Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

New Siemens SCADA Vulnerabilities Kept Secret, Says Schneier

Roblimo posted more than 3 years ago | from the watch-those-centrifuges-spin-out-of-control dept.

Security 119

From the article: SCADA systems -- computer systems that control industrial processes -- are one of the ways a computer hack can directly affect the real world. Here, the fears multiply. It's not bad guys deleting your files, or getting your personal information and taking out credit cards in your name; it's bad guys spewing chemicals into the atmosphere and dumping raw sewage into waterways. It's Stuxnet: centrifuges spinning out of control and destroying themselves. Never mind how realistic the threat is, it's scarier." What worries Bruce Schneier most is that industry leader Siemens is keeping its SCADA vulnerabilities secret, at least in part due to pressure from the Department of Homeland Security .

cancel ×

119 comments

Read it before (1)

ge7 (2194648) | more than 3 years ago | (#36226852)

Uh oh, this story looks exactly like this story [slashdot.org] .

Re:Read it before (2)

McGiraf (196030) | more than 3 years ago | (#36226890)

Uh oh, this comment looks exactly like this comment. [slashdot.org]

Re:Read it before (1)

avgjoe62 (558860) | more than 3 years ago | (#36226956)

That was fun! Can we do it again? [slashdot.org]

Re:Read it before (2)

Chris Mattern (191822) | more than 3 years ago | (#36227320)

Sure! "It's just a jump to the left, and then a step to the riiight..."

Re:Read it before (1)

ShadoHawk (741112) | more than 3 years ago | (#36229686)

"Put your hands on your hips!"

I find the idea (0)

Chrisq (894406) | more than 3 years ago | (#36226958)

I find the idea of Iranian centrifuges spinning out of control and destroying themselves comforting rather than scary. Its a shame teh same hasn't happened to Pakistan [dailymail.co.uk] .

Re:I find the idea (2)

smelch (1988698) | more than 3 years ago | (#36227092)

Yeah, well how would you like incubators for human babies to start spinning out of control and destroying themselves?

I'm not so worried about what terrorists might do in a cyber attack, I'm worried about the trolls.

Re:I find the idea (1)

Black Parrot (19622) | more than 3 years ago | (#36227342)

Yeah, well how would you like incubators for human babies to start spinning out of control and destroying themselves?

Do incubators spin?

Re:I find the idea (1)

smelch (1988698) | more than 3 years ago | (#36227378)

You mean incubators for babies aren't the same as the incubators in Jurassic Park?

Re:I find the idea (3, Funny)

torgis (840592) | more than 3 years ago | (#36227750)

Spinning Incubator Babies would be a really excellent name for a rock band.

Re:I find the idea (1)

Black Parrot (19622) | more than 3 years ago | (#36227856)

Spinning Incubator Babies would be a really excellent name for a rock band.

Spin, Baby, Spin!

Re:I find the idea (2)

Gilmoure (18428) | more than 3 years ago | (#36227460)

We're incubating troll babies?

WAH?

Re:I find the idea (1)

drinkypoo (153816) | more than 3 years ago | (#36227668)

Yeah, well how would you like incubators for human babies to start spinning out of control and destroying themselves?

Not really an issue here on earth, maybe on a space station it would be a consideration. Or were you thinking of Fetus Harvesters [wikia.com] ?

Re:I find the idea (1)

countertrolling (1585477) | more than 3 years ago | (#36227476)

You all keep on pissing and moaning about Iranian nukes, while part of the new Saudi arms deal is to protect future Saudi nuclear ambitions.. which, by the way, also involves Pakistan [google.com] (had to use google cache to get the whole article)

And what did this clown [foreignpolicy.com] ever do to deserve all those medals?

Hyperbole. "Out of control... destroying" (1)

Anonymous Coward | more than 3 years ago | (#36229142)

"spinning out of control and destroying themselves"

The image the author creates is of a machine spinning at such velocity it explodes in a shower of fragments. While that makes for great copy, it's hardly what happened. In reality, Stuxnet caused the affected centrifuges to alter their rotational speed by only a few percent, which resulted in lower material rendering in the cascading purification process. This result has several advantages to a "self-destructing" centrifuge. 1) a destroyed centrifuge is an obvious problem which would trigger immediate investigation, while a "drifting" (and misreported) spin rate is not easily discovered 2) an undetected problem tends to pollute product quality and lead to doubts and investigations of all areas of the manufacturing process -- wasting time and expert resources diagnosing the root cause
I think you get the point.

If it did cause an accident... (3, Insightful)

AmiMoJo (196126) | more than 3 years ago | (#36226966)

Seems like Israel and the US are playing a dangerous game here. Say that Stuxnet caused an accident that released radioactive material into the environment...

Re:If it did cause an accident... (2)

Lehk228 (705449) | more than 3 years ago | (#36227036)

the whole thing would have been denied and covered up instead of bragged about.

Re:If it did cause an accident... (1)

turing_m (1030530) | more than 3 years ago | (#36228968)

I think he meant in terms of danger to people's lives, not blowback.

