Slashdot Mirror
Attackers Drain CPU Power From Water Utility Plant In Cryptojacking Attack (eweek.com)
darthcamaro writes: Apparently YouTube isn't the only site that is draining CPU power with unauthorized cryptocurrency miners. A water utility provider in Europe is literally being drained of its CPU power via an cryptojacking attack that was undetected for three weeks. eWeek reports: "At this point, Radiflow's (the security firm that discovered the cryptocurrency mining malware) investigation indicates that the cryptocurrency mining malware was likely downloaded from a malicious advertising site. As such, the theory that Radiflow CTO Yehonatan Kfir has is that an operator at the water utility was able to open a web browser and clicked on an advertising link that led the mining code being installed on the system. The actual system that first got infected is what is known as a Human Machine Interface (HMI) to the SCADA network and it was running the Microsoft Windows XP operating system. Radiflow's CEO, Ilan Barda, noted that many SCADA environments still have Windows XP systems deployed as operators tend to be very slow to update their operating systems." Radiflow doesn't know how much Monero (XMR) cryptocurrency was mined by the malware, but a recent report from Cisco's Talos research group revealed that some of the top un-authorized cryptocurrency campaigns generate over a million dollars per year. The average system would generate nearly $200,000 per year.
If only there was some sort of readily available monitoring software to catch this sort of crap sooner than after 3 weeks.
CLI paste? paste.pr0.tips!
Come on. Don't run your operational systems on the internet, even if they need to be internet connected. Provide your employees with a separate system connected outside the LAN so that such issues are isolated. Another solution in non-sensitive areas is simply giving them Wi-Fi and access to their phones. All of these solutions present fewer problems than having employees on the operational system infecting the operational network.
hard to lockdown XP IE web apps. Hell they may need admin rights to run the day to day software.
As long as the cost of replacing all that software with something new (and probably a lot of hardware too in cases where the existing hardware can't support the new software) is higher than the estimated cost (to the business, not to society at large) that would arise should the worst happen, they wont replace it.
Heck, it may well be that there is no new software that can be used and they would need to not just replace the PCs but the gear they talk to (I doubt the companies that make that kind of gear would want to spend money upgrading software for old obsolete hardware so it can run on more modern systems, not when they have more modern hardware to sell you :)
That's why I stayed with Windows 2000.
According to the summary, web ads (why aren't those blocked?!) are suspect. Windows XP is mentioned, though, as it's to blame somehow. To me, XP (or any older OS) is the devil you know versus the devil you don't - you can plan for the devil you know. Don't assume XP is automatically worse because we haven't discovered everything about 10, etc. For the technically smug, look at the surprise of Meltdown and Spectre.
...From plugging in a serial cable. Desktop jockies don't understand such things.
As to why they aren't upgrading everything all the time, I work in water too, and like other such "invisible" industries, it is big and more complex than you may think. Since these sites must function, NO MATTER WHAT, screwing around with one that is working fine is discouraged since each new "project" requires much planning, thought, approval and budgeting.
In my younger days, in an instant, I brought down a medium-sized city's water supply just by plugging in a serial cable, the large pumps shutting down next to me. The controlling PLC's serial port powered pin #9 (not commonly done) as did the new radio transceiver that I just plugged in. "Did I do that?!!"
I was fortunate in that shutting pumps off ungracefully can cause severe "water hammer" on the main pipes underground - broken pipes sometimes result.
Can't we just illegalize monero?
Avantgarde Hebrew science fiction
I remember hearing the SCADA and industrial hacking news as far back as early 2000's from when I got into the tech world, and even then, always the same take-away: Why are these systems even accessible outside the intranet they exist on? I'd even take it a step further and wonder why there isn't much tamer form of a secured, air gap datacenter approach to this? Anyone who's done or worked with building automation systems or even went to a tech school for SCADA operation knows this shit doesn't have to exist and be set up that way.
I actually wondered what the hit-rate of SCADA attacks was, and I had no idea there was an online database of them that goes way back into the early 90's. And exposure to the internet is harder to hide from, shoot, most don't even have to try if they are using Shodan.
I think that's the real issue and always has been. That really-old-Windows-OS-and-the-word-crypto-buzzword phrasing is just a tech journalism shock-jock plug to lighten the heat from the real problem.
