Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Stuxnet Worm Infected Industrial Control Systems

Soulskill posted more than 4 years ago | from the going-for-the-gusto dept.

Worms 167

Sooner Boomer writes "ComputerWorld has an article about the Stuxnet worm, which was apparently designed to steal industrial secrets and disrupt operations at industrial plants, according to Siemens. 'Stuxnet has infected systems in the UK, North America and Korea, however the largest number of infections, by far, have been in Iran. Once installed on a PC, Stuxnet uses Siemens' default passwords to seek out and try to gain access to systems that run the WinCC and PCS 7 programs — so-called PLC (programmable logic controller) programs that are used to manage large-scale industrial systems on factory floors and in military installations and chemical and power plants.' If the worm were to be used to disrupt systems at any of those locations, the results could be devastating."

Sorry! There are no comments related to the filter you selected.

Suxnet (-1, Flamebait)

Ethanol-fueled (1125189) | more than 4 years ago | (#33615870)

Obvious American intelligence tool. Why is it in North American plants? So they can cause accidents for fearmongering and to further their agenda.

Re:Suxnet (5, Interesting)

Wyatt Earp (1029) | more than 4 years ago | (#33615914)

Israel, not American.

Israel has always been an industrial spy on the US and Western Europe, but their big focus is Iran right now, so they test it on the US, UK and Korea but the main focus is Iran.

Wouldn't be surprised to find it in Saudi systems too

Re:Suxnet (0)

Anonymous Coward | more than 4 years ago | (#33616072)

Whatever, you paranoid delusional douche.

Re:Suxnet (2, Funny)

formfeed (703859) | more than 4 years ago | (#33616324)

Obvious American intelligence tool. Why is it in North American plants?

Because Major Carter found the worm, and last night she reformated all American PCs.
She's quite good, you know. I've seen it.

"however the largest number of infections, by far" (1)

Jeremiah Cornelius (137) | more than 4 years ago | (#33617142)

"however the largest number of infections, by far, have been in Iran"

Can we even take that statement at face value? Who in Iran is reporting these? Has a "Command and Control" hub for the botnet been captured?

Is the traffic analysis - up in the layer-4 part of the packet - so good that this has been observed in transit?

Disinformation has wheels within wheels, my friends.

Cue the conspiracy theories (1)

leromarinvit (1462031) | more than 4 years ago | (#33615878)

So the largest number of infections have been in Iran. It is designed to disrupt industrial processes, which are also used by the military.

Obviously it was created by the CIA in an effort to spoil the Iranian nuclear program!

deserved (4, Insightful)

Anonymous Coward | more than 4 years ago | (#33615894)

If they still use default password, they deserve to be hacked and face total havoc.

Industry`s security is still so crappy.

Re:deserved (0)

Anonymous Coward | more than 4 years ago | (#33616158)

what do you do about the shadow password exploit? it keeps resetting to default passwords. until that bug is fixed they can't be blamed for using default passwords. my advice is to set up a dupe sign in thread that detects an automatically changes the password back to the certified tech's immediately once the sign in is detecting a bogus login.

Re:deserved (0)

Anonymous Coward | more than 4 years ago | (#33616688)

well said. this is the two-thousand & tens ffs. your using default seimens passwords on your infrastructure... you are a lesson to others. go stuxnet

Re:deserved (5, Informative)

thegarbz (1787294) | more than 4 years ago | (#33616792)

If they still use default password,

Having experience with a few of these systems from various vendors I say it would be great to have a choice in the matter. The is a lot of investment in the configuration of a large logic controller and vendors often provide themselves a back door such as a hidden admin password to come in and fix things when the system goes tits up. On top of that they often recommend not changing the default passwords of systems that are hooked directly to process control because the machines themselves are often under lock and key and behind firewalls and thus presumed to be "safe".

We were infected with the Stuxnet worm at our plant, and it spread all around the machines on the business network but never made it to the process control systems. Although it was still disruptive. The firewall was shutdown and the control network isolated for days so they could do a complete virus scan. A little network management and physical security can go a long way. Frankly if any virus gets onto the process machines, default password or not, and not even targeting the software for the control systems there's potential for a real "game over" event.

Re:deserved (2, Informative)

Anonymous Coward | more than 4 years ago | (#33617190)

This.

I can confirm the existence of at least one such backdoor. I did tech support for a company that sold cellular connectivity devices through which automation systems could report to a remote server, or be remotely administered.

It was just a Busybox machine with a bunch of services, but we had an insecured telnet (as in, port 23, ALL PLAINTEXT) master login that gave root privileges, and we used it for advanced troubleshooting. It was the same user account for all products across all firmware, and even though we never shared it with the customers, anyone calling us to help them do the initial configuration over Ethernet could've set up a packet sniffer and got it.

Military and police customers tended to use private networks (thankfully) but I'd estimate 90% of those devices were directly facing the internet, including many used for the administration of governmental utilities. In the wrong hands, this not only provided access to all the transmitted data, but was a non-noticeable attack vector on all the equipment on the LAN, since those tend to not have intrusion detection systems.