Re:If it did cause an accident... (2, Interesting)

MRe_nl (306212) | more than 3 years ago | (#36227074)

The Japanese nuclear plant in Fukushima ran on Siemens computers that the Stuxnet worm was programmed to infect- in fact the virus was found in Fukushima systems last year.
Makes you wonder why the cooling system wasn't functioning. Maybe the tsunami caused failures which Stuxnet made the reactors unable to handle.
Failures at four other plants in Japan, German and South African reactors shut down.
Using Siemens systems as well?

Re:If it did cause an accident... (2)

rubycodez (864176) | more than 3 years ago | (#36227330)

Quit reading tin hat nonsense sites. Have you seen the 1970s systems that control those GE Mark I's? No virus exists for those old things

Re:If it did cause an accident... (2)

Yvanhoe (564877) | more than 3 years ago | (#36227464)

Of course you have the sources for that ?

From what I understand, stuxnet was targeting unrichment facilities, which is very different from what Fukushima is.

Re:If it did cause an accident... (4, Informative)

Svartalf (2997) | more than 3 years ago | (#36227854)

Stuxnet doesn't "target" anything other than Windows SCADA systems (which should cause concern when you see those three words together...), notably those from Seimens. Anywhere you've got one of those SCADA systems, you've got a possibility of Stuxnet. It's just that Iran was using them for their process control systems for the enrichment plant.

Re:If it did cause an accident... (3, Interesting)

dachshund (300733) | more than 3 years ago | (#36228306)

Stuxnet doesn't "target" anything other than Windows SCADA systems (which should cause concern when you see those three words together...), notably those from Seimens. Anywhere you've got one of those SCADA systems, you've got a possibility of Stuxnet. It's just that Iran was using them for their process control systems for the enrichment plant.

Stuxnet targets a Siemens centrifuge controller that's programmed by an (air-gapped) Windows machine. Unfortunately this same basic pattern repeats itself all over the place.

For any given SCADA system --- regardless of manufacturer --- you're extremely likely to see it connected to a modern PC, typically a windows machine. Even if the Windows machine is just running a terminal program, it's connected.

What Stuxnet showed us is that these Windows boxes are a critical vulnerability, even if they're just an ingredient in the programming chain, even if the box is separated by an air gap. I'm sure Israel/US would have found a way to those centrifuge controllers, but without the Windows infection vector it would have been a whole hell of a lot more difficult.

Re:If it did cause an accident... (1)

heathen_01 (1191043) | more than 3 years ago | (#36228436)

Yes, they should have been using macs. They don't get viruses.

Re:If it did cause an accident... (1)

kvvbassboy (2010962) | more than 3 years ago | (#36228856)

What? If it is connected to a Linux machine, they will program Stuxnet to work with Linux. Or are you implying that non-Window machines are invulnerable?

Re:If it did cause an accident... (3, Informative)

TubeSteak (669689) | more than 3 years ago | (#36229540)

Stuxnet doesn't "target" anything other than Windows SCADA systems (which should cause concern when you see those three words together...), notably those from Seimens.

You might want to do a little more research on the matter.
Stuxnet's code has been picked apart: the trojan was designed to infect SCADA systems, but only to attack very specific hardware configurations.

Stuxnet's payload was designed to (1) spin the uranium centrifuges used by Iran at certain known-to-be-destructive RPMs,
(2) lie to the monitoring software which was supposed to prevent out of bounds conditions and set off alarms if they occur,
and (3) should 1 & 2 not ruin the centrifuges, Stuxnet would go dormant and reawaken to try (1) and (2) again.

Stuxnet is completely harmless unless you happen to attach the exact same hardware the Iranians had plugged into their SCADA controllers.
Just to be very clear: Stuxnet's payload was specifically crafted to attack the known configuration of Iran's uranium centrifuging program

Re:If it did cause an accident... (1)

Antimatt3r (1311379) | more than 3 years ago | (#36229822)

Actually Stuxnet does have a target. Each Siemen system has a unique serial number. Stuxnet only manipulated systems with certain serial numbers and it so happens that these serial numbers only existed in Siemens systems in Iran.

Re:If it did cause an accident... (1)

gl4ss (559668) | more than 3 years ago | (#36227426)

neglible amounts, if any. the real why it would end up in atmo would have been the faults of the engineers working at the plant. if you don't know how to build control systems, you shouldn't be building a nuke in the first place.

anyhow, scada networks, because of how practically all of them are designed, should be separated from untrusted networks anyways, and preferably all control going through some bridge that wouldn't pass "wrong" things - better yet, all control should pass through a human - but this depends on the specific use, really, as we don't have android typists acting as super firewalls(like in gits), who would want to type some textile pattern? nobody. you should treat them like your one-wire whatever networks, or like your local usb running on your table - if some attacker has access to that then what surprise it is that he can make the keyboard type "format c:".

of course there should be SOMEONE who knows what the machines should be doing, how and why. like the plant manager, chief engineer and etc, too bad good guys to fill those spots don't grow on trees... but that is not news.

Re:If it did cause an accident... (1)

PremiumCarrion (861236) | more than 3 years ago | (#36228078)

If there was an accident surely all the danger would be in Iran. Why would Israel and the US be playing a dangerous game?

