Slashdot Mirror

← Back to Stories (view on slashdot.org)

Ski Lift In Austria Left Control Panel Open On the Internet (bleepingcomputer.com)

Posted by msmash on from the of-course-they-did dept.

An anonymous reader writes: Officials from the city of Innsbruck in Austria have shut down a local ski lift after two security researchers found its control panel open wide on the Internet, and allowing anyone to take control of the ski lift's operational settings. There was no authentication in place, and anyone accessing the control panel could have modified the ski lift's speed, the distance between cable cars, and cable tension.

Coincidentally, researchers discovered the ski lift's control panel on the same day that NBC ran a report about a ski lift system suffering a mechanical malfunction, going at crazy speeds, and injuring 10 people. Both ski lifts were from the same vendor, but researchers say they weren't aware of the NBC report when they stumbled upon the one in Austria. Innsbruck officials shut down the ski lift for a security audit, and the ski lift is still nonoperational today.

34 of 59 comments (clear)

  1. Why does this need Internet by Anonymous Coward · · Score: 5, Insightful

    Can anyone explain why a ski lift could possibly need Internet-connected settings? What possible benefit is there to being able to control it if you aren't physically there to judge the operating conditions and environment, and to watch the customers?

    1. Re:Why does this need Internet by ELCouz · · Score: 1

      +1 Insightful! Why the fuck someone can control these critical parameters? What's next....Nuclear launch control over WAN?!

    2. Re:Why does this need Internet by iggymanz · · Score: 4, Interesting

      it pisses me off enough that at work we have faucets in the washroom that need the fucking batteries changed before they will dispense water. now young "engineers" think everything has to be internet connected too. fucking 'ooo shiny gadget toy' syndrome run amok

    3. Re:Why does this need Internet by Anonymous Coward · · Score: 2

      This is often done for vendor support purposes. If something goes wrong, you want the dummy operator to get help from a person who knows the system. Remote control access to heaters in business and government buildings is very widespread too, for the same reason. They just shouldn't be on the open internet, and the control panel should have built-in encryption and authentication, so that even if it is exposed to the internet, it can't be hijacked.

    4. Re:Why does this need Internet by Anonymous Coward · · Score: 1

      Dude, these are for-profit ski resorts. It costs extra to get a lift tech to drive out to solve a problem, particularly when the problem might be resolvable remotely.

      The reason why the lifts are not properly connected to the Internet is because even lift servicing companies are for-profit and like to save a buck.

      So, that and everyone's an idiot.

    5. Re:Why does this need Internet by Anonymous Coward · · Score: 1

      Touch free faucets serve a different purpose that internet connected things though. It's a sanitation improvement.

    6. Re:Why does this need Internet by iggymanz · · Score: 5, Insightful

      because faucets with foot pedal or that can be activated with elbow don't exist?

      it's a sanitation improvement when the thing doesn't work at all?

      get real anon, stop trying to defend the mental retardation

    7. Re:Why does this need Internet by war4peace · · Score: 5, Insightful

      It doesn't. It needs a network-connected web interface, but to most... let's say "not IT companies" such a ski resort, there's no difference. These companies have one network, usually wholly connected to the Internet, and that's it. Default security and whatnot.
      Why does this happen? Simple, really. They see IT as "the cheapest dude we could find to take care of the internet stuff". And so they hire that dude, which let's be honest, won't be someone who dropped $30K on classes and spent 5 years studying networking.

      One thing leads to another and voila, critical systems exposed to the Internet. Could be just a checkmark in config panel, such as "open CP to the Internet", which someone thought it would be a good idea. or a manager asking for it to see the default dashboard.

      --
      ...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
    8. Re:Why does this need Internet by vtcodger · · Score: 3, Funny

      So, the repair person flies to the nearest large city, drives a rental car 70km at 25kph through a raging blizzard, hangs out for 45 minutes while the ski area finds someone who can open up the ski rental area, finds skis and boots that don't fit too badly, slogs 500 meters through the ongoing blizzard to get to the control shed ... Only to find that someone has changed the standard password. ... and that there is no cellphone service available at the control shed.

      Sounds like a giant leap forward for mankind to me.

