Slashdot Mirror
Hackers Could Blow Up Factories Using Smartphone Apps (technologyreview.com)
An anonymous reader quotes a report from MIT Technology Review: Two security researchers, Alexander Bolshev of IOActive and Ivan Yushkevich of Embedi, spent last year examining 34 apps from companies including Siemens and Schneider Electric. They found a total of 147 security holes in the apps, which were chosen at random from the Google Play Store. Bolshev declined to say which companies were the worst offenders or reveal the flaws in specific apps, but he said only two of the 34 had none at all. Some of the vulnerabilities the researchers discovered would allow hackers to interfere with data flowing between an app and the machine or process it's linked to. So an engineer could be tricked into thinking that, say, a machine is running at a safe temperature when in fact it's overheating. Another flaw would let attackers insert malicious code on a mobile device so that it issues rogue commands to servers controlling many machines. It's not hard to imagine this causing mayhem on an assembly line or explosions in an oil refinery. The researchers say they haven't looked at whether any of the flaws has actually been exploited. Before publishing their findings, they contacted the companies whose apps had flaws in them. Some have already fixed the holes; many have yet to respond.
Oh look, it's the hackers can bomb you with you own computer headline again.
This time featuring smartphones and apps oh boy that changes everything!
Security in automation controls is an absolute joke. In the world of Rockwell Automation (if you're not familiar, roughly 70% of the US automation market), with network access to a single device anywhere on the automation network, you can go in and upload an entire controller entire program and see the full source. Their only 'security' is easily bypassed by a program on sf. Once you have said program, there is nothing, literally nothing, from stopping you from changing the program logic to do whatever you want. If you like you can even make temporary 'test' changes until poop hits the fan, then cancel them, returning things to normal. There's no logging of any of these changes and no security to prevent you from doing it. This is scarier than Meltdown/Spectre and i'm utterly amazed we haven't seen more disasters due to the simplicity of access and modifying these systems.
Scott
Organizations that blame their security issues on "morons" are unlikely to develop an effective security posture.
Re "Any data crossing between from internet to intranet should require red tape"
East Germany faced just that problem. One day a trusted member of staff walked out with a list of East Germany spies in other nations.
Before creating new trusted spy networks with new names something had to be done to prevent a list of spies ever walking out again.
Details about mission, the spy codename, the real identity got split up into very different physical files kept separated.
Nobody could every put the real name to the results of a mission without mountains of red tape to walk each file together and see a person's name linked to a mission.
East Germany then went digital.
Th East Germans thought it would be good to have a full list that could be accessed if spies had to be given new missions very quickly.
The CIA walked out with the list of all their spies.
The same was used for NSA compartmentalization until the political rush for private sector contractors resulted in walk outs.
The storing of some US gov/mil/contractors/workers information, clearance levels, past work, mission history, lifestyles in plain text on internet facing computers.
Political parties who have trusted staff walk unencrypted data to the waiting media.
So much is done to save time, for politics, for cost savings that later results in vast amounts of data walking.
No apps needed as everything is in plain text as thats how its been used everyday.
Domestic spying is now "Benign Information Gathering"