Wow (5, Interesting)

0123456 (636235) | more than 4 years ago | (#33615908)

So people not only leave the default password on their industrial controllers, they put them on the same network as Windows PCs... Wow.

Re:Wow (0, Redundant)

DarkKnightRadick (268025) | more than 4 years ago | (#33615928)

no kidding, that was my first thought.

Re:Wow (1, Insightful)

Anonymous Coward | more than 4 years ago | (#33616048)

you seriously do not want to know how common it is.

Scary common... On things that would disrupt major cities...

Re:Wow (2, Informative)

DarkKnightRadick (268025) | more than 4 years ago | (#33616190)

Stop. The more I know the more I want to scream.

Re:Wow (0)

Anonymous Coward | more than 4 years ago | (#33617284)

Want even more scary? Even *IF* they bothered to set the passwords on these controllers. The passwords are easily sniffed using a man in the middle attack (done it a couple of times myself for 'forgotten passwords'). They literally transmit the password in the clear over the serial/network cables using industry standard control codes.

The passwords are nothing more than a way for each company to sell sdk's to companies so you can only use their software with them. They give 0 security.

Some of these sites are stupid easy to get into with a little social engineering. As many of the people who work there dont even know the thing exists. So you show up look all official with a clipboard and a 'work order' and a hard hat. Many times they would just let you in.

That there has not been a major incident yet with this stuff is what I find shocking about it.

Re:Wow (1)

pspahn (1175617) | more than 4 years ago | (#33616322)

And people wonder why the NSA and is trying to promote education [nsa.gov] .

Of course, it's damned if you do, damned if you don't. Sure, they're a bureaucracy, and therefore inefficient (or whatever you want to call it). If they do nothing, then it's their fault for not doing anything. If they do something, they get ridiculed for doing it wrong (even if it's an improvement).

We all know there is an insane amount of holes in all sorts of industries, yet it hardly appears as what is currently being done is enough. People tend to be all hat and no cattle. It's nice to walk around and talk about how bad the problem is, but it's better to actually do something about it.

Re:Wow (3, Informative)

DNS-and-BIND (461968) | more than 4 years ago | (#33616300)

You do know that factories are staffed by engineers and workers, not IT pros? I doubt if they're even aware that passwords exist on their equipment. When they set up the factory, they just called some people to get all the machines to talk to the computers properly. Then, the contract is finished and the IT people only get a call if there's anything wrong or new equipment is added.

Re:Wow (4, Insightful)

denobug (753200) | more than 4 years ago | (#33616542)

Our past experience indicate the IT staff does more damage to the stability of the system than anything else could. Most IT and network personnel has zero understanding of reliability of a system. The architecture they design are simply too complex and not robust enough. So before anybody can hack in, the system itself becomes unstable, crashed, and end up causing dangerous situation.

One of the most common mistake observed is a super complicated VLAN scheme that link multiple network together under the name of "ease of management" or "security", while in fact the first thing they need to do is to completely seperate the control network with corporate network, and then flatten the control network with air-gap from the corporate network. Also make sure you have zero wireless network access to the control network would be a wise choice not only in security but also improves each component's availability in general.

Again, common sense goes a very long way.

Re:Wow (0, Redundant)

DarkKnightRadick (268025) | more than 4 years ago | (#33616678)

so true

Re:Wow (4, Insightful)

networkBoy (774728) | more than 4 years ago | (#33616736)

This is manifested in the door security where I work.
We have RFID badge readers.
My boss recently wanted to add one to a lab he controls. When he found out the bill was $10K he balked. We told him it was for the security conduit (intrusion detection conduit, I assume gas charged & detect pressure drop in a leg?).
His response? We don't need the conduit, just run the wire.

Luckily security said F off and use a key lock, we're not installing it without the conduit. But that same attitude is why these machines still have the default passwords.

-nB

Re:Wow (0)

Anonymous Coward | more than 4 years ago | (#33617408)

Posting as AC because work knows of my slashdot ID.

Amen, brother, amen. I deal with crap just like this every working day.

I disagree on the wireless part, it's just to handy in physically large / large PLC count installations. What's needed is a BSD-based AP on the control network(s) with PKI and strict physical control of the troubleshooter's machines: they shall never leave the facility, they shall never connect to anything but the control network, they shall be audited regularly and randomly, they shall never, ever be touched by regular corporate IT.

If anyone ever has success at this, do let the rest of us control engineering types know how you did it. Technical specs and what manner of blackmail used ;)

Re:Wow (3, Informative)

Lunoria (1496339) | more than 4 years ago | (#33615944)

People are lazy. Why change the password on these machines? You'd have to write it down somewhere because remembering things is tough.

Re:Wow (4, Interesting)

Jurily (900488) | more than 4 years ago | (#33616294)

People are lazy. Why change the password on these machines? You'd have to write it down somewhere because remembering things is tough.

