Slashdot Mirror


User: nnull

nnull's activity in the archive.

Stories
0
Comments
684
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 684

  1. Re: Is this unexpected? on PC Market Still Showing Few Signs of Life (axios.com) · · Score: 1

    The power users will still remain with PC. I donâ(TM)t think that is going to change. But for most people, an iPad is just more than enough for their eveday tasks.

  2. "I worked in a power plant and in this plant you do things right as I described or really, really bad things happen."

    It'll come, don't worry. Our utility company here, Edison, is already full of growing incompetence. I already have an undersized transformer that glows in the dark supplying my service. Edison laid off a lot of important people, people that I've actually had the pleasure to study their work because they're the ones that wrote the book on anything medium to high voltage stuff.

    "And to be honest if the situations you described could not be avoided with failsafes then it means that the engineer who designed that failsafes did not know what he was doing, which then falls in the case of the "incompetent engineer" I have described."

    And sadly, this is becoming more common. As demand for cheaper equipment grows and no over sight for worker safety anymore because of costs, this is just going to increase exponentially. We already have some great examples of some huge accidents, like Deep Horizon. Utility companies are not immune.

  3. And do what? Most inspectors don't have the knowledge to deal with this. Most inspectors will not ask what the hell the PLC is doing because they don't even know how a PLC works. Edison stole my transformer for my 4000Amp gear, reduced me to 2000kVA, so now I have a hot boiler outside. Utility commission doesn't care and the city is helpless about doing anything about it. Think NERC will be any different?

  4. Give it time, the incompetence will sweep through power plants soon when all the older guys retire just like the rest of the industry.

  5. I'd like to know what fantasy world you live in where I have competent people designing such systems all the time. My auto-tie baler destroyed itself because the physical limit switch failed, brand new by the way from a very reputable manufacturer. It should have never happened, but it did.

    If what you stated is true, I wouldn't have half the problems I have with quite a lot of manufacturers. Point being, not everything is so cut and dry as you state and there are a whole lot of incompetent people building equipment now (Not including incompetent contractors). And yes, there is equipment being sold in the million dollar and up range that have such problems, especially if you're buying from Asia. Not saying there isn't well designed equipment, but a good chunk of designers are now negating common sense.

    Will machines explode? In most cases, probably not, but anyone with nefarious purposes could easily damage equipment that costs quite a lot of money to repair. But I think the more likely scenario are hackers locking out equipment for money. However, speaking of explosions, I can name you a couple companies that deal with Ethylene Oxide with some of the lousiest safety practices you could imagine. Any hacker could easily cause these plants to explode as their safety lockouts is a button that signals a PLC to open a gate and keep another gate from opening to keep the LEL below 3% (One of them already blew up because a maintenance guy bypassed safety procedures by modifying the PLC). Open the gate at the wrong time and you end up going over the LEL and boom.

  6. I don't know. But go to anyone hosting conferences for Siemens, Rockwell, etc. The big talk is about having things controlled with your smartphone app and being able to upload changes while sitting on a beach. Try to mention anything about the dangers of such a system and you get talked down too.

  7. Re:HAS SCIENCE GONE TOO FAR??? on Hackers Could Blow Up Factories Using Smartphone Apps (technologyreview.com) · · Score: 2

    There are going to be far more connecting industrial equipment. Data acquisition is a big factor in this, which I don't see a problem with. Interconnecting multiple pieces of equipment to form one line is another. However, lately there is a big push by big name companies like Siemens pushing remote access to your equipment from the beach and being able to "fix" mistakes from said beach. All the Siemens engineers are quite proud of this feature at these conferences, that you can change the functionality of an equipment thousands of miles away without even knowing what the hell it's doing physically, like maybe squishing one of those poor workers that's around it. I find that more concerning than worrying about someone trying to blow up a plant.

