Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Malware Infects US Power Facilities Through USB Drives

Soulskill posted about a year and a half ago | from the under-your-thumbdrive dept.

Power 136

angry tapir writes "Two U.S. power companies have reported infections of malware during the past three months, with the bad software apparently brought in through tainted USB drives, according to the U.S. Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). The publication (PDF) did not name the malware discovered. The tainted USB drive came in contact with a 'handful of machines' at the power generation facility and investigators found sophisticated malware on two engineering workstations critical to the operation of the control environment, ICS-CERT said."

cancel ×

136 comments

Sorry! There are no comments related to the filter you selected.

Scan the security cameras... (5, Insightful)

eksith (2776419) | about a year and a half ago | (#42600783)

...If they have them installed and actually recording. Find out which ones were inserting the USB drives in question, fire them and ban them from ever being hired at any infastructure facilities. Train the remaining employees in security best practices and run random scans of any equipment they bring into the premises.

More often than not security breaches are a result of an oversight, but far too often, it's laziness and incompetence.

Re:Scan the security cameras... (3, Insightful)

Anonymous Coward | about a year and a half ago | (#42600865)

They know who did it - it was apparently a contractor installing software.

And banning USB keys or "scanning" is not the solution - the solution is to not use vulnerable crap like windows for any critical functions at something like a power plant. Although banning/firing any contractor that specified a windows based system for the installation in the first place, could be a good first step.

Re:Scan the security cameras... (2, Interesting)

Anonymous Coward | about a year and a half ago | (#42600875)

the solution is to not use vulnerable crap like windows

If the malicious code was embedded in the software which was intentionally installed, then exactly how would the choice of OS have fuck-all to do with it?

Re:Scan the security cameras... (0, Informative)

Anonymous Coward | about a year and a half ago | (#42600925)

The choice of OS made it vulnerable to the "malicious code" in the first place.

or... choosing windows based software, which is itself vulnerable to "malicious code"

Re:Scan the security cameras... (1, Funny)

Anonymous Coward | about a year and a half ago | (#42601141)

or... choosing windows, which is itself "malicious code"

Re:Scan the security cameras... (2)

RoboJ1M (992925) | about a year and a half ago | (#42601847)

But, it was a contractor installing software.
The OS didn't need to be vulnerable.
The infected application had super user rights.
Of course no doubt it DID leverage holes in windows and it wasn't there to compromise the power station, just run spam chewing malware.
And it was only ON the stick in the first place because of Windows security holes.

But by definition any OS (GNU Linux, OSX, Windows) on which you are installing software if vulnerable by default
Of course in a secure environment such as GNU Linux or BSD or whatever, the machines that wrote the stick in the first place would have been astronomically less vulnerable to leaky security and easy compromise such as the box where the contractor spent the morning browsing drive by pr0n sites.

If it was a malicious contractor, no OS is going to save you.

Re:Scan the security cameras... (1)

Svartalf (2997) | about a year and a half ago | (#42603079)

Ah, but you're reading MORE into this than is actually there (HINT: This story'd been WAAAAY different if it'd been YOUR story...).

Quite simply put, you're glossing over that Windows is actually a BAD choice for a SCADA system software component- because this wouldn't have happened the way it was read and seems to be playing out if it'd not been a Windows system in the first place.

Re:Scan the security cameras... (1)

RoboJ1M (992925) | about a year and a half ago | (#42604027)

Yes, sorry, should have reiterated that Windows is just a bad choice full stop.

(can my story be directed by Michael Bay please?)

Re:Scan the security cameras... (0)

Anonymous Coward | about a year and a half ago | (#42600927)

Somthing tells me your making assumptions here. There are not real "viruses" for GNU/Linux. Theory OK. Some insane set of steps users have to take first demos-yes. But real viruses? No.

Re:Scan the security cameras... (-1)

Anonymous Coward | about a year and a half ago | (#42600937)

Because Windows is an unstable, vulnerable piece of shit that'll be compromised by a 10 year old developmentally challenged kid on a Valium binge.

Re:Scan the security cameras... (0, Flamebait)

Anonymous Coward | about a year and a half ago | (#42600993)

a 10 year old developmentally challenged kid on a Valium binge would be less of a troll and more informed than you.

Get off Torvalds cock for once

Re:Scan the security cameras... (-1)

Anonymous Coward | about a year and a half ago | (#42601019)

Butthurt much, Ballmer-boy?