I blame management. With all the chaos around a factory (at least the ones I've worked in), the default password is more reliable than the people who are supposed to know them when they're needed.

Add in the fact that factory workers don't really get paid enough to care about anything, and you have to start wondering why this this kind of attack isn't more common. Hell, we've played Minesweeper on the monitoring terminal of a >$100M production line :)

Re:Wow (1)

CannonballHead (842625) | more than 4 years ago | (#33616484)

Clearly, minesweeper is a big security hole. ;)

Re:Wow (2, Insightful)

Anonymous Coward | more than 4 years ago | (#33616524)

The OS it runs on is.

Re:Wow (2, Funny)

aggemam (641831) | more than 4 years ago | (#33617280)

Re:Wow (4, Insightful)

gmuslera (3436) | more than 4 years ago | (#33615952)

Probably the network is behind a firewall, so they think they are safe from outsiders. The problem is when insiders have both windows and no clue.

Re:Wow (4, Interesting)

hairyfeet (841228) | more than 4 years ago | (#33616256)

The real problem is NOT the OS, since it is pretty obvious this attack has been specifically designed to hit a very small niche target, which means no matter what OS you were running the malware writers would have simply written to that target.

No the problem is something I run into all the time in my little shop, I call it magical thinking. It is the classic "we have A, therefor we never have to worry about security!" problem. in this case too many are thinking their firewall will magically make the problems go away, not realizing the user is often the weak spot. I've seen the exact same thing at a SMB where the owner had bought Macs based on magical thinking, then his kid wanting to look at pron ended up infecting the network with that DNS Changer trojan.

The problem as we are witnessing here is there is NO magic bullet, be it Windows, OSX, or Linux, be it a firewall or other piece of hardware, be it any other piece of tech. The ONLY way to secure a network is a top to bottom approach that runs everything on absolute least permissions and no network access to anything that doesn't absolutely need it. But sadly that takes real planning, real effort, and a dedication to keeping the security level up, and most companies would rather buy into "this magic box will save us!" because it is cheaper and easier. Sadly it also never works.

Re:Wow (1)

pspahn (1175617) | more than 4 years ago | (#33616392)

Sadly it also never works.

Sure it works, and in fact does so for a bunch of people. That's why there is truth to security through obscurity, because if someone doesn't know about your system and isn't interested in targeting it, you can keep out all the script kiddies by boilerplating security.

Remember, it isn't necessarily about securing the information absolutely, it's about taking realistic measures to adopt a policy that works and provides an acceptable amount of risk.

Think of a small copy-print shop, for example. Customers might come in and use computers to run prints of some document that contains sensitive information (or whatever). They open it off their thumb drive or email or something, and then print off a dozen copies. Is the shop owner going to go to the trouble of making sure all the customer computer's hard drives don't contain forensically traceable remnants of that document? Of course not, this is a highly unlikely scenario.

Of course, running a system with default passwords is kind of silly in the type of environment described in TFA.

Re:Wow (1)

RightwingNutjob (1302813) | more than 4 years ago | (#33616434)

Yeah, but we're talking about industrial controllers here, not a small copy shop. At where I work, the standing policy is that if it controls a piece of moving machinery, it's behind an air gap. No exceptions. It doesn't prevent malicious individuals with physical access to the system from doing bad things, but it takes away a whole set of headaches about network security out of the picture entirely.

do any industrial controller have online drm? (1)

Joe The Dragon (967727) | more than 4 years ago | (#33616578)

do any industrial controller / software have online drm systems?

Re:do any industrial controller have online drm? (2, Informative)

networkBoy (774728) | more than 4 years ago | (#33616818)

yes.
Our CNC uses an on-line DRM.
We have it on its own network behind a proxy server that only allows it to connect to the manufacturer's URL, and at that only to the authentication server address.

Fortunately the manufacturer uses SOAP on port 80, so that makes the filtering easier.
-nB

Re:Wow (1, Insightful)

Anonymous Coward | more than 4 years ago | (#33616426)

> The real problem is NOT the OS, since it is pretty obvious this attack has been specifically designed to hit a very small niche target, which means no matter what OS you were running the malware writers would have simply written to that target.

Bill? Steve?

Oh, what a coincidence UK, North America and South Korea is where Windows is stronger. Nah, forget it, correlation is not causation etc. etc.

> The problem as we are witnessing here is there is NO magic bullet, be it Windows, OSX, or Linux, be it a firewall or other piece of hardware, be it any other piece of tech.

This is _your_ problem. Ours is getting rid of worms, viruses... and M$.

I'm sure idiots have a role in this, but M$ somehow acts as amplifier of idiocy.

Re:Wow (1)

thegarbz (1787294) | more than 4 years ago | (#33616820)

Proper management of these kinds of systems should mean the firewall does effectively block all access that isn't physical to the machine. The way the network is setup where I work, the firewalls literally only allow one way traffic. The process network pushes data through the firewall to the machine on the other side continuously. From what I've been told there's no confirmation that the data is even received. Only the information on the other side of this network is accessible via another more typical firewall by the rest of the business.