Seriously, stop connecting SCADA systems to computers running Windows. It really doesn't matter what you connect it to as long as it's not running an operating system that is well known for being vulnerable to attack!
Anons need not reply. Questions end with a question mark.
CPU power is not a liquid which can run out of a drain.
But hopefully with some advances in microfluidics it can be! ;)
Anons need not reply. Questions end with a question mark.
One of my brothers manages the local water facility, he bitched and complained about a system with win xp which was already eol until they finally replaced it with of course windows 7 a little over a year ago. They now have a little less than two years before win 7 extended support ends.
It is not being literally drained of its CPU power. CPU power is not a liquid which can run out of a drain. Asshole.
metaphor (noun): a figure of speech in which a term or phrase is applied to something to which it is not literally applicable in order to suggest a resemblance, as in “A mighty fortress is our God.”.
Or maybe your problem is not drained, but the use of literally.
literally (adverb): in effect; in substance; very nearly; virtually, as in "I literally died when she walked out on stage in that costume."
Seems simple to me. SCADA systems shouldn't be controllable over the internet, or by anything connected to the internet. For remote control used leased lines. Hardly anyone uses ISDN or leased 56k lines anymore, so there's an easy solution.
For monitoring, you can have an internet connected data logger wired into the SCADA system with a serial port. Even if someone manages to hack into the data logger, you can't take over the SCADA system if it's not designed to accept commands over serial.
I worked for a broadcast company that operated this way. The broadcast equipment could only be controlled by standing in front of the machine, or via a single hardwired remote terminal in the operations room that wans't connected to anything else. It spit out a bunch of system status data over a serial port to an network connected machine, but you couldn't control it that way.
My Other Computer Is A Data General Nova III.
Several APIs involving Queues and pipelining have a "drain" function call which clears it.
The dangers of excessive individualism are nothing compared to the oppressiveness of excessive collectivism
Someone had to do it.
Which is fine if the machines aren't yours and you don't have to pay for the power they use.
A single machine may generate a trivial amount, but there are many thousands of insecure machines out there. Add them all up and you've got a lucrative earner.
You don't even have to spend your own time collecting the machines, you can use automated scripts to scan for and infect machines.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
The modus operandi of privately owned utility companies: Socialize losses, privatize profit.
I'm a good cook. I'm a fantastic eater. - Steven Brust
It can actually be an appropriate metaphor, though it's not clear that it is being used in that way in this case.
One can say that a system can only provide so many computations, so if some application is consuming them to the detriment of other applications also trying to be computed, then it is appropriate to say the first application drained the system of it's power.
Or one can be talking about electrical power usage and figure that each computation consumes a certain amount of electrical power, so the application was draining the system of it's power (in this case the computer system is acting as a combination transformer and conduit).
So the headline could be appropriate. The summary, however, didn't seem to justify that particular use, and that jarred on me, also. But perhaps the original story *did* justify the use, so a harsh judgment is probably rather unwarranted.
I think we've pushed this "anyone can grow up to be president" thing too far.
If you don't have an air gap between your critical infrastructure equipment and the internet, then you're an idiot. Why was it possible to open a browser on these machines in the first place?
I've abandoned my search for truth; now I'm just looking for some useful delusions.
You also need to wait several years to amortize the cost of each GPU...
I've abandoned my search for truth; now I'm just looking for some useful delusions.
For piracy and to prevent used SCADA sales. They must be on the internet all day to re-activate themselves.
They also on purpose refuse to support anything after XP on purpose to force repurchases of perfectly good working systems with 7 support. So CFOs buckle and keep XP on instead as a firm of giving them the finger.
THen the I.T. guy gets blamed when they get hacked because the CFO doesn't want to pay the extortion to throw out a good SCADA controller because the vendor wants more money and you can't be used just to ensure the PC attached gets security updates. Ridiculous.
There are should be laws as this is part of infrastructure and something both China and RUssia know too well if they want to hurt another country.
http://saveie6.com/
The issue with Windows XP, or 7, or 10, is to disconnect these critical infrastructure maachines from the internet. If they are on the internet, then train users to not use a web browser on this critical machines. Upgrading the OS does not magically fix a poor security set up.