  8. Re:no setpoint access / they won't trust you on Hackers Could Blow Up Factories Using Smartphone Apps (technologyreview.com) · · Score: 2

    Or you can just get the Teamviewer ID and password because the vast majority of tech support by major machine manufacturers and/or integrators use Teamviewer and a vast majority of them use the same password.

  9. Re:Exploit them on Hackers Could Blow Up Factories Using Smartphone Apps (technologyreview.com) · · Score: 1

    Unfortunately, there is still too little people interested in exploiting such companies. I'm pretty sure it will come. Crypt locking machines seems like it could be a very lucrative business.

  10. Re:oh no! you stopped the conveyor line~ on Hackers Could Blow Up Factories Using Smartphone Apps (technologyreview.com) · · Score: 3, Insightful

    For more automated plants, shutting down anything can be quite catastrophic. Bottling lines, injection molders, cnc shops. How are they going to do all this stuff manually? And sabotaging steel mills has absolutely disastrous consequences. All this can cost millions for even just a couple days down time. I know in my plant, I would have to basically send everyone home as there would be nothing for anyone to do. Doing things manually is no longer an option in many places.

  11. Re:Here's something to worry about on Hackers Could Blow Up Factories Using Smartphone Apps (technologyreview.com) · · Score: 1

    The sabotages are already happening. It doesn't get reported. I've already witnessed it at customer plants. It's going to get worse. Siemens and Allen Bradley are by far the worst in security. And of course, everyone now has to load teamviewer on every HMI with a static password and ID to offer support, to punch through firewalls.

  12. Still waiting for other linux distributions to issue a patch. As of this moment, Arch latest is still 4.14.11-1 and is still not patched from the looks of it?

    https://security.archlinux.org...

  13. Re:In all fairness... on 'Kernel Memory Leaking' Intel Processor Design Flaw Forces Linux, Windows Redesign (theregister.co.uk) · · Score: 3, Interesting

    This, I don't completely understand the reasoning for crippling all processors, including non-intel. It seems Intel is trying to use its political clout to reduce everyone's performance with a bunch of fear and scare tactics which just tops the charts for 2017 and 2018, just so they don't lose their edge. This is just an utter catastrophe for Intel and they're trying to drag the rest of us with them.

  14. Re:Is the Rust community still toxic like I found on Rust Blog Touts 'What We Achieved' in 2017 (rust-lang.org) · · Score: 1

    I'll stick to Python. It equally hates everyone.

  15. Re:Is the Rust community still toxic like I found on Rust Blog Touts 'What We Achieved' in 2017 (rust-lang.org) · · Score: 1

    It's mind blowing how such a community can even exist and function, but yet it does. I better watch what I say, I might offend someone and the dogma police will come after me.

  16. Re:From cardboard to plastic... on Amazon Tries To Figure Out the Packaging Box Problem It Created (t.co) · · Score: 5, Informative

    I'm sure this is more than reducing shipping costs for Amazon. Yes, it does reduce the costs for Amazon overall. Plastic is unfortunately much cheaper and more durable than paper. Plastic packaging machines are much cheaper over all, easier to control and for the most part, less error prone. The various quality issues has forced me to move away from paper packaging, too much moisture cause it to curl and the machine jamming up all the time, waste of time. Paper might be more environmentally friendly, but in the manufacturing world, paper is not being cost friendly at all lately due to various QC issues at paper mills and box plants lately (If you buy paper containers, you know what I'm talking about).

    And then the bouncing up and down costs of packaging is just insane. It makes it difficult to plan long term when GP, IP or the other big mills decide to raise the prices dramatically for no reason at all (They've done so multiple times this year already). Then you have Asia wanting to dump their shit paper products onto the US market that somehow winds up in container manufacturers that used to be good. There's a whole lot of shit that's going on in the paper world that you're just not aware of.

    I can see why Amazon wants to move away from it too.

  17. Re:Packaging... on Amazon Tries To Figure Out the Packaging Box Problem It Created (t.co) · · Score: 5, Informative

    Well, the good thing is, Amazon seems to have no problem replacing your product. I've already had Amazon ship me free stuff when my package was a week late, and when it does arrive, they don't want it back. Their customer service is excellent so I don't see why they can't experiment a little with the good coverage that they have.