With a firewall such as this, and computers that are kept physically under lock and key so no operator can come in and plug their usb stick in, there's no reason to presume you're not completely covered.

Re:Wow (0)

Anonymous Coward | more than 4 years ago | (#33617070)

"The ONLY way to secure a network is a top to bottom approach that runs everything on absolute least permissions and no network access to anything that doesn't absolutely need it." Well said, and considering the amount of insecurity and related stuff I read about these days makes me wonder, Why is this not the standard?

Re:Wow (2, Insightful)

Svartalf (2997) | more than 4 years ago | (#33615964)

And they USED Windows as the OS... Brilliant!

Saying that they should airgap the SCADA is obvious- unfortunately, people tend to favor "ease of use" and that airgap is one of the first things that typically tends to get botched in the name of that. So, even if you thought you put it on a standalone, the thing's liable as not to be on the corporate net with all the other machines.

Re:Wow (1)

MichaelSmith (789609) | more than 4 years ago | (#33616140)

Management will want statistics out of the scada system. How many widgets processed in the last (hour, day, week, month, etc)?. So there has to be an interface. Perhaps a USB key from the HMI to an employee laptop.

Re:Wow (1)

networkBoy (774728) | more than 4 years ago | (#33616836)

RS422 to a PC dedicated to that purpose.
It would be hard to infect the machine when it only sends data out on that interface and does not receive data, or only receives 2 byte commands to which it responds with a slew of numbers. Most machines like this have (at least as an option) an interface like this, precisely because they are supposed to be gap'd from the main network.

Re:Wow (3, Insightful)

Anonymous Coward | more than 4 years ago | (#33616538)

Often the system IS airgapped... and then they use a USB key to transfer the reports.

That's why USB keys were targeted for infection.

Re:Wow (0)

Anonymous Coward | more than 4 years ago | (#33616706)

So what's the solution (beyond using an OS that can't be hacked via USB drives -- maybe as simple as disable autorun)? is this a case where an airgap is less secure than a tightly controlled bridge (only allowing you to transfer the files you need, only one way, etc.) would have been, simply because the workaround for moving necessary data across the airgap is more complex, with more potential vulnerabilities beyond your control, than a strictly controlled link?

It's an interesting situation...

Re:Wow (1)

Antique Geekmeister (740220) | more than 4 years ago | (#33617428)

And that "airgap" means the hardware can't report its state, such as temperature, power issues, time synchronization, automated shutdown procedures among multiple nodes in case of an upstream systems failure, empty materials bins, or usage reports. Having an airgap is like virginity. It's easy to pledge to, but turns out to create other losses.

Re:Wow (5, Informative)

Mr. Sketch (111112) | more than 4 years ago | (#33616032)

Having worked in that industry, it's very common for them to be on the same network as Windows PCs. As for the default passwords, that's their own fault.

The reason they have to be on the same network as PCs is both:
1) The software to program and monitor PLCs are on Windows (made by Siemens, Rockwell Software, WonderWare, were the big names when I was in the industry 10 years ago), so it makes sense to have them on the same network so they can communicate with the PLC while it's online and see the logic operations in real time.
2) The biggest reason is that PLCs communicate with visualization software that runs on Windows (also made by the same companies as above), that can be viewed from a central location. This allows the production line manager to visually see the operations of the machines in a nicer format than looking at the raw logic bits. The visualization software can display shapes, colors, diagrams, animations, etc of the production line with real-time data about what's happening.

So yes, these PLCs are usually on the same network as Windows PCs. Ideally it's a private network with just the PLCs and the visualization/programming/monitoring PCs, but many places are not that strict about the network separation.

Re:Wow (2, Interesting)

MichaelSmith (789609) | more than 4 years ago | (#33616150)

As for the default passwords, that's their own fault.

I remember, back in the day, DEC had an account called FIELD on all the VMS systems they maintained. The DEC support guy would always grumble when we disabled that account, or changed the password. Its more trouble for them, you see.

Re:Wow (1)

Jah-Wren Ryel (80510) | more than 4 years ago | (#33616184)

This allows the production line manager to visually see the operations of the machines in a nicer format than looking at the raw logic bits. The visualization software can display shapes, colors, diagrams, animations, etc of the production line with real-time data about what's happening.

Sounds like a job for Data Diode. [datadiode.eu] (they aren't the only guys who make such things)

Re:Wow (1)

sjames (1099) | more than 4 years ago | (#33616306)

Even given that goofy situation, they could at least help matters by connecting the visualization machine to the control net (only) and use an IP enabled KVM to connect it to the LAN.

Ideally, there would be gateway software that polls everything, serializes it (over an actual serial connection) to an information server and let the visualization software talk to that. Ideally, the line from the info server's Tx to the gateway's Rx would be cut to make sure the communication can only be one way.