      --
      You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
    9. Re:Why does this need Internet by Anonymous Coward · · Score: 1

      I can see the reason behind it. For example, to control this from the managers room in the ski building a few hundred meters away. I imagine the critical controls (on/off) are always on both the top and bottom of the lift within easy reach. I agree it's a bad idea however. Even though doing security right isn't that hard, it is so often done wrong. captcha: develop

    10. Re:Why does this need Internet by msauve · · Score: 1

      Or the simple "push and water flows for 15 seconds" mechanical ones.

      Of course, you then stuck with one of the electric "blows germs around the room" or "needs batteries to give you towels" things to dry your hands.

      --
      "National Security is the chief cause of national insecurity." - Celine's First Law
    11. Re:Why does this need Internet by rogoshen1 · · Score: 1

      Or you know the boss/director guy saying he wants to be able to connect remotely from home, but doesn't know what a fucking VPN is. (which kind of dovetails into what you just said.)

    12. Re:Why does this need Internet by war4peace · · Score: 1

      Believe me they know what VPN is. They're just too lazy to use it.

      --
      ...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
    13. Re:Why does this need Internet by thegarbz · · Score: 1

      Can anyone explain why a ski lift could possibly need Internet-connected settings?

      Not internet connected: Remote settings. Just that remote in this case is likely on an unsecured network connected to the internet by idiots. Why would you need that? Ever notice a ski lift slows down if someone stumbles when getting on at the bottom, and also slows down when someone stumbles getting off at the top? Already you have two different locations you need to control a single system from. Guess what the *cheapest* way of doing that is.

      What possible benefit is there to being able to control it if you aren't physically there to judge the operating conditions and environment, and to watch the customers?

      Not everything is about control. Most of these systems are setup with remote access for data collection and equipment monitoring with control added in as a bonus for someone who needed an additional network based control.

      Some idiot likely ticked every checkbox and turned on everything.

    14. Re:Why does this need Internet by thegarbz · · Score: 1

      Or the simple "push and water flows for 15 seconds" mechanical ones.

      No that one simply is a retarded waste of water, incidentally there were banned in my city when we hit water restrictions 10 years ago.

    15. Re:Why does this need Internet by CaffeinatedBacon · · Score: 1

      It's LITERALLY the most ridiculous hyperbole EVER!

    16. Re:Why does this need Internet by bn-7bc · · Score: 1

      Well WAN is not a problem as long as the WANin question is isolated from public norwoeks (dark finer or at least a dedicated lambda). But if you use wan as a synonuym for Internet, I completly agree

    17. Re:Why does this need Internet by tlhIngan · · Score: 1

      because faucets with foot pedal or that can be activated with elbow don't exist?

      it's a sanitation improvement when the thing doesn't work at all?

      get real anon, stop trying to defend the mental retardation

      Foot pedal controls need installation of something into the floor. If it's mechanical, it means you need to run water to a valve on the floor then to the tap, which is a lot of plumbing. Then you need a shutoff valve so you can service the valve and taps as necessary without turning off building water supply, so it's either more stuff you bury in the floor (often concrete) or you're running pipes everywhere.

      Elbow valves are similar - people just don't want to touch them. They get very adept at kicking the valves. Germophobes can react very strangely.

      As for battery powered faucets, they are fine. If yours are constantly running out of battery, then the building manager needs to change them more often. They can last a surprisingly long time before the batteries actually need to be replaced even with near-constant use.

    18. Re:Why does this need Internet by iggymanz · · Score: 1

      No! for foot activated the valve can be in exactly the same place, only extra mechanical things are needed. and you're going to need another shutoff valve regardless of type of faucet, look under the sink in your home sometime!

      elbow activated valves are widely used, they've stood the test of time unlike malfunctioning battery operated valves which are not fine and always having problems.

      god, the level of mental retardation people have defending unnecessary tech is truly astounding.

    19. Re:Why does this need Internet by iggymanz · · Score: 1

      actually that "blow germs around the room" thing is a falsehood created by one of Dyson's competitors, they used sewage water on hands for testing to claim Dyson sprayed germs around the room. Soup cleaned hands being dried have a different result.

      The piles of waste paper in a bin from paper towel hand drying are more problematic.....

    20. Re:Why does this need Internet by iggymanz · · Score: 1

      hey don't deride those that fuck the sewer pipe and wonder why pathogens are causing them to have horrible diseases, it's not nice

    21. Re:Why does this need Internet by msauve · · Score: 1

      2018 study

      There's my authority, published Feb 2018. AFAIK, Dyson's aren't heated, and that study dealt with "hot air hand dryers." Doesn't make sense that it would be funded by a Dyson competitor.

