fast.
I will just leave this here:
https://www.youtube.com/watch?...
I think people over estimate engineers consistently and fail to understand the context of an engineers work in todays world. its all fine and dandy to say that proper engineers would never do things like this or allow control of dangerous processes to have contact with the outside world, but engineers are people too, people who have bosses who tell them what to do. They are also afflicted by project costs and inter office politics, so much so that there is no more pure engineering as all of the consequences of failure is hidden away under a mountainous amount of red tape and corporate protection.
TL;DR: never underestimate stupid or greed, they will win over safety and caution every day of the week
Honestly, in my considerable experience working in the US industrial, defense, academic, financial, and aerospace sectors, the more money is spent on equipment, the more likely it is that the installing engineer will be dangerously incompetent.
This is because many corporate and government cultures preferentially promote and reward people with traits antithetical to good engineering (such as sycophancy, sociopathy, psychopathy and obsequiousness) rather than identifying good engineers through evaluation of the quality of their work. Very expensive engineering projects seem to attract pointy-haired incompetence like churches with celibate priesthoods attract pedos, basically.
HACKERS COULD PROGRAM YOUR COMPUTERS TO EAT YOUR HOMEWORK, MAKE YOUR PANTS TIGHT, AND CALL YOUR MOTHER FAT! (not necessarily in that order)
A new study published in the Eleet Journal of Computer Sciences finds that you mother is fat and your homework will get eaten by the internet, thanks to hackers. According to Dr. Yakub Leafstein, hackers have actually already destroyed your homework and called your mother names. You just don't know it yet because you are being distracted by a massive propaganda campaign consisting of fabricated news stories, pants tightening imagery, and badly written fictions called duplicate lasagna. Dr. Leafstein insists the hacker threat is no longer just a threat, but a real world problem. When asked about the hacker threat, Dr. Leafstein said, "The hacker threat is no longer just a threat, but a real world problem". This is a whole new paradigm! If your own mother isn't safe from hackers, what is? With this new found knowledge we've come to the conclusion that anything is possible when the hacker is involved. Who knows what could be next? People voter fraud? Brain sex DNA modification? Blowing up swaprats with mobile telephone computer applications? It's like almost anything presented in fiction in the past is now a reality. Well, I for one won't be using my computer anym
Well, that's why we needs spies/whistleblowers to break the info out. The NDA is simply a way to hide criminal acts. Public interest shall prevail over all NDAs. It can be done the easy way, or the hard way, but we will get free pepperoni for all!
It's not hard to imagine this causing mayhem on an assembly line or explosions in an oil refinery.
Yeah I can imagine a lot of things. Can these flaws actually be used to blow something up, or just imagine it?