Re:If it did cause an accident... (0)

Anonymous Coward | more than 3 years ago | (#36228182)

It would be blamed on "TEH TERRORISTS" of course. Maybe added for a "cyber" to appeal to the true retards of incompetence.

Logic of the egomaniac retard: "You have attacked my fist with your face! So I will punish you for it, by punching your face even harder!"

Re:If it did cause an accident... (1)

cavreader (1903280) | more than 3 years ago | (#36229344)

I'm sorry but I must have missed the proof that the US or Israel was responsible for Stuxnet. But of course actual facts are old fashion and can be quite problematic when the don't support your world view.

On the other hand... (1)

Kamiza Ikioi (893310) | more than 3 years ago | (#36230046)

... I can see not publicizing vulnerabilities. We don't, for instance, want our military publicly posting our vulnerabilities. Because, they sure as anything aren't going to ask for public patches. Public disclosure only really works if someone in the public can help. On the other hand, if you are running legacy systems in any number of unknown locations, you can't apply the patches anyways.

We always talk about how bad obfuscation is as a security vector. However, it is a vector. Knowledge of a thing can be its greatest weakness. For instance, publicizing how a company's internal network is setup can help an attacker greatly. But, hiding it can increase security. It's soft security, but it's better than no security.

Sometimes a SCADA hack is a good thing (3, Funny)

Anonymous Coward | more than 3 years ago | (#36226968)

How do you think Reese's initially got chocolate in their peanut butter?

NO!!!!! (2)

SirTreveyan (9270) | more than 3 years ago | (#36227192)

It was peanut butter in their chocolate

Re:NO!!!!! (0)

sexconker (1179573) | more than 3 years ago | (#36228976)

It was peanut butter in their chocolate

Actually, no.

The Reese's family made peanut butter cups and other confections. No chocolate, just creamy little cups (about the size of a caramel, or today's "mini" Reese's) of peanut butter and some stuff to make it hard on the outside.

It was an accident when someone poured chocolate sauce into the the wrong reservoir, resulting in peanut butter cups with swirls of chocolate. Reese's family sold the recipe to Hershey's after his death. (This wasn't a slimy cash-in by his family - Reese had worked with Hershey before, and had great respect for him. Hershey inspired Reese to open his own candy shop, which exclusively used Hershey's chocolate.)

Re:NO!!!!! (1)

SirTreveyan (9270) | more than 3 years ago | (#36229704)

Jezzz...evidently you don't remember the commercials [youtube.com] Reese's used to run [youtube.com] all the time [youtube.com] . Don't take things so serious.

Call me naive or something, but... (2)

Pecisk (688001) | more than 3 years ago | (#36226986)

...simply good old network security with hardened OSes (Linux, BSD, OS X) with seriously turned off all other services, firewalls and proxies with filtering won't do a trick?

Who is running industrial systems with direct contact with Internet anyway?

Re:Call me naive or something, but... (1)

Anonymous Coward | more than 3 years ago | (#36227052)

...simply good old network security with hardened OSes (Linux, BSD, OS X) with seriously turned off all other services, firewalls and proxies with filtering won't do a trick?

Who is running industrial systems with direct contact with Internet anyway?

Stuxnet infected the Iranian nuclear plan through USB.

Re:Call me naive or something, but... (1)

Pecisk (688001) | more than 3 years ago | (#36227108)

And excuse of sticking USB without security protocol (can't execute stuff from USB drives) is...? Still similary stupid to connecting boxes to Internet.

Re:Call me naive or something, but... (4, Insightful)

jimicus (737525) | more than 3 years ago | (#36227300)

I'm not sure it would have done much good. The general consensus of opinion is that this was a case of a determined attacker with a lot of resources, not some nutter on the Internet with a copy of the latest Virus Generator Toolkit (TM).

How much weight we should give that opinion is something I'm not going to discuss.

In any case, you think a determined attacker is going to be put off by a small thing like that? Hell, if it boils down to it you either organise double agents to apply for jobs at the target site or you target someone who already works there with a brown envelope full of unmarked, non-sequential notes. The latter is high risk, but find the right person, someone who's in debt up to their eyeballs and has been keeping it from their family for some time perhaps, and away you go.

Re:Call me naive or something, but... (0)

Anonymous Coward | more than 3 years ago | (#36227056)

Stuxnet got on the centrifuge controllers from USB sticks.

Re:Call me naive or something, but... (0)

Anonymous Coward | more than 3 years ago | (#36227062)

Who is running industrial systems with direct contact with Internet anyway?

Not the Iranians. They ran a proper air-gap separation between their enrichment systems and the Internet.

Not that it made any difference to the CIA and Mossad.

Re:Call me naive or something, but... (1)

Lehk228 (705449) | more than 3 years ago | (#36227078)

iirc the wild form of stuxnet was not the same as the one that hit iran, theirs was placed by a spy, not spread "naturally"

Re:Call me naive or something, but... (2)

wiredog (43288) | more than 3 years ago | (#36227114)

Many systems are remotely accessible, just not over the internet, and no one thought that heavy security would be needed. Even though those networks were getting compromised back in the 60's.