Re:Scan the security cameras... (-1, Troll)

Mike Frett (2811077) | about a year and a half ago | (#42601155)

Ahhh...The Windows Fanbois arrive, with glorious dancing Ballmer by their side. They spew Microsoft lies with pride and flaunt their vulnerable platform with a virus laden stride.

Re:Scan the security cameras... (5, Funny)

aurispector (530273) | about a year and a half ago | (#42601891)

Since windows is the de facto standard and as such the bulk of malware is targeted at it. Pick any platform, make it the standard and the amount of malware written for it will explode.

Nice rhymes BTW - that english degree is paying off for you!

Been wrong for years (-1)

dbIII (701233) | about a year and a half ago | (#42602619)

Back in the early days of the web most of the machines connected to it ran some form of *nix, yet the MSDOS machines and Win95 machines had close to a monopoly on malware. Now most of the things directly connected to the internet once again run some form of *nix (ADSL modems, servers, wifi access points, now even TVs) and malware is now entirely restricted to MS platforms. If you'd spent some time on thought instead of mindless cheering you would have realised how utterly stupid your "attacking the most common platform" argument is when it's not the most common platform that has the malware monopoly.

The choice of fucking OSs... (-1)

Anonymous Coward | about a year and a half ago | (#42602369)

> If the malicious code was embedded in the software which was intentionally installed, then exactly how would the choice of OS have fuck-all to do with it?

Because if the fucking OS wasn't Windows, then the fucking OS wouldn't get infected by plugging in a fucking USB device into the fucking machine ..

Re:Scan the security cameras... (2)

Svartalf (2997) | about a year and a half ago | (#42603049)

I don't think that it was embedded there (or we'd have a different story we'd be commenting on...)- it was just infecting the tech's USB thumb drive. Something that Windows actually excels at.

Re:Scan the security cameras... (2)

inasity_rules (1110095) | about a year and a half ago | (#42601069)

I agree, but what you suggest is impractical. Normally the consultant would have specified the requirements, and then chosen from a list of options given. Practically, all of those options would be Windows, because, guess what, it is the industry standard. Practically then, any contractor suggesting a different system would be at a disadvantage because they would be deviating from the de facto standard. Industry has so much momentum changing from windows is excessively difficult.

Re:Scan the security cameras... (1)

Anonymous Coward | about a year and a half ago | (#42601143)

If you think the only OS with issues are Microsoft OS', explain how all the centrifuges in Iran got infected? OS no longer matters, there is mal-ware out there for all OS'. There is no way to stay in front of all possible mal-ware threats so the simple method to address the issue, ban all USB drives, one of the main vectors for transmission of bad-guy software. Also ensure everyone doing ANY installs are well trained to not make mistakes like this in the future and also educate everyone else, being in a USB device and connect it to the company machines at all, you are fired.

Re:Scan the security cameras... (0)

Anonymous Coward | about a year and a half ago | (#42601239)

It is my understanding, that they were infected through the HMI software, which runs on windows. From there you can send/receive data from the PLC and reprogram it if you want to. So the malware software ran on the HMI machine and sent bogus data/programmed faulty code to the PLC.

Re:Scan the security cameras... (0)

Anonymous Coward | about a year and a half ago | (#42601219)

Unfortunately, there aren't many options for other systems than windows in automation world, except for dedicated PLCs of course, which run their own embedded systems, windows and one linux(that i know of, don't know if it does anymore though). Also all programming software is for windows, except for some smart relays or small PLCs, which may have a java based software like siemens logo does.

I've only run into one open source project for PLC programming and the development for it seems quite slow. It's not really an option yet, also because the industry doesn't follow any file standards, so you can't open programs from another package with another.

Everything else from HMI software to data gathering stuff runs on windows (unless of course you've built your own). There are couple open source options for HMI software, that run on other platforms.

Re:Scan the security cameras... (0)

Anonymous Coward | about a year and a half ago | (#42601361)

But the choice of OS is dictated by the vendor. We have clinical systems like this: you get given a supplied PC and quite often, Tamper Ye Not.

Hilariously, if the control PC is air-gapped, its antivirus will *by definition* be spectacularly out of date.

This is never as simple as it seems...