Re:Wow (1)

thegarbz (1787294) | more than 4 years ago | (#33616868)

Still working in that industry I'm absolutely amazed that you didn't mention any form of delimitation. Yes these windows machines are connected directly to the PLCs but they should be pushing data out to another machine via a one way firewall, and they should also be kept under lock and key. Any type of access at all be it direct or over the network via a firewall should only ever happen to these "expendable" machines.

We got this virus at our plant. All computers were infected except the machines hooked to the PLC. These machines were also the only ones that didn't have the latest windows updates, and had no virus scanner on them. As a precaution the two networks were physically isolated so for 2 days while the PLC machines were checked, and while IT were fixing hundreds of computers on the business network. The major downside is we had engineers looking over operators shoulders rather than sitting in their comfy offices.

Re:Wow (3, Interesting)

The Master Control P (655590) | more than 4 years ago | (#33616040)

The problem isn't that they're on the same network as Windows machines, it's that they're on any kind of network whatsoever that's not insulated from machines connected to the public Internet by an air gap.

Once again: Do not -ever- put mission-critical systems on the Internet.

Re:Wow (2, Informative)

Relic of the Future (118669) | more than 4 years ago | (#33616156)

From TFA: "spread [...] typically via USB sticks."

Air gap will hopefully stop secrets from getting out (unless... is this thing smart enough to wait for another USB stick, copy its stolen data on to it, and wait to be plugged in to a networked PC to communicate out? That'd be snazzy!) but it won't stop a USB stick. And, since USB is how code and software updates are usually delivered to these devices (not to mention the mouse and keyboard for the PC hook up), you can't just turn USB off either. Hence this [slashdot.org] .

restrict USB device classes (0)

Anonymous Coward | more than 4 years ago | (#33616308)

And, since USB is how code and software updates are usually delivered to these devices (not to mention the mouse and keyboard for the PC hook up), you can't just turn USB off either.

You may not be able to shut it off completely, but why can't you restrict what type of classes of USB device are attached when they're connected?

http://en.wikipedia.org/wiki/Universal_Serial_Bus#Device_classes

Also, if you need to have storage devices, what's the equivalent of "mount -o noexec,nodev,nosuid /dev/usb0 /mnt" on a Windows machine? Perhaps throw in an "ro" as well while you're at it if you don't want information leaking out, which would also prevent one system from spreading stuff around.

Re:Wow (1, Interesting)

Anonymous Coward | more than 4 years ago | (#33616882)

I know of several factories that have epoxied all the USB ports on machines on the production LAN. It kinda diminishes the worry about a USB stick attack when it won't fit in any of the machines.

Re:Wow (2, Informative)

MichaelSmith (789609) | more than 4 years ago | (#33616212)

Once again: Do not -ever- put mission-critical systems on the Internet.

You will never win that game. Google has real time traffic info from traffic signal systems these days. How do you think the information gets through? I used to run a traffic signalling system. There was an indirect internet connection, but security was taken seriously by everybody, both working with the system and in management. I would be much more concerned about a totally airgapped system with poor internal security. Because these days you can't have a 100% air gap.

Re:Wow (1)

The Master Control P (655590) | more than 4 years ago | (#33616592)

On one hand, that really scares me.

On the other, I can see where you're coming from and I suppose the Internet having read-only access could be lived with given other suitable precautions (boot from ROM, etc) to assure access was read-only.

traffic lights need the internet for the cameras (1)

Joe The Dragon (967727) | more than 4 years ago | (#33616598)

traffic lights need the internet for the red light cameras to send the pic's / video out!

Re:traffic lights need the internet for the camera (1)

MichaelSmith (789609) | more than 4 years ago | (#33616858)

Red light cameras are a separate enforcement system where I live. They most likely get a contact closure from the signal controller for coordination.

Re:Wow (1)

GiveBenADollar (1722738) | more than 4 years ago | (#33616430)

Network != Internet. If you have to control a large industrial system then you need to have centralized command and control, this is what enables the operators to see changes and equipment failure before they begin breaking other things. If you were to say the problem is the DEFAULT PASSWORD then I would agree with you.

Re:Wow (4, Informative)

thegarbz (1787294) | more than 4 years ago | (#33616898)

You clearly don't work in the process industry, nor have an idea of just how bullet proof a proper setup actually is despite there not being an airgap.

The ability to quickly and easily read values from the PLC remotely (one way only is the key) is paramount to not only the efficiency of running the plant, but sometimes the safety of the plant itself. Sometimes it goes a step further to even be a legal requirement. If a plant is levelled by a huge explosion you don't want to be the one standing in front of congress telling the people that the reason you have no idea what happened is that you didn't log every process value on a computer offsite in realtime.

Air-gaps are like the idiots guide to security. Yeah it helps, but it's impractical and there's so many other ways a competent person can secure a process network from the outside world. If you actually worked in the industry the lengths you see many companies go to will blow you away.