Just pulling the cable when remote access isn't needed is a highly effective, and often neglected, security practice.

Re:Call me naive or something, but... (1)

Maximum Prophet (716608) | more than 3 years ago | (#36227368)

no one thought that heavy security would be needed

Who is this imaginary "no one", that never thinks anything could go wrong? I and all my friends who grew up watching "War Games" are always thinking about how things could go wrong.

It always seemed to me that what "no one" is thinking is not that bad things can happen, but "I'll put in just enough security so that the failure won't happen until after I retire."

Re:Call me naive or something, but... (1)

wiredog (43288) | more than 3 years ago | (#36230032)

Why would you need heavy security for something that is air-gapped? If the Bad Guys (TM) get physical access you've lost anyway! We didn't even require passwords for access, because the keyboard was locked in the control cabinet. The only time it was networked was when someone hooked up a modem so it could be remotely debugged or upgraded. After which the modem was disconnected.

Re:Call me naive or something, but... (2)

Black Parrot (19622) | more than 3 years ago | (#36227382)

Just pulling the cable when remote access isn't needed is a highly effective, and often neglected, security practice.

I tried that, but my screen went black.

UR doin it rong! (1)

wiredog (43288) | more than 3 years ago | (#36228806)

Pull the other cable.

Not that one! You'll go blind!

Re:Call me naive or something, but... (0)

newdsfornerds (899401) | more than 3 years ago | (#36227152)

It won't do the trick because the vested interests wouldn't get paid as much. What are you, a commie? jk

Re:Call me naive or something, but... (0)

Anonymous Coward | more than 3 years ago | (#36227350)

This typically is not a problem of systems being Internet connected. The Iranian systems, for instance, were not. They operated on a closed network, but the human factor was exploited in order to infect. As others have pointed out, even without Internet connectivity, there is always some means of external access as various systems are geographically diverse and the need for communication is present. Any time there is any form of outside connectivity, there is vulnerability. The crux of the problem is that these systems were never built with security in mind. It's an afterthought. The efforts now revolve around retro-grade securing. What is needed is a complete redesign that includes security and filtering at every level, including out at the most remote piece of field hardware connected to the system.

Re:Call me naive or something, but... (0)

Charliemopps (1157495) | more than 3 years ago | (#36227370)

Imagine a power plant that takes little to no intervention throughout the year. At most the engineer(s) only need to make adjustments when changing out fuel rods or during an emergancy. Now imagine the engineers that make these changes make $200k+ a year and your company has 10 such reactors. Introduce the internet and... profit!!!

Re:Call me naive or something, but... (1)

cshake (736412) | more than 3 years ago | (#36227410)

I'd imagine it would be because the company that makes the machines that you're controlling only make drivers and control software for their own special computer systems that you have to buy from them. The advantage there is that if any part of the system goes wrong, from computer to end product, you have a single point of contact to get support from.
I think the mistake that many people on /. make is thinking that everyone is a 'computer guy', where in reality the people running these computers just know how to work the interface itself and not anything below the hood, so calling external support is very valuable.

And I bet a random *nix box that your friend in IT sent you wouldn't pass their ISO xxxxx certification.

As for internet connection, they must all be hooked up to an internal network at least for logging and alerting other systems in case of problems, but having that network also connected to the web is beyond me.

Re:Call me naive or something, but... (0)

Anonymous Coward | more than 3 years ago | (#36227412)

...simply good old network security with hardened OSes (Linux, BSD, OS X) with seriously turned off all other services, firewalls and proxies with filtering won't do a trick?

Who is running industrial systems with direct contact with Internet anyway?

Stuxnet was USB-loaded...

Re:Call me naive or something, but... (0)

Anonymous Coward | more than 3 years ago | (#36228528)

Reality. To everyone who says they don't get it on the internet. Reality.

These PLCs are expensive little pieces of hardware. The "engineers" (they are not engineers by training or trade, but that's the title unless you're in Canada) that know how to program and configure them start at about 90 an hour unless you own them as an FTE, which of course--the large corps do.

Depending upon the solution purchased they may either integrate solely with a specific version of windows, or solely with a specific piece of hardware that transmits data over bluetooth/microwave/radio/cellular/segregated IP or one of the 'wire' protocols developed for collection and control. This box will push either to a proprietary webpage over an unknown network, or wire the data back home by any number of protocols you can imagine. They *really* like FTP push.

If you're using a MUCH more power intensive system than many, these may even talk directly over the internet--in particular, the cellular solutions are dramatically cheaper this way. With modern hardware, you can get PPTP and L2TP support, although it's easier to just use TLS and a heavily firewalled webserver that only tolerates a single port. Some people are so cheap they'll just use a self signed key that expires in 20 years... you can recognize it in the client as long as it doesn't change...

Command and control can happen over a wholly RESTful architecture, which means your programmers are now...a dime a dozen in India if you have a versatile embedded solution.

But I mean...those are what I call "cheap" trade offs. People cutting corners with cost and willingly trying to make "reasonable" security compromises that frankly still have questionable judgment, but you can easily conceive of situations where it is appropriate.