Re:Scan the security cameras... (5, Insightful)

benjymouse (756774) | about a year and a half ago | (#42601931)

the solution is to not use vulnerable crap like windows for

Right. So there would never be any risk when using Linux?

http://www.h-online.com/open/news/item/USB-driver-bug-exposed-as-Linux-plug-pwn-1203617.html [h-online.com]

http://news.softpedia.com/news/Researcher-Demonstrates-USB-Autorun-Attack-on-Linux-183611.shtml [softpedia.com]

http://linux.slashdot.org/story/11/02/07/1742246/usb-autorun-attacks-against-linux [slashdot.org]

http://www.omgubuntu.co.uk/2011/02/how-usb-autorun-malware-could-easily-infect-linux [omgubuntu.co.uk]

You are stupid to think that any OS is free of such problems. Or you are just blind to facts because of Linux fanaticism.

Re:Scan the security cameras... (2)

Svartalf (2997) | about a year and a half ago | (#42603191)

1) These are due to trying to make Linux "easy". If you're using a desktop install, it's going to happen. Autorun is a BAD and bogus idea, really.
2) An embedded or secured Linux won't respond to Autorun like this. I think only the ones trying to be a Windows/OSX "competitor" like Ubuntu have this on by default.

Sorry, it's more that the OS in question (Windows) does stupid things that're insecure by design - and adopting any of those bad ideas in your OS will cause the same sorts of problems. Your set of links merely proves this.

Re:Scan the security cameras... (0)

Anonymous Coward | about a year and a half ago | (#42603623)

Like Svartalf, I have to kinda disagree with you about this.

Yes, all operating systems have security issues but Windows, in general, is a whole other beast.

what about not useing outside technicians (1)

Joe_Dragon (2206452) | about a year and a half ago | (#42602957)

what about not useing outside technicians.

So they can have more control over over there work / pay for all hardware / software costs to make security right.

Don't fire / ban the tech who may be just following a script that may of just been to go X website and download this file to a usb key that will be used for the updates.

Also that malware may of even came from a different system that was being updated with the same usb key at a different place.

Re:Scan the security cameras... (0)

Anonymous Coward | about a year and a half ago | (#42605513)

As a software engineer I have to state that there is no such thing as non-vulnerable software. No matter how hard you try there will still be at some point a vulnerability found.

Re:Scan the security cameras... (1, Troll)

The Cisco Kid (31490) | about a year and a half ago | (#42600873)

"laziness and incompetence" = using Microsoft platforms for power plant engineering systems.

"security best practices" = never letting Microsoft platforms near anything mission critical at such an installation.

Re:Scan the security cameras... (1, Funny)

symbolset (646467) | about a year and a half ago | (#42600961)

Strangely I agree with this moderation. If there ever was a day when "redundant" should be an up mod, this is it.

Re:Scan the security cameras... (1)

Anonymous Coward | about a year and a half ago | (#42600877)

Before you fire them, find out *why* they did it. Was it necessary to do their job? Organizations often impose restrictions that make the expected processes impossible, and it works only because employees ignore the restrictions. If that is the case, make it clear to the other employees that they were close to being fired too because, presumably, they did similar things. Do not spare the culprit -- he/she should have reported that the expected processes don't work under the imposed restrictions, not ignore them.

Also, place a strip of duct tape over all USB ports. IT can remove the tape if they need to, but $RANDOM_EMPLOYEE will know that they are not expected to remove the tape. That won't block a malicious employee, but might block a lazy or incompetent one. Removing the ports will work, but is probably to cumbersome.

FTA: "found sophisticated malware on two engineering workstations critical to the operation of the control environment"
FTA: "in early October to report a virus infection in a turbine control system"

And why can software be installed on these things except updating the control software? Seems like a problem with the equipment itself, and a market opportunity for manufacturers of security-hardened equipment.

FTA: "An outside technician used a USB drive to upload software updates during equipment upgrades" ... or for manufacturers / service companies who don't damage the equipment of their customers.

And the mandatory question: Why the heck has a random employee permissions (in the computer sense, not the organizational one) to install things on their computer?

Re: Fire him (4, Funny)

Anonymous Coward | about a year and a half ago | (#42600991)

When firing him, make him walk past all the other employees lined up at the front doors, who turn their backs one by one as he passes them. And as he walks to his car, the slow-clap chant of "unclean, unclean, unclean" should be encouraged. And a hail of out of date McAfee trial disks thrown at his car as he drives away.