      But feel free to provide your proof that the study was funded by a Dyson competitor.

      --
      "National Security is the chief cause of national insecurity." - Celine's First Law
    22. Re: Why does this need Internet by nnull · · Score: 1

      Many reasons. With the advent of more use with Ethernet/IP and Modbus/TCP, LAN communication is more convenient and much easier to control. Even I use it for my equipment and all the various software I made to communicate with said equipment. Of course I care about security and have this entire network isolated and separated. I don't trust any device manufacturer. Even my ABB speed drives for some reason want to talk an send data to the Internet, wtf ABB? Blocked

      Then comes the support. Many manufacturers or builders of these control panels give themselves remote access to these panel. They always request internet access if you want technical support. Of course none of these people give a crap about security on both sides, the person buying the equipment and the manufacturers providing the equipment. And this isn't chump change here, we're talking about equipment ranging from 100K to millions.

      You would be surprised how many power stations, manufacturing places, etc I've been at that have full access from the internet (wide open ports) to teamviewer installed on all their HMIs with the key and password fully visible if you walk by the station.

      I always get moron naysayers that this is not true when we have a public case of it right here.

    23. Re: Why does this need Internet by nnull · · Score: 1

      Anyone that knows about PLC controls and these systems, there is no tick box. This was just laziness. These ports were deliberately opened for technical support. This is more common in the industry than anyone thinks. None of these people give a damn about security.

      If they can't get the ports opened, download teamviewer on a pc with the required software, there you go.

    24. Re: Why does this need Internet by nnull · · Score: 1

      It's strange to me as a person that buys expensive equipment like this, that none of the manufacturers of this equipment take any precautions against this. They sell DIN rail mounted network switches with firewalls now. Most of them the size of the typical DIN rail mounted network switches. They will not spend the extra $600 to secure their internal stuff, even when the machine costs millions of dollars and they're getting great returns for selling it.

    25. Re: Why does this need Internet by nnull · · Score: 1

      Most places don't even hire the cheapest IT dude.

      They don't even hire IT at all, ever!

      Most places it's always a one time thing, they have the guy install the system and that's it, gone. Many places are like this. My neighbors place is still all Cisco 100M switches and connections done way back years ago. The firewall is probably just as old.

    26. Re: Why does this need Internet by thegarbz · · Score: 1

      Anyone that knows about PLC controls and these systems, there is no tick box.

      Errr who said anything about PLC controls and these systems? The tick box exercise is done entirely at the procurement stage where some project manager likely decreed they want everything, for flexibility of course and because it's cheaper to specify the most flexible solution up front rather than risk a late stage variation order. We can program PLCs and networks to do whatever customers want.

      This was just laziness.

      Nope. This was incompetence, an important distinction that applies regardless if these ports were there for some functional reason, maintenance reason, or otherwise.

  2. probably the tip of the iceberg. by pezpunk · · Score: 1

    great, now every time i get on a roller coaster, elevator, or subway train i'm just going to be wondering about whether there are online control systems for those things, and if i trust that company to properly secure it. it's a problem likely to become more widespread over time.

    --
    i could live a little longer in this prison
  3. They say by Tablizer · · Score: 4, Funny

    I hear it got infected by the S0nnyB0n0 virus.

    --
    Table-ized A.I.
    1. Re:They say by Anonymous Coward · · Score: 2, Funny

      I hear it got infected by the S0nnyB0n0 virus.

      Thanks for Cher-ing that.

    2. Re:They say by Tablizer · · Score: 1

      No problem, I got you, babe.

      --
      Table-ized A.I.
  4. If only APK hostfiles worked by Anonymous Coward · · Score: 1

    They could have protected themselves with APK's hosts files.

    But alas, that dumb bitch doesn't know how to sign software he expect you to run as administrator.

    ZIP - so much winning...

  5. That’s how they filmed by donstenk · · Score: 1

    Kingsmen!! The second one which was brilliant if odd.

    --
    Dennis Onstenk
  6. Insane by AndyKron · · Score: 1

    Why the hell does a ski lift control panel need to be online? Insane.