There's much scarier unreasonable ones...

To see a real example, google for Scott Lunsford...who gave a presentation at Defcon IIRC about 2006 or so (IIRC)--the man successfully penetrated a nuclear power plant. And...it was easy. Now, ignore that "in your network" the person that screwed up would have been fired. That you scan for these machines and rogue AP's... I'll let you blissfully ignore the coming ipads, androids, iphones and consumer hardware that your managers will be demanding hookup in the next few years... call that point temporarily conceded.

The point...and the business utility of Scada systems--demands connection to ... the internet. It's that "information wants to be free" meme. Your devices report in--the data is aggregated in a reporting system, a database, a file server. Your accountants, engineers, field officers all want access to it--summaries, supports, statistics, trends, correlation analysis, pretty charts generated in Excel. The most successful marketing we had was directly to C-level or higher (board itself).

Now, you can carefully craft and architect a one way data flow. And for 90% of the "pure monitoring" it may be sufficient. But that other 10%--you get huge value from remote control. And of course, some markets are all about nothing but control and feedback. And SCADA, like anything benefits from economy of scale and standards--it can be cheaper to put the same multifunction device out in the floor with 4 or 40 different feeds than it is to train your team in ten custom appliances. And of course, requirements may change after installation--better to have that remote control turned on, or at the absolute most have a way to push an OTA update to enable it.

From there, you should see why it's inevitable these are on the Internet. Nobody wants to get up, walk from their reporting station over to the "control terminal" on a separate network that corporate had to invest extra money in. Extra wiring, extra computers, extra os licenses, extra control software license, extra training, desk space, power....

Windows is secure enough to run their accounting, domain service, file sharing and protect their CAD. And Internet Explorer is secure enough to control the chemicals and pressures of their industrial process....

Scary? Yeah--it fucking terrifies me. But I wrote some of it, and it's no more or less negligent than the rest of business as usual.

Re:Call me naive or something, but... (0)

Anonymous Coward | more than 3 years ago | (#36228750)

Several large utility companies

Re:Call me naive or something, but... (1)

nnull (1148259) | more than 3 years ago | (#36229752)

Quite a lot of people lately. Management wants to see their production on their office computers. They're easy to network and of course easy to hack. Siemens is not the only one vulnerable here, *cough* Schneider *cough* Schweitzer *cough* ABB...

Secure the perimeter (0)

elh_inny (557966) | more than 3 years ago | (#36227004)

I would leave exposed SCADA interface in the open, after Stuxnet it should be clear that securing SCADA interfaces should be done on a higher level - by putting it in a different VPN etc.
Whether the vulnerabilites are public or not doesn't change the fact that a given setup is secure or insecure by design...

Re:Secure the perimeter (2)

drinkypoo (153816) | more than 3 years ago | (#36227258)

Now imagine the scenario where you have windows machines on the same network as your SCADA devices because the tools you've bought or built work this way. Someone attaches an unauthorized device to your network and fail, fail.

Now, I think we can probably agree that you can and should take steps to prevent something like that from happening, but there is the issue of getting from point A, where your network is insecure, to point B, which requires at least buying or developing a whole bunch of new software. This is non-trivial and it costs a lot of money so a lot of operators probably weren't even looking at it until recently.

Re:Secure the perimeter (1)

Black Parrot (19622) | more than 3 years ago | (#36227400)

Now imagine the scenario where you have windows machines on the same network as your SCADA devices because the tools you've bought or built work this way. Someone attaches an unauthorized device to your network and fail, fail.

Aren't those development tools rather than run-time tools? If so, isolate your system and get serious about how you allow stuff to be moved over to it.

Re:Secure the perimeter (4, Informative)

Interfacer (560564) | more than 3 years ago | (#36227498)

Not really. The process control is done on real-time controllers, but visualization is usually on windows machines. Data historians, configuration databases, OPC servers, etc are often Windows servers. Add to that that hotfixes and service packs have to be vendor approved before putting them on the live system. This means that those systems often run whatever was approved at the time of installation, which can be years out of date.

Many SCADA and DCS systems are also horribly insecure, have default or hard coded administrative passwords, etc. What doesn't help is that they are often managed by people who are good at the actual process stuff, but not necessarily at security or system administration.

Show that things are a-ok on the comfy VB forms (1)

ThatsNotPudding (1045640) | more than 3 years ago | (#36229920)

meanwhile, the processes race towards disaster. I assume this is what the Iranians experienced.

It makes me feel safer that Stuxnet exists (-1)

Anonymous Coward | more than 3 years ago | (#36227014)

and that someone's thinking of how to stop Iran's nuclear program than if it didn't.

Duh? (1)

trifish (826353) | more than 3 years ago | (#36227024)

What worries Bruce Schneier most is that industry leader Siemens is keeping its SCADA vulnerabilities secret

If you want to prevent the bad guys from exploiting a vulnerability, then don't... um... tell them about the vulnerability? But do tell the affected parties about it.

Re:Duh? (1)

Anonymous Coward | more than 3 years ago | (#36227134)

Yeah, security by obscurity. That works great. Keeps the world safe.

