Slashdot Mirror
A Critical Security Flaw in Popular Industrial Software Put Power Plants At Risk (zdnet.com)
A severe vulnerability in a widely used industrial control software could have been used to disrupt and shut down power plants and other critical infrastructure. From a report: Researchers at security firm Tenable found the flaw in the popular Schneider Electric software, used across the manufacturing and power industries, which if exploited could have allowed a skilled attacker to attack systems on the network. It's the latest vulnerability that risks an attack to the core of any major plant's operations at a time when these systems have become a greater target in recent years. The report follows a recent warning, issued by the FBI and Homeland Security, from Russian hackers. The affected Schneider software, InduSoft Web Studio and InTouch Machine Edition, acts as middleware between industrial devices and their human operators. It's used to automate the various moving parts of a power plant or manufacturing unit, by keeping tabs on data collection sensors and control systems. But Tenable found that a bug in that central software could leave an entire plant exposed.
A severe vulnerability in a widely used industrial control software? Go figure. Good thing we don't connect those systems on the internet. Oh, wait...
Somebody make a useless law to protect these systems! Stat!
as the manufacturing world connects more and more things to the Internet. This is driven by MBA managers who want to be able to access fancy dashboards from their head offices miles away from the plants. The major marketing push currently going on in the manufacturing world is the IIOT (Industrial Internet of things) and is driven by greedy companies who are taking advantage of middle to upper management's lack of knowledge to sell them on fancy gizmos and gadgets with out actually explaining the potential consequences. When combined with the race to the bottom for cost of I.T in manufacturing, this is a catastrophe just waiting to happen.
We have already seen examples recently of ski lifts but this was already a problem with remote desktops and all you have to do is search for defcon talks to see hundreds of examples. The only difference is that now the access is baked right into the control software and black hats dont need to worry about looking for vulnerable remote desktops.
That's it, there is no other news. Exploit found, manufacturer fixed in a timely manner. I would say that whatever ad-hoc system that is in place for identifying software vulnerabilities, whether it's a reward or just the coolness factor of having one's name in an article, seems to be working. I did like the picture of the Nuke plant in the article though. I am making a wild guess that any software running internally in a nuclear plant is not accessible from outside, not even through a firewall. But I could be wrong. Think Homer Simpson.
1. Don't put any control hardware on the internet. Air-gap everything. This is already best practice. For monitoring, do an RS-232 link to an internet-connected machine, from an embedded machine with no network stack.
2. Lock down the machines running the control software. Physically isolate the machines. Make the web-based client machines thin clients running a locked-down browser.
3. Lock down the control network. Use MAC filtering and IP authentication, which I believe is part of the industrial IP standard.
Schneider makes the APC UPS line. Monitoring software uses a USB connection. Hopefully similar bug isn't present in that.
It's ok we have a no homers rule at our plant
... aren't the only hackers in the world.
Fix it by all means - but not every security risk should be used as a "Two Minutes of Hate" sort of drill.
Have gnu, will travel.
But Kanye needed a tax cut yo! Shithole cuntry is falling apart, BIGLY.
Slashdot on Facebook uses an automated 'bot in its messenger system. Who points the finger at the finger pointer?
I figured that I would chime in here, since I've worked on these types of systems, and in this type of environment for nearly 30 years.
It is common to see these types of alerts for all kinds of HMI software, PLC's, and DCS's. They all have security vulnerabilities discovered, just like any software-based systems do. In the electric utility environment in the US, these systems fall under NERC CIP regulations. There will be someone at the utility tasked with keeping track of these alerts and making sure that systems are patched. For really old systems, they will be planning upgrades.
These Industrial Controls Systems (ICS) will be firewalled from the business networks, which will again be firewalled from the Internet. It is common to have a data historian pushing data out of the secured ICS network onto a system on the business networks. This allows managers, engineers, and anyone else who needs the data for analysis and reporting to do so without having to be inside the plant. These days it is common to have a mechanical engineer working on something from across the country through these historian systems.
The firewalled connection pushing the data out of the network may just be a connection between two servers over a particular TCP port that must be initiated from inside the ICS network as an example of the simplest, and probably the most common example. It is more common these days for the data to be pushed to a DMZ server, which then passes it to the business system, making it even more secure. It is also common to use a data diode, where there is only a fiber optic transmitter on the inside and a receiver on the outside, so you can't even physically pass a signal into the ICS network.
I'm not an expert in these particular Schneider systems, but the alert seems to be for HMI software used in the control room to operate the equipment. These systems would be on the firewalled ICS network and not exposed to the business network, so it is unlikely that someone would be able to access them from the company's business network, much less the Internet.
Security of these ICS networks is taken pretty seriously, and the visibility and attention to security have increased greatly in the last ten years. It certainly isn't as far along as it could be, but the ominous picture of cooling towers, which most people equate to nuclear plants, although they are common in large coal units as well, makes this look much worse than it probably is. I can assure you that there are none of these Schneider systems connected to the Internet controlling a nuclear reactor anywhere.
I'm not trying to paint a rosy picture here, merely suggesting that in all probability there will be some engineers patching some firewalled HMI systems in the coming weeks, while they continue to beef up the security at their plants, and not a nuclear meltdown as some script kiddie exploits this hole in a nuclear control system sitting on the Internet with this hole in it.
do not connect safety systems to external networks.
do not connect safety systems to external networks.
do not connect safety systems to external networks.
Every time I see "a software" it irks me. Seems ignorant to say things like "I have three softwares!". It's not enumerable.
Software is like knowledge - you don't talk of having "three knowledges", for example. It encompasses all you know, just as "software" encompasses all the programs on your machine. It can be qualified: "operating system software", like "software development knowledge", but not counted.
Have they ever considered not connecting their industrial plant directly to the Internet.
I am an industrial engineer, and I have significant international experience consulting on - you guessed it - physical and cybersecurity for power plants and other critical infrastructure.
The amount of fucks that most of the owners and financiers gives is basically zero. Unless there is a regulation (with teeth) that prohibits or requires something, they won't spend one centavo. While some plant managers or equivalent might be stupid or ignorant, the people with real power and oversight almost always know that having a SCADA system that will only run on a narrow patch range of an antique operating system hooked up directly to the Internet is a terrible idea. The problem is, when high power consultants come in and tell them what it's actually going to cost to modernize, they shit their pants.
Technological debt is real debt.