Slashdot Mirror
Norsk Hydro, One of the World's Largest Aluminum Producers, Switches To Manual Operations After Ransomware Infection (zdnet.com)
Norsk Hydro, one of the world's largest aluminum producers, said today it has "became victim of an extensive cyber-attack" that has crippled some of its infrastructure and forced it to switch to manual operations in some smelting locations. From a report: The cyber-attack was later identified as an infection with the LockerGoga ransomware strain, the company said during a press conference. News of the cyber-attack broke earlier this morning in a message the company sent to investors and stock exchanges. "Hydro became victim of an extensive cyber-attack in the early hours of Tuesday (CET), impacting operations in several of the company's business areas," the company said. "IT-systems in most business areas are impacted and Hydro is switching to manual operations as far as possible."
I have to wonder how many of these random malware infections of industrial machinery could be avoided by having all control systems running Linux.
Sure they could still be targeted by a dedicated hacker but at least you wouldn't have general mass-market malware accidentally get in and shut you down.
Maybe you could even use Wine to run existing control software and switch over today... I can't imagine the software they use is very sophisticated in terms of Windows API use.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
In my experience, lots of factories are running Win95... maybe Win2000 if you're lucky.
I know of PLC aggregation / communication software that literally only exists on Windows, simply because that's what many factories run.
The reason for that is because the first big wave of making "smart factories" was in the late 90s.
And factories, by and large, never replace anything unless it has been fully depreciated... and sometimes, not even then.
Within the last hour I've received a few emails from our overarching IT group indicating some people have clicked a link in a fake email going around. One of the user's accounts has been disabled.
Like you, we all receive yearly training on what type of emails not to open or click links in yet people still do it.
Here's the best part. This email was quarantined by default (Microsoft Exchange) and the user still went ahead and released it so they could read it.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Linux won't avoid this situation. The issue isn't OS, it's complacency.
I knew someone who ran a Linux video server on a hardened Red Hat system to monitor security cameras. He never gave it a second thought until his NOC called him at 3am on a Sunday to tell him they had pulled the network cable to his server because it was launching portscans against the rest of their network.
He did the post-mortem on the server and found the attacker got in through an old SSL vulnerability. He said it was a wake up call. Just because you are running Linux with non-essential services disabled, it's meaningless if you aren't applying security updates.
It is easier to build strong children than to repair broken men. -Frederick Douglass
it may not be sophisticated, but my guess is that their PCs have special hardware components and drivers to run their production equipment that are not available in WINE or linux or even Win7.
These boxes should have been on sneakernet, it's really the only solution for something this important yet this vulnerable.
If an experiment works, something has gone wrong.
I still need to maintain a bunch of AT computers on MSDOS that run some old pipetting robots. It's how it goes.
If an experiment works, something has gone wrong.