Re:Duh? (5, Insightful)

nedlohs (1335013) | more than 3 years ago | (#36227196)

or fix it, that works really well too.

Re:Duh? (4, Insightful)

markus_baertschi (259069) | more than 3 years ago | (#36227246)

That is exactly what will not happen.

The ones who should tell their Customers about the problem is Siemens. But they will play the problem down because it might affect the sales of the next batch of stuff.

The evil hacker will just buy a bunch of systems, analyze it and find the vulnerabilities. This completely independent of the disclosure. Stuxnet was developed before this disclosure and I think the vulnerabilities used by Stuxnet are still there.

This is why security by obscurity does not work in the real world.

Re:Duh? (1)

Svartalf (2997) | more than 3 years ago | (#36227970)

The evil hacker will just buy a bunch of systems, analyze it and find the vulnerabilities. This completely independent of the disclosure. Stuxnet was developed before this disclosure and I think the vulnerabilities used by Stuxnet are still there.

This is why security by obscurity does not work in the real world.

Most definitely. Comments about someone not being able to afford to buy the devices not withstanding, it is very much what someone would do if they were to attack a system or come up with a new Stuxnet type piece of malware. Someone always has the wherewithal and resources to accomplish this sort of thing.

Re:Duh? (2)

chaos.squirrel (1085995) | more than 3 years ago | (#36227250)

If you want to prevent the bad guys from exploiting a vulnerability, then don't... um... tell them about the vulnerability? But do tell the affected parties about it.

I think nuclear power plants and the like warrant something a bit more than security through obscurity...

Re:Duh? (1)

betterunixthanunix (980855) | more than 3 years ago | (#36227322)

Except that the bad guys have already been made aware of the vulnerability, since Stuxnet is out there for anyone to analyze. Do you think the Iranians have not been picking apart Stuxnet and trying to figure out how they can use it?

Re:Duh? (1)

Svartalf (2997) | more than 3 years ago | (#36227916)

That's specifically not what they're doing...telling the affected people about it. They're keeping that information to themselves- because it might reveal the exploits in question. As for not disclosing because the bad-guys might figure it out...heh...keep fooling yourselves folks. The bad-guys almost always KNOW about them- it's why they call 'em "0-dayz".

DHS probably wants the security holes (4, Insightful)

Anonymous Coward | more than 3 years ago | (#36227094)

Actually it's probably the CIA, NSA and other TLA's that truly want the security holes. They're just using the DHS as the mouthpiece to convince the companies to keep quiet and not plug the holes. After all, without those holes, Stuxnet (and likely other woms/viruses/trojans) wouldn't be as effective as they apparently have been.

Re:DHS probably wants the security holes (4, Insightful)

fuzzyfuzzyfungus (1223518) | more than 3 years ago | (#36227408)

I'm not so sure: Obviously, assorted sinister TLAs are happy to exploit available holes; but all but the really stupid ones have to realize that they don't exactly live in a unipolar world when it comes to writing viruses, and that the US(and its assorted western buddies) have a lot to lose in an atmosphere of general SCADA-smashing.

If all SCADA systems become deeply vulnerable, who loses more? Industrial or post-industrial societies with high levels of complexity that could be on the edge of collapse with a few days of supply chain disruption, or the dusty low-GDP countries of the world where disenfranchised hackers, cheap laptops(and/or exploits provided by friendly powers using them as proxies) are still easily available?

Re:DHS probably wants the security holes (1)

HeckRuler (1369601) | more than 3 years ago | (#36230394)

There's another layer here. Having vulnerabilities allows TLAs to do sneaky things, empowers them, and helps them do their job. And you're right, those things cut both ways. But, having them cut both ways ALSO empowers the TLAs. They all got a big budget boost in the aught years. Security was suddenly a really important thing.

So what the TLAs want isn't always their intended purpose.

Re:DHS probably wants the security holes (1)

jonwil (467024) | more than 3 years ago | (#36228130)

If the CIA etc really wanted to infect these things, why wouldn't they just infect the machines at the factory then use a front company to sell them to IRAN or whoever on the cheap.

I remember seeing a JAG episode once where the spooks deliberatly allowed some bad guys to steal an F-14 and extract its control software (knowing that the software was to be given to IRAN for an upgrade of its F-14s and knowing that the software was deliberatly defective) and I see no reason it couldn't happen in the real world.

Re:DHS probably wants the security holes (1)

Jaysyn (203771) | more than 3 years ago | (#36229654)

Didn't the CIA do something like this to the USSR concerning oil pipeline control software?

Security (0)

Anonymous Coward | more than 3 years ago | (#36227122)

Whatever comes out of this, I don't want to be the one with Siemens in my face.

Responsible Disclosure (2)

Aladrin (926209) | more than 3 years ago | (#36227168)

Last I checked, 'responsible disclosure' meant giving the company time to fix the vulnerabilities before you released the info to the public.

Am I missing the part where we've gone beyond that point?

Re:Responsible Disclosure (0)

Anonymous Coward | more than 3 years ago | (#36228924)

Am I missing the part where we've gone beyond that point?