No. It's not to punish him further, it's to reinforce acceptable group behaviour on those who remain.

"We don't do this to you if you steal a laptop or a roll of copper wire. We don't do this to you if sneak out at noon every day. This is the thing we do this for."

Re: Fire him (1)

Feyshtey (1523799) | about a year and a half ago | (#42604979)

And more often than not the message that is actually recieved is "Dont do whatever you have to do to make this backwards shithole actually operate on the outdated, broken, kluge of a system that's been cobbled together by hogtied engineers over a generation of mismanagement. Just sit back, and watch it collapse under its own wait and tell the bosses, 'I told you so....'."

Re:Scan the security cameras... (0)

hairyfeet (841228) | about a year and a half ago | (#42601795)

Uhhh...Why have USB slots on the PCs in the first place? Its really not that hard to just epoxy some plugs into the slots in the back and pull the cable to the front ya know. Even if they did do what you say its still possible an enemy might in the future blackmail an employee into plugging a drive in, can't do that if its common knowledge there ain't no USB slots on their machines.

If it were me while I was at it I'd set a GPO blocking Windows from enabling any CDROM or floppy drives along with the USB drivers so even if somebody in some out of the way place cracked the case open and reconnected the headers it wouldn't do any good as Windows wouldn't load the drivers.

Re:Scan the security cameras... (1)

aaarrrgggh (9205) | about a year and a half ago | (#42602843)

To do it right, you would need one machine that you load the USB stick into, another machine scans that stick and copies selected file to the network. Very few guarantees in this situation though that you would be able to scan for all vulnerabilities or potentially damaging configurations.

About the only thing you can do is have a second supervisory network watching the first, and taking over (with reduced functionality) when an abnormality is detected. If course that system needs to running different hardware (JACE need not apply), supported by a different vendor, etc. It gets very expensive, but is often done when you can't trust your controls. (Haven't seen a new system like this implemented in a long time though...)

Re:Scan the security cameras... (1)

Feyshtey (1523799) | about a year and a half ago | (#42605061)

Or you build a dev environment and *gasp* TEST SHIT BEFORE YOU ROLL IT TO PRODUCTION.

Also not a failsafe solution, but my God why isnt it done more? If this shit is so critical please explain to me why? "Go for it Hank. Its from the vendor. What could possibly go wrong!?"

Re:Scan the security cameras... (2)

tlhIngan (30335) | about a year and a half ago | (#42605323)

Uhhh...Why have USB slots on the PCs in the first place? Its really not that hard to just epoxy some plugs into the slots in the back and pull the cable to the front ya know. Even if they did do what you say its still possible an enemy might in the future blackmail an employee into plugging a drive in, can't do that if its common knowledge there ain't no USB slots on their machines.

  If it were me while I was at it I'd set a GPO blocking Windows from enabling any CDROM or floppy drives along with the USB drivers so even if somebody in some out of the way place cracked the case open and reconnected the headers it wouldn't do any good as Windows wouldn't load the drivers.

Well, if you did security right, you have an airgapped network, which means the critical network and the corporate LAN are separated.

But that brings a question - how do you update anything on the airgapped network? And yes, things do need updating now and again, including any Windows machines used to manage it. May be a software update, may be a configuration update (e.g., some new machinery was installed, or something was replaced and now the whole setup has to be reconfigured).

The easiest way is a thumb drive.

Otherwise what you have is a completely useless network that runs ancient software that has to be maintained somehow.

Airgapped networks work, but they have a serious vulnerability in that going from an insecure to secure environment (let's say you gateway it so all data brought to the isolated network must be scanned by a gateway PC - now the gateway PC needs to have latest antivirus etc. - and how do you get those onto it, since it's airgapped?).

Some people make fancy "data diodes" that are very strict firewalls - it lets the isolated network go and talk to the corporate network for updates, etc, but prevents anything from the isolated network from leaving it.

But it's a huge problem with no easy solution - Stuxnet, the USAF, they all suffered when airgapped computers got infected. (The USAF when their UAV control PCs got infected because they used a thumbdrive to move a map update across).

Re:Scan the security cameras... (1)

Feyshtey (1523799) | about a year and a half ago | (#42604767)

This assumes, of course, that your security staff is better qualified and trained than your other staff. And that they have been granted authority to build adequate security measures.