  18. Re:Ubuntu Phone? on Ask Slashdot: Are There Any Alternatives To Android Or iOS? · · Score: 1

    Wow, thanks for that. I was disappointed when Ubuntu killed the project, I'm glad the volunteers have continued it. It's not a bad platform and it could be built to be a great alternative platform.

  19. Re:Custom Android ROM on Ask Slashdot: Are There Any Alternatives To Android Or iOS? · · Score: 1

    I still don't understand how Ubuntu Mobile failed. It was an opensource project with a lot of interested developers and interest in the system. I quite enjoyed it. They just shut down the whole thing and told everyone to basically "fuck off". It's failure was the lack of production phones and seriously bad business decisions (Seriously, no one could buy the phone), not that it wasn't a good platform. This is what happens when you have a single entity control of a platform.

  20. Re:Good! Let the trolls leave on Twitter Rolls Out Stricter Rules On Abusive Content (apnews.com) · · Score: 1

    Right, just ostracize the very people that made them popular. Already seen plenty of companies that have tried to do the same only to become relics of the past. Good bye Twitter and good luck to the new next replacement! And all the people blabbing about the "rubbish" on twitter are just going to twirl around in a dead social medium like the others before it, because, guess what? People don't want filtered content despite complaining about the trolls and trash. They want to moderate or be at least able to contain it, but censorship and filtering is not the answer.

    And seeing how Youtube is reacting to all this, they're not just filtering bad content, they're just filtering everything they feel like.

  21. Wow there tiger. All systems need some kind of ethernet / IP link for communication, even if it's just for the initial config. "Remote" is hardly considered "across the internet" In most cases where the vendors advertise "remote" they basically mean no longer dragging a laptop to the device to plug into the serial port on the front.

    Remote configuration is a must, just that "remote" in this case is from 2 rooms away via a closed network.

    This is generally true and I understand the intentions of what the devices makers are trying to accomplish and I do use it with my own secured network (Yes I love it). And yes, there are manufacturers that are advertising "Remote access" via the Internet. I've already attended seminars by great big Siemens where their whole excitement is, you guessed it, remote access to your machine or internal devices from your phone! Oh how wonderful!

    But all over the world, this gets way abused to hell. Remote access now means some guy wants to login to my machine from across the world and diddle with it without even knowing what's going on. Too many equipment manufacturers I've seen abusing this. I'm already seeing remote reprogramming of Safety PLC's on gas fired equipment (Excellent solution to the whole liability problem if the equipment blows up, you can deny everything). I've even had a Siemens rep request I install remote controlled circuit breakers, just in case he needs to turn my machine on and off (This was my last time I ever wanted to deal with anything Siemens after that conversation).

    Yes, it's the owners problem, but truthfully, this is just getting out of hand here. Stuff that shouldn't be happening, is happening. Good engineering practices isn't happening, general good safety practices isn't happening and network security is just one big joke. Oh, you have a firewall? No problem, let me install TeamViewer here on your Beckhoff PLC (Or whatever Windows embedded based PLC). So I can just punch through your firewall settings, tee hee hee

    Read my second reply to myself. In this case it turns out the attack was purely on the engineering station which was multi-homed to a network for remote desktop purposes, and the system was left permanently in program mode (which is idiotic). You're right in any case, I got my IEC standards confused, 61508 applies to vendors, 61511 applying to process industry end users is the one which has requirements for control of authority for changes to systems. All 61508 does is require access control to be considered during the risk assessment phase.

    So I was correct in my assessment that this was being remotely operated via the Internet. Really no surprise. No doubt that it was the field tech. No, this is not the device manufacturers fault, this is quite indeed the customers fault for being complete idiots. But device manufacturers could definitely do a lot more here.