Yes. If you follow the links from Schneier's article, the researcher talks about testing the proposed fix from Siemens and breaking it wide open in 45 minutes. They're also making noise about these hacks requiring "special laboratory conditions and unlimited access to the protocols", which to Siemens means you can buy a SCADA controller and plug it in to your local network. In other words, they can't fix the problems and are already using marketing tactics to blunt the impact of the bugs.

Re:Responsible Disclosure (1)

DMUTPeregrine (612791) | more than 3 years ago | (#36229548)

Responsible disclosure meant giving the company time to fix the vulnerabilities before you released the info to the public.
So the companies stalled and never fixed the vulnerabilities, tried to sue the researchers, etc.
Responsible disclosure came to mean giving the company a set amount of time to fix the vulnerabilities before you released the info to the public.
So the companies kept threatening researchers, called the grace period "extortion" and such, stalled for more time to "test", and didn't fix the vulnerabilities.
Responsible disclosure died, and full disclosure took its place. The researcher's ethical responsibility is not to the company with the flawed product, but to the customers. Having all the details of a vulnerability is pretty much always useful for mitigating that vulnerability until a fix is released, and having the vulnerability publicly known motivates companies to actually fix the flaw. Thus, full disclosure is reasonable.
Some companies DO fix vulnerabilities when informed of them. With these it is reasonable to provide the grace period. If you do not know, it is reasonable to provide a grace period. 90 days is typical. If a company refuses to fix the flaws within the time, they forfeit their future grace periods.

Re:Responsible Disclosure (0)

Anonymous Coward | more than 3 years ago | (#36229812)

Well, what's exactly "responsible" about risking human lives by giving a vendor time to fix a bug instead of telling everyone, "hey, that machine over there can be hijacked and kill you"? I can sort of see the point of not releasing outright exploit code, even if it seems that's the only way some people will actually believe your claim, but it's rather funny how when actual human lives are on the line how much "responsible disclosure" doesn't seem very responsible at all. The only "responsible" thing to do is to inform as many people as early as possible that X is dangerous so people can stop using X; and if the vendor of X won't acknowledge the problem, even going as far as trying to block you telling people about the problems with X, then full disclosure seems a near necessity to convince people that X really is dangerous. Anything less seems rather irresponsible, like knowing about any other faulty product and sitting idly by as people are possibly hurt.

Full disclosure is better (0)

Anonymous Coward | more than 3 years ago | (#36230248)

Giving them time to fix the vulnerabilities only works with companies that are enlightened enough (and responsible enough) to use that time to try and fix the vulnerabilities. Many companies won't bother and will just use that time to demonize you and/or threaten you with lawyers etc.

It's been tried in the past, and usually nothing short of full disclosure will get these companies off their asses to actually fix the problems.

Perfect example (1)

return 42 (459012) | more than 3 years ago | (#36227270)

Sounds like exactly the sort of thing Wikileaks exists for.

No mention of anyone but Siemens? (0)

Anonymous Coward | more than 3 years ago | (#36227402)

Seems odd to me that there is a lot of talk about Siemens but not Rockwell (by far the more popular PLC here in the US) nor Wonderware (a more popular SCADA platform in the US than Siemens), nor any talk of GE products (with higher market share in the power including nuclear market segments, again limited to in the US).

Lifetime of a bug/hole (1)

Tei (520358) | more than 3 years ago | (#36227434)

Hole/bugs lifetime is forever. If you find a bug or a hole, and you choose to ignore then, it will not go away. It will be there waiting for his moment to ruin your morning. Maybe bug/holes are not as important as people dedicated to the racketeer industry think. So if you can't fix then on the morning, you can fix then after the tea, if you fix then today.

Industrial Control Systems (0)

Anonymous Coward | more than 3 years ago | (#36227494)

Keep it internal and put an 'air' wall between the systems and the internet.
By 'air' wall I mean disconnected from the internet. Only a fool would connnect say a reactor control system to the internet.
However; we've seen the results of a fools work before...
Remember what Murphy says:
"Anything that can go wrong will go wrong and; at the worst possible time."
Just ask the Japanese.

Open Secret (5, Informative)

adavies42 (746183) | more than 3 years ago | (#36227526)

I did my master's thesis on SCADA security. tl;dr: there isn't any. We're talking about an industry that uses unencrypted radio links in their control systems....

Re:Open Secret (1)

Anonymous Coward | more than 3 years ago | (#36227846)

Believe me I know all about it, as I'm a guy that designs and puts those links in. I've been making a big push with the uppers for more secure links and it is starting to get in now. Licensed bands with AES etc. Previously it would all be modpacs or Canopy links. We're starting to move to licensed stuff with AES now, but damn near everything in this area was already done like this. Anyone could pretty much get on the network with the right know how. Most of the stuff is the water control systems for the cities/towns.

Re:Open Secret (2)

Svartalf (2997) | more than 3 years ago | (#36228072)

Heh... They're "thinking" about using crypto on things like the radio links. They're "concerned" about things like "latency" (Here's a hint, if you're worried about injecting a 1-2 character's worth of transmission time delay at 9600 baud, you're doing it wrong.) so the industry's been reticient at trying to at least lock down some aspects of the remote links. Biggest problem is the downtime of some systems in addition to the overall expense of things while they retrofit to higher data rates, end-to-end crypto (and not the security mode of DNP3 and other SCADA device protocols...), and security monitoring. Most of the "smart grid" security model's been predicated on security through obscurity and authenticated command and control with data being plaintext in most cases because that's the "least expensive" solution to the "problem".

