A Critical Security Flaw in Popular Industrial Software Put Power Plants At Risk (zdnet.com)

A severe vulnerability in a widely used industrial control software could have been used to disrupt and shut down power plants and other critical infrastructure. From a report: Researchers at security firm Tenable found the flaw in the popular Schneider Electric software, used across the manufacturing and power industries, which if exploited could have allowed a skilled attacker to attack systems on the network. It's the latest vulnerability that risks an attack to the core of any major plant's operations at a time when these systems have become a greater target in recent years. The report follows a recent warning, issued by the FBI and Homeland Security, from Russian hackers. The affected Schneider software, InduSoft Web Studio and InTouch Machine Edition, acts as middleware between industrial devices and their human operators. It's used to automate the various moving parts of a power plant or manufacturing unit, by keeping tabs on data collection sensors and control systems. But Tenable found that a bug in that central software could leave an entire plant exposed.

Comments

Re:expect more of these stories

[DontBeAMoran]

Systems should be able to tell the outside world about their current state, but they should not be able to be controlled from the outside.

In short, make those types of systems read-only.

Re:expect more of these stories

[dunnomattic]

I'm no Schneider expert, but I've worked with guys who are. While I agree with you on the explicit principle that externally-accessible systems should be read-only (or even better, receive data via internal system pushes instead of pulling data through whitelisted IP:port), I think there are two nuances here:

1. -The middleware itself can't be read-only since it is used to monitor/automate tens of thousands of individual sensors/valves/breakers per site, each of which has multiple registers involved in the monitoring/adjusting communication. If they were read-only, technicians would have to go through hundreds or thousands of steps just to test if one class of device is nominal.
2. -These critical systems should never be accessed by the outside world. I doubt that anyone who wanted to keep their job would knowingly expose these system interfaces publicly. However, with so many layers of software separating the outside attacker from the critical system, one of them will get the needle threaded at some point to hit the critical system. So now you've got an attacker facing a read/write industrial control system with the vulnerability to bypass authentication. The comm protocol specifications I've seen for these type of systems are well-documented, but they are extensive just due to the variety of devices they need to control. This won't be the last vulnerability in these industrial control systems. They should never be exposed by design.

...and yes, DeleteFacebook.