    My personal favourite is seeing a TUV certificate for a well known US based vendor's valve actuator listing a reliability of 2 FITS. That's only about 3 orders of magnitude better than generally expected experience in the industry. I agree a TUV certificate these days isn't worth the paper its printed on ... right until you get caught without one :-) The certification industry is a bit of a farce.

    It's going to get worse.

  22. I agree, this is an SIS system, there is no reason to require remote access to any of these devices or my fancy talk of apps, but YET THEY DO! Just look at Phoenix Contact, they offer bluetooth, NFS, and online connectivity, for what? ABB with their speed drives offer complete connectivity with the drive and changing parameters for their safety cards and they advertise it openly with remote access! Then you have all these brand new safety devices that have ethernet/IP or Profinet, with complete full access to the device. I think even ABB's programmable safety devices now have an app? This is happening right now with little care for what might happen, all because of convenience and sales, because X has this and Y doesn't.

    Are these things convenient? Yeah, ethernet is quite convenient when designing a panel, but this is where Engineering practices come into play with some thought put into network security. I do love ethernet, because no longer do I have to pull 50 wires through out a control panel. But there is definitely a lot of people not considering any security issues over this.

    I doubt they will lose any certifications over this. There is nothing in either the IEC standard, UL or NFPA standards against this. All there is, is some blurb about "Risk Assessment" when using or designing these safety devices. I definitely know UL won't do anything, knowing how they work and TUV Germany (Not TUV US) might do something, maybe. Their self certification CE mark in the EU is not threatened as they more than likely complied with all the standards available. All you might find in these standards is that you must prevent changes on these devices. It doesn't say how you need to do that and anyone doing it maliciously doesn't mean you haven't complied with the said standard. I know there is some sway with risk assessment requirements in the EU, but not so much in the US.

    But, if they actually cared, we wouldn't be flooded with Chinese made devices with certifications. Even CHNT has certifications up the wazoo, contactors, breakers, relays that cost less than $10 (When they normally cost over $100) with all the certifications you could imagine, all of them legitimate. They meet the bare minimum and that's all they care about.

  23. Re:Don’t worry on Attackers Deploy 'Triton' Malware Against Industrial Safety Equipment (securityweek.com) · · Score: 3, Informative

    It's not like you have to do much. Most of these manufacturers don't care about security, because it's additional costs. You'd be surprised how many machines out there are just openly connected to the internet, because ooo wow, we made a phone app so you can see how your production is going, but you have to open port xxx on your firewall. When I tell these guys no, they all go into a fury and try to talk down to me like a child (At least most American machine manufacturers do).

    When I ask for encryption and security precautions from manufacturers, they just look at me funny and think I'm crazy. If you think I'm joking, just scan through a bunch of IP's and enjoy how many high tech equipment is just out there in the open where you can just completely obliterate someones manufacturing process. It's not like it hasn't happened before, you know. Knowledge of SCADA systems? What the hell for? Most of these idiots run some unsecured remote access, so you can easily press buttons like you're there. My favorite latest thing these guys do now is install TeamViewer on these machines (Free version of course, surprised TeamViewer hasn't gone after these people for using it for commercial use, big name manufacturers too that I can easily name), with some social engineering, you can easily get the Teamviewer ID and password. Nobody ever changes it, like, ever. These are "Professionals" doing this on a daily basis by the way.

    What I quite hate is how after these places get hacked, they claim the hacker is some sort of genius, that meticulously planned this attack, when all he did was login to the PLC or some Windows based Operator console and messed with the whole thing.

  24. And what good is that going to do for us? Phone companies have been posting this crap all the time and no one even knows what the hell it means anymore. They'll just do the same thing.

    The market does need to take care of this problem, but the cities, states and the Feds need to stop protecting these ISP's and stop giving them exclusive rights to X area then, so real actual competition can happen. We wouldn't need net neutrality if these ISP's didn't have exclusive rights, allowing legal monopolies.

  25. Could you provide evidence that this is happening? Otherwise, you're full of shit.