Re:Open Secret (1)

Anonymous Coward | more than 3 years ago | (#36228592)

Wait a second. Unencrypted *radio* links? Seriously? I sure hope it's for controlling the ice cream and chocolate factories of the world and not something important.

Re:Open Secret (0)

Anonymous Coward | more than 3 years ago | (#36230482)

Worked on embedded hardware mostly measuring but with some control over oil pipelines. Security concerns were pushed to the way far back burner. "It's never going to be plugged into the Internet".

Embedded work was simply different. There was no processing power or complexity to allow for this sort of thing. The ONLY I/O for these things used to just be their serial port.

That's changed and the industry is feeling the pains of scope change.

Re:Open Secret (1)

Myrcurial (26138) | more than 3 years ago | (#36230572)

Master's Thesis on SCADA Sec? Really? Published anywhere?

SCADA security isn't. I'm sorry but it's true. And the entire "security industry" is talking just like all the slashtards commenting.

Doing security right in this environment is non-trivial. The SCADA/ICS vendor community isn't providing it because SCADA/ICS customers aren't asking for it. The downside of course is that the SCADA/ICS customer is NOT the individual who is going to suffer when the screwups happen. The SCADA/ICS vendors and customers have externalized the costs of failure on the general public and no country-scale government is actually doing anything other than paying lip-service to the idea of dealing with aging/insecure infrastructure.

If you want to see more - have a look at the talk I did at DEF CON 18 - it covers the situation nicely.

anonK (0)

Anonymous Coward | more than 3 years ago | (#36227580)

Antivirus went nuts trying to open the first link. xss
http://jurelia.co.be/games/mario.jar a variant of Java/Agent.BP trojan
2 of those followed by an ip address trying to dl an avi.

Re:anonK (1)

ledow (319597) | more than 3 years ago | (#36227680)

Seeing as you're the only one commenting on this, and I can't see it either, it's probably YOU that's infected, or you clicked something you didn't mean to.

Hell, there aren't even any banner ads on that page at all.

computer systems that control the real world? (1)

doperative (1958782) | more than 3 years ago | (#36227960)

"SCADA systems -- computer systems that control industrial processes -- are one of the ways a computer hack can directly affect the real world".

Only if you connect the SCADA systems directly to the Internet and run them on top of Windows [wired.com] . Instead of running them behind a secure VPN connection running on embedded hardware.

Re:computer systems that control the real world? (1)

PPH (736903) | more than 3 years ago | (#36228158)

The problem with such systems is that they can be 'infected' through the programming platform. In the case of Stuxnet [wikipedia.org] it was the PCs used to program the PLCs that were infected. And one of the vectors of infection was the use of infected USB flash drives on these (Windows) systems. Programming PLCs is often done through a direct cable connection, so while keeping industrial control systems off 'The Internet' may be a good idea, it isn't sufficient to prevent such an attack.

Re:computer systems that control the real world? (1)

geekoid (135745) | more than 3 years ago | (#36229274)

This types of attacks should happen regardless of the OS.

These are specifically targeted attacks, the manly take advantage of human trust.

And yes, the SCADA systems need to be isolated, and then need to only allow access from specific machines.

OTOH, that level of security is expensive, and for some reason everyone thinks infrastructure programs don't cost money. and all money the government gets is 'waste'.

backdoor (0)

Anonymous Coward | more than 3 years ago | (#36228050)

Somehow I'm thinking that "vulnerability" is the new word for "backdoor".

They shuod keep then secret (1)

geekoid (135745) | more than 3 years ago | (#36229226)

there should also be strict government oversight to ensure the vulnerabilities are being fixed.

Re:They shuod keep then secret (1)

VortexCortex (1117377) | more than 3 years ago | (#36230044)

there should also be strict government oversight to ensure the vulnerabilities are being fixed.

... And that the fixes don't make it to other governments. See: VUPEN's alleged Chrome exploit.

VUPEN released a video of the exploit in action to demonstrate a drive-by download attack that successfully launches the calculator app without any user action.

The exploit shown in this video is one of the most sophisticated codes we have seen and created so far as it bypasses all security features including ASLR/DEP/Sandbox (and without exploiting a Windows kernel vulnerability), it is silent (no crash after executing the payload), it relies on undisclosed (0day) vulnerabilities discovered by VUPEN and it works on all Windows systems (32-bit and x64).

VUPEN, which sells vulnerability and exploit information to business and government customers, does not plan to provide technical details of the attack to anyone, including Google.

Guess it depends on who you think the "bad guys" are. I say, show the world and let the good 'n malicious duke it out -- hint: Bug fixes are often easier to code than full exploits.

Call Jack Bauer (1)

LittlePud (1356157) | more than 3 years ago | (#36229568)

Someone has been watching too much 24 Season 7.
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...