Slashdot Mirror
Hackers Could Blow Up Factories Using Smartphone Apps (technologyreview.com)
An anonymous reader quotes a report from MIT Technology Review: Two security researchers, Alexander Bolshev of IOActive and Ivan Yushkevich of Embedi, spent last year examining 34 apps from companies including Siemens and Schneider Electric. They found a total of 147 security holes in the apps, which were chosen at random from the Google Play Store. Bolshev declined to say which companies were the worst offenders or reveal the flaws in specific apps, but he said only two of the 34 had none at all. Some of the vulnerabilities the researchers discovered would allow hackers to interfere with data flowing between an app and the machine or process it's linked to. So an engineer could be tricked into thinking that, say, a machine is running at a safe temperature when in fact it's overheating. Another flaw would let attackers insert malicious code on a mobile device so that it issues rogue commands to servers controlling many machines. It's not hard to imagine this causing mayhem on an assembly line or explosions in an oil refinery. The researchers say they haven't looked at whether any of the flaws has actually been exploited. Before publishing their findings, they contacted the companies whose apps had flaws in them. Some have already fixed the holes; many have yet to respond.
Oh look, it's the hackers can bomb you with you own computer headline again.
This time featuring smartphones and apps oh boy that changes everything!
OK let's say you have enough knowledge to do this remotely. Even if you can manipulate process automation through a smartphone app, it's a sure bet you can't change most of the limits or permissives. There are specific reasons why process and power are designed to prevent this and covered by ASME or API codes. It's not random or arbitrary design. And while there are industrial accidents they are usually a chain of multiple failures or unforeseen problems in the design no one anticipated.
This article is FUD. You may be able to trip the plant or shut down production, but unlikely to cause a malfunction that results in a catastrophe.
A few people shot out some PG&E transformer oil reservoirs in California a while back. It tripped the substation, and PG&E routed around it. That is more likely than a hacker gaining enough knowledge to cause damage remotely.
1st rule of internet security: Only hook something to the net if it must be hooked to the net to do its job.
2nd rule of internet security: If a system is hooked to the net to allow monitoring, make it only capable of transmitting onto the net, and not recieving from the net.
3rd rule of internet security: Do not hire morons who will plug a memory stick into a unit that's not on the net, after that stick has been in a unit that is on the net.
4th rule of internet security: Disable any wireless connectivity on systems you are not intentionally hooking to the net.
5th rule of internet security: Do not hire anybody who would violate the preceeding four rules.
If your CEO is a moron he/she will make it less than a fireable offense to violate any of the above, and then your company deserves to have its factories explode.
Some nice fictional movie script could go like this:
Someone preppy who is photogenic has a modem and a new computer.
They had the phone number of their local power plant.
They created a script to dial every extension and only keep the number of any phone number extension that responded to a modem.
A day later they got a direct line to a modem in the power plant and could interact in computer ways with the local power company...
Black helicopters, federal law enforcement in suits swarm the local town looking for the computer owner.
In 2018 the movie has to have an app. The messages to and from the power plant are now are all on social media and have a pretty GUI.
Domestic spying is now "Benign Information Gathering"
Security in automation controls is an absolute joke. In the world of Rockwell Automation (if you're not familiar, roughly 70% of the US automation market), with network access to a single device anywhere on the automation network, you can go in and upload an entire controller entire program and see the full source. Their only 'security' is easily bypassed by a program on sf. Once you have said program, there is nothing, literally nothing, from stopping you from changing the program logic to do whatever you want. If you like you can even make temporary 'test' changes until poop hits the fan, then cancel them, returning things to normal. There's no logging of any of these changes and no security to prevent you from doing it. This is scarier than Meltdown/Spectre and i'm utterly amazed we haven't seen more disasters due to the simplicity of access and modifying these systems.
Scott
If you allow remote access to factory systems with anything else but special purpose laptops with hardware VPN and zero Internet access, you're doing it wrong. Any data crossing between from internet to intranet should require red tape, any software mountains of red tape (all on physically archived paper). Any data from intranet to internet should be across busses verified to be strictly unidirectional (ie. not tcp/ip with some ungodly complex stack written in C).