Re:Wow (1)

phantomfive (622387) | more than 4 years ago | (#33617626)

Air-gaps are like the idiots guide to security. Yeah it helps, but it's impractical and there's so many other ways a competent person can secure a process network from the outside world. If you actually worked in the industry the lengths you see many companies go to will blow you away.

I don't know much about this industry, but based on the article it sounds like the industry would be a lot more secure if there were more 'idiots' around. People always think they're secure until something like this happens. With an airgap, this wouldn't happen.

Re:Wow (4, Informative)

jofny (540291) | more than 4 years ago | (#33616138)

You can't change the Siemens passwords in this case (and have things keep working).

Re:Wow (1)

kaptink (699820) | more than 4 years ago | (#33616166)

I've seen loads of similar devices (Moxa) on several networks managing the safety systems, HVAC, environmental in tunnels and mines. All with default passwords on the same vlan as several windows machines with internet access and a history of malware. I'm sure there are many others out there. My question though is why go after industrial stuff? Perhaps in the hope they will hit something big and get some ego wank from it. Its not like anyone will benefit financially. It looks like true evilness.

Re:Wow (1)

GiveBenADollar (1722738) | more than 4 years ago | (#33616476)

Well, most large industrial plants are expensive to operate and even more expensive to shutdown and repair. Sounds like a Dr Evil ransom situation to me. $1,000,000,000,000,000 or I cause your machinery to explode.

Re:Wow (3, Interesting)

Sylak (1611137) | more than 4 years ago | (#33616176)

the problem lies ONLY in being on a network with Windows PCs. Simens more often than not specifically designs their products to NOT be networked OR have any default passwords changed, like on a JR Clancy Rigging System for theatres. Many of these appliances you can't change the passwords on without violating your service warranty, so complaining about passwords is really a bad assessment.

Re:Wow (3, Insightful)

DarwinSurvivor (1752106) | more than 4 years ago | (#33616562)

What is the point of a password if it's written in the owners manual of every person that has ever worked on a similar machine? At that point, you may as well call the communications API a "password".

Re:Wow (0)

Anonymous Coward | more than 4 years ago | (#33616188)

got nuke root?

Re:Wow (0)

Anonymous Coward | more than 4 years ago | (#33617124)

or you buy PLC's from Rockwell, who only provides control/programming software that runs on Windows.

lulz (1)

Syobon (1853468) | more than 4 years ago | (#33615918)

Iran the most affected country with 60% of infections, a highly sophisticated worm that resembles warfare espionage. NSA or CIA don't even need a backdoor in windows, just some obscure vulnerability, if it goes public ms maybe forced to patch.

inb4china (1)

BlueKitties (1541613) | more than 4 years ago | (#33615972)

I'm pretty sure it's only a matter of time before someone points to the finger at China.

What the? (3, Interesting)

Mashiki (184564) | more than 4 years ago | (#33615974)

Who is programming their PLC's? And why aren't they put into 'lock' mode(AKA ROM) when they're put into production machinery so the EEPROM can't be affected? I used to write programs for PLC's(generally Mitsubishi and Siemens), and you always locked the device or update when you were finished, so things like this can't happen.

Re:What the? (5, Informative)

luca (6883) | more than 4 years ago | (#33616112)

Do you know that when you set a password on a siemens plc, it isn't enforced by the plc itself but by the step 7 programming software?
Use something else (e.g., libnodave) and access is wide open.

Re:What the? (1)

DarwinSurvivor (1752106) | more than 4 years ago | (#33616584)

Reminds me of older (2000?) windows file servers. We had one at a workplace I was at where all the employees had network folders for their work and a few shared ones for moving stuff between departments. It was understood that nobody could access other people folders (especially upper management) and it was true (we double-clicked a managers folder by accident once and got the permission denied folder). The really strange part though was that I used a different file manager (explorer-xp) and one of the other guys like it, so I gave him a copy (freeware). He started using that and once again accidentally double-clicked the manager's folder and BOOM he was in! As far as we coudl tell, this file manager gave us 100% permissions on the ENTIRE file server, including out-of-building upper management. Our only guess is that the security is enforced on the client side (windows explorer) and the server simply expects the client to check the permissions itself.

Needless to say, I've never trusted microsoft security ever since :P

Re:What the? (2, Informative)

Mashiki (184564) | more than 4 years ago | (#33616838)

Yeah it's a common issue with a bunch of different models of PLC's however there is a psychical write lock on the controller that can be engaged. Well that's as long as you're not stupid enough to buy PLC's without it, and that means you're spending an extra $4/unit. In the end it means that you have to either physically pull the PLC, memory card, or controller card to be able to allow writing to the unit.

Re:What the? (0)

Anonymous Coward | more than 4 years ago | (#33617006)

Sounds like a classic design flaw to me. The PLCs I'm familiar with have a physical switch with a key that disables the ability to rewrite the device software.

Re:What the? (0)

Anonymous Coward | more than 4 years ago | (#33616866)

RTA - It specifically says that the worm targeted SCADA systems and the Siemens PCS7 DCS. You don't put in a SCADA system if you can get by with a simple ROM base controller. ROM controllers are used for standardized machine tools, most mid to high end controllers are RAM based, some with some type of flash backup.

Much manufacturing equipment is custom one-off machines specifically designed for the product being manufactured. I work in a manufacturing industry where it is not unusual to have several hundred controllers in a facility, all with custom programs. With all this custom software, you encounter situations that require technicians to make changes to keep things going.

Separate your manufacturing network, maintain change control, and have a disaster recovery plan.

Re:What the? (1)

thegarbz (1787294) | more than 4 years ago | (#33616942)

Things like what can't happen? From the article it appears as though that exactly this did happen. The virus was found on 14 networks and none of the PLCs were affected. Mind you with access to the PLC via the default password I would imagine that unlocking the PLC would be trivial. This is why I'm a fan of PLCs which require a physical key to be inserted into the rack and turned before the software can write anything to it.

Don't alot of the systems have isa slots and old s (0)

Anonymous Coward | more than 4 years ago | (#33616042)

Don't alot of the systems have isa slots and old software on them? But why default passwords?? even a easy 1234 password is better or just have the password on a post it note if it needed each day by many different people and you don't want to change it all the time.

But the ones in Iran did the us or some plant the worm there just to shut Iran down?

Why can't there be a fun Worm that gave free cable (0)

Joe The Dragon (967727) | more than 4 years ago | (#33616058)

Why can't there be a fun Worm that gave free cable channel running on a cable system? why does it have to be ones that can do big damage? or not just stuff like free HBO and or PPV?

Re:Why can't there be a fun Worm that gave free ca (1)

sjames (1099) | more than 4 years ago | (#33616332)

Because they spend actual money to prevent that. Sure, blacking out the east coast is a problem, but people getting free HBO would be an unmitigated DISASTER.

Re:Why can't there be a fun Worm that gave free ca (1)

DarwinSurvivor (1752106) | more than 4 years ago | (#33616600)

Well, they're just thinking of the children. Imagine if children suddenly had access to violent movies on channels their parents didn't think they needed to block!

Ok, I'm just going to stop baiting the trolls now :P

Why is there even a default password? (1)

rs1n (1867908) | more than 4 years ago | (#33616064)

Why aren't these types of devices just set up to require setting a password prior to usage? Sure, you might forget the password, but it sure as heck beats out having some random stranger take control over such an important device from God-knows-where. At the same time, if the device must play an important role, why not just have a physical key that overrides passwords if you need to get to the system. What am I leaving out here? This seems like a pretty sure way to fix this problem.

seems to be app passwords and not windows ones (1)

Joe The Dragon (967727) | more than 4 years ago | (#33616106)

seems to be app passwords and not windows ones.

So if the app needs a password just to run or do stuff that needs to be done each day vs stuff that does not need to be done all the time there you go.

Re:Why is there even a default password? (2, Interesting)

geekoid (135745) | more than 4 years ago | (#33616110)

At the very least generate a unique default password during install.

The SCADA system where I work require a specific USB key to be plugged in. While I'm not a fan of dongles in general, for critical system they can be worth the pain.

And this is on top of physical separation and a good password scheme. And strong passwords are easy to cerate an remember.

Good news? (1)

hex0D (1890162) | more than 4 years ago | (#33616086)

The positive spin on this story seems to me that although there were exploited vulnerabilities (but there always will be, that's why security is an ongoing process) it was effectively dealt with before any significant damages occurred. As long as lessons are learned, and remedies implemented this seems to be a good thing as far as I can tell.

Re:Good news? (1)

sjames (1099) | more than 4 years ago | (#33616384)

I wouldn't hold my breath. This all happened several years after the first warnings that it could happen, after the demos on power meters, and after the malware blew up the Russian pipeline.

That soft thudding you hear is the sound of surgically sharp clues being dulled and broken as they slam against the skulls of managers everywhere and fall ignored to the ground.

Damn-you, skynet! (4, Funny)

SethJohnson (112166) | more than 4 years ago | (#33616094)

Skynet just inched us one-step closer to the apocalypse by establishing its ability to assemble T1000 robots via CnC machines controlled by this botnet.

Seth

Secure your SCADA, idiots! (1)

atomicthumbs (824207) | more than 4 years ago | (#33616134)

I've seen too much of this in recent years. Control systems should be separated from the Internet by an air gap unless they absolutely need to be connected to it.

Hobby Coders (1)

BoRegardless (721219) | more than 4 years ago | (#33616148)

It is one thing for an isolated programmer to make security errors in a program.

It is entirely another thing when a Siemens or similar puts out code all over the world and they OBVIOUSLY have no serious security review of their code.

If a giant plant or process is taken down by this type of worm or similar, is Siemans going to plead that their EULA protects and indemnifies them from any responsibility for loss by the user of the software?

This gives me the willys.