Almost everyone is doing it wrong ... the only place you should BYOD is the unemployment line.
The only way we are going to see any change in the industry is if it starts costing them money because simply continually cleaning up the messes of careless companies isn't going to change their attitude toward security. The reality is that you are actually enabling them to continue on with their poor security practices.
Anons need not reply. Questions end with a question mark.
Of course if you were going to be that destructive, much safer to drive around in a white diesel van with an PTO and an electromagnetic pulse generator and simply cause wide spread chaos on the move. Pretty hard to track you down, as all the tracking systems and agencies go down and you are only noticeable by the fact you are still moving, whilst everything else is coming to a halt with the damage and impact tied to the power output of your EMP device and how many kilometres you can travel with it pulsing away. Don't do this, it would be bad, seriously but you know where this is going been said again and again. When governments hack governments, the next step is EMP attacks, it is inevitable that it will escalate to this and you can bet corporations will attack corporations, billions at stake.
Chaos - everything, everywhere, everywhen
Damn Slashdot stepped on my joke. The subject line of my above comment was supposed to be,
You are welcome on my lawn.
Any refinery or chemical plant that is even remotely complaint with HSE rules should have very limited exposure to anything the control system can do to cause a truly major incident.
Sure it is trivial to shut it down or trivial to do something like cause catalyst or product to go to where it shouldn't. But any scenario that could cause something like an explosion should be identified and protected by safety systems independent of control systems and unable to be directly controlled.
Even when you look at oil industry incidents recently you can see the majority of accidents are due to missmanagement or bypassing of safety barriers for abnormal reasons which aren't properly risk assessed.
This potential scenario is one of the reasons the TRITON / TRISIS malware we covered recently got so much interest, and likely one of the reasons why the attacker was attempting to modify the code in the safety system.
For more automated plants, shutting down anything can be quite catastrophic. Bottling lines, injection molders, cnc shops. How are they going to do all this stuff manually? And sabotaging steel mills has absolutely disastrous consequences. All this can cost millions for even just a couple days down time. I know in my plant, I would have to basically send everyone home as there would be nothing for anyone to do. Doing things manually is no longer an option in many places.
Or you can just get the Teamviewer ID and password because the vast majority of tech support by major machine manufacturers and/or integrators use Teamviewer and a vast majority of them use the same password.
There are going to be far more connecting industrial equipment. Data acquisition is a big factor in this, which I don't see a problem with. Interconnecting multiple pieces of equipment to form one line is another. However, lately there is a big push by big name companies like Siemens pushing remote access to your equipment from the beach and being able to "fix" mistakes from said beach. All the Siemens engineers are quite proud of this feature at these conferences, that you can change the functionality of an equipment thousands of miles away without even knowing what the hell it's doing physically, like maybe squishing one of those poor workers that's around it. I find that more concerning than worrying about someone trying to blow up a plant.
3rd rule of internet security: Do not hire morons who will plug a memory stick into a unit that's not on the net, after that stick has been in a unit that is on the net.
Not possible. If you don't want a memory stick plugged in then you will have to physically remove access. Even smart people with the best of intentions make mistakes or sometimes are duped.
4th rule of internet security: Disable any wireless connectivity on systems you are not intentionally hooking to the net.
Wireless (and wired) connectivity systems should be disabled by default and require positive action to enable. End users should not have the rights to enable this functionality.
5th rule of internet security: Do not hire anybody who would violate the preceeding four rules.
And how do you propose to identify these people ahead of time since they don't carry Bill Engvall I'm stupid signs.
I'd say cars stopping all around the truck and trapping it/blocking streets would quickly end this plan.
SCADA (process control) networks have long been known to have vulnerabilities that can be exploited in the real world. Further, project Aurora proved you could cause a generator to explode with the proper SCADA inputs. Just because they are front ending the mess with apps doesn't change anything.
rule. When I was working with high voltage semiconductor equipment, the rule was that there
had to be 2 electromechanical (i.e. not computer controlled) backup systems to 'safe' things
before they could be accessed. Seemed sensible to me. Is this not followed anymore?