That's Nothing... (0)

Anonymous Coward | more than 4 years ago | (#33616164)

What *really* concerns me is the recent invasion of the NukenBomb virus that installs itself on the target PC and then starts issuing launch codes to the missile silo controller cards. I heard of a sophisticated defense against this attack that entailed separating something or inhibiting direct connectiwhatsises but I can't recall the details and I think it was too difficult to implement anyway.

Would you like to play a game? (1)

Arancaytar (966377) | more than 4 years ago | (#33616238)

Launch code "hunter2" accepted. Please enter target.

Stupid developers (1)

Pedrito (94783) | more than 4 years ago | (#33616480)

Developers; Listen up! NEVER, EVER, EVER, EVER, EVER have a default password in apps you build. The setup should ask for a password if one is needed and the app should not install without one! What is so hard about this? It boggles my mind that things as important as routers, database servers and industrial equipment control software would install with default passwords! Why does that not raise red flags in developers' minds the second it pops into them?

what about router and other systems that need that (1)

Joe The Dragon (967727) | more than 4 years ago | (#33616614)

what about routers and other systems that need that pass word just to get the setup / config screen / page?

Re:Stupid developers (1)

WillDraven (760005) | more than 4 years ago | (#33617202)

My understanding is that it's even worse than a default password. It's a back-door account hard coded into the software that the users don't have the option of disabling.

Not about "default passwords. Worse. (5, Interesting)

Animats (122034) | more than 4 years ago | (#33616586)

This has nothing to do with "default passwords". It's worse than that. The Windows-level part of the attack was signed code signed with a Microsoft-issued key. The signing keys involved has been revoked. US-CERT isn't saying who had them.

At the controller level, Siemens has issued a bulletin: [siemens.com] Previously analyzed properties and the behavior of the virus in the software environment of the test system suggest that we are not dealing with the random development of one hacker, but with the product of a team of experts who must have IT expertise as well as specific know-how about industrial controls, their deployment in industrial production processes and corresponding engineering knowledge. ... The behavioral pattern of Stuxnet suggests that the virus is apparently only activated in plants with a specific configuration. It deliberately searches for a certain technical constellation with certain modules and certain program patterns which apply to a specific production process. This pattern can, for example, be localized by one specific data block and two code blocks. This means that Stuxnet is obviously targeting a specific process or a plant and not a particular brand or process technology and not the majority of industrial applications.

So this is an attack on a specific industrial plant. But whose? Neither Seimens nor US-CERT is saying.

This is cyber-warfare. Someone is trying to sabotage a specific plant somewhere.

Re:Not about "default passwords. Worse. (1, Insightful)

Anonymous Coward | more than 4 years ago | (#33617200)

Looks like it worked. Boom goes the gas line in California.
Turned up the pressure on a valve somewhere? Old pipes.
Just a matter of time with a big gas leak before it finds a flame.

Re:Not about "default passwords. Worse. (1)

slimjim8094 (941042) | more than 4 years ago | (#33617218)

I just about shat my pants.

We got complacent in the last few years. Since there was too much money in viruses, nobody caused mayhem for fun - it was all spam botnets and the like, something the writer could monetize.

This isn't a kid reminiscing about the shits-and-giggles days. I daresay the writers of this virus are hoping to profit in a big way.

This is the stuff of the 'movie virus', where some well-spoken sinister-looking guy goes and shuts down a city for ransom money.

Re:Not about "default passwords. Worse. (1, Insightful)

Anonymous Coward | more than 4 years ago | (#33617252)

The Windows-level part of the attack was signed code signed with a Microsoft-issued key. The signing keys involved has been revoked. US-CERT isn't saying who had them.

Realtek, according to everyone else on the internet. Which might point the finger at China, who would be well placed to acquire keys from Realtek and who have a well-publicised history of industrial espionage and using malware to attack foreign governments.

Re:Not about "default passwords. Worse. (5, Interesting)

sapphire wyvern (1153271) | more than 4 years ago | (#33617264)

There are indications that the target may have been the Bushehr nuclear power plant in Iran [langner.com] , with the Russian contractor's USB drives being the attack vector into the plant's control systems. (Which are not on the Internet, despite the smug assumptions of so many posters earlier in this comments section.) There's enough information out in the wild now that anyone with access to the target's PLC code could verify the target. Obviously this means the attack targets will be able to prove that the trojan was targeting them, but I doubt they'll be announcing the fact to the world - unless they can trace the attackers and gain political advantage through an announcement.

It seems the evidence currently leans towards a probably Israeli or possibly US cyberwarfare attack on Iran.

Re:Not about "default passwords. Worse. (0)

Anonymous Coward | more than 4 years ago | (#33617362)

Inside job - they engineer the problem - already having the solution ready - so much for the free internet... RIP

Now can we do something about the cespool? (1)

sjames (1099) | more than 4 years ago | (#33616692)

Just a note to the FBI, before you ignore that next spambot virus running around unencumbered, keep in mind it might just be spamming so it will be ignored by law enforcement. The primary objective might be cyberattack.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?