Security personnel (physical or digital) are not immune to negligence and incompetence . If they were there would be safeguards against allowing a USB drive to be functional in a critical infrastructure system or not having USB ports at all, and issolation from those machines that require such inputs.

Re:Scan the security cameras... (2)

timeOday (582209) | about a year and a half ago | (#42605625)

Everybody is rushing to agree with you, but I don't see how the use of a USB drive is the problem in this case. USB drives are a bad way to transfer information to secure systems because they are writable, so sensitive information can leak back into the open environment. But that's not what happened here, so it makes no difference whether the upload to the sensitive system had been done with a CD, USB drive, floppy... what do you think they should use, and what difference would it make? Are you assuming they failed to run a virus scanner on the software they uploaded? Those aren't 100%, especially not for targeted attacks. All secure systems are loaded with software and hardware that is ultimately from the open, so there is a chance of bad stuff leaking through. Even if you built the whole computer system onsite from sand and software written from scratch (which is absurd), there is still the trustworthiness of the people who do the work.

i wonder which is better (1, Insightful)

someone1234 (830754) | about a year and a half ago | (#42600837)

1. It is stuxnet
2. it is something else

Re:i wonder which is better (1)

oodaloop (1229816) | about a year and a half ago | (#42601487)

Stuxnet was specially designed to go after equipment used in Iran for enriching Uranium. However, the code has been in the hands of hackers around the world for a while now, and I'd be surprised if it's never reused.

On another note, as early as 2009 we've known China has been probing US electric companies and installing logic bombs. We know they're there, and we can't get rid of them. China has the ability already to shut down our power indefinitely, as in destroy the generators. And take a wild guess who makes the generators.

Re:i wonder which is better (0)

AmiMoJo (196126) | about a year and a half ago | (#42601805)

Was it retaliation in the cold war with Iran, or was it the start of an offensive by a third state? Or did US cyberweapons backfire?

Re:i wonder which is better (1)

toutankh (1544253) | about a year and a half ago | (#42601921)

It seems to me that the US government wants to be able to use software-based attacks on other countries (like Iran with Stuxnet), while being totally protected from software-based attacks from the outside. In my opinion, this will never happen: US, like any other country, is and will be vulnerable to these attacks. No matter how much money they throw at it. In this context one might wonder whether it's in the US government's interest to bring the war to this terrain, like they did with Stuxnet.

Reminds me of the second battle of Ypres (0)

Anonymous Coward | about a year and a half ago | (#42602027)

When the Germans used poison gas with success, but couldn't advance because they haven't invented gas masks yet. If you release a virus, you should be damn sure that you can defend yourself against it.

Why the hell (-1)

Anonymous Coward | about a year and a half ago | (#42600845)

... would any machine running Windows be attached to or associated with anything that was critical to the operation of a power plant?!

Whoever made that decision needs to be FIRED and not be allowed anywhere near anything like a power plant ever again.

Re:Why the hell (3, Interesting)

c0lo (1497653) | about a year and a half ago | (#42601023)

... would any machine running Windows be attached to or associated with anything that was critical to the operation of a power plant?!

Just in case you are scared about power plants failures - don't! There are much better things to be worried about.

For example - only a bit more that 4 years ago, the UK Navy finished retrofitting its nuclear subs with... Window XP and 2000! [tomshardware.com] For sensors and weapons control no less. At the time, /.ers coined a new meaning for the BSOD [slashdot.org] .

Re:Why the hell (1)

oobayly (1056050) | about a year and a half ago | (#42601157)

But "Windows for Warships" has such a great ring to it - much better than "Linux for Landlubbers".

Re:Why the hell (2)

inasity_rules (1110095) | about a year and a half ago | (#42601077)

Because it is the industry standard and they would be fired for suggesting otherwise? Wake up, the world isn't full of perfect ideals.

Don't DEAL with problems, SOLVE them... (1, Interesting)

jkrise (535370) | about a year and a half ago | (#42600851)

I can't help but laugh at the infantile levels of thinking and planning which goes into building secure infrastructure systems. Here's how I would do it:

1. First, insulate critical infrastructure systems from the rest of the World. Don't install 'secure' routers or 'secure' firewalls. Simply insulate them. End of.

2. Do not install any software (OS, database or application) that needs to be activated from the outside, or auto-updated from the outside.

3. Do not ALLOW any USB based access to any of the networked machines, ever. If at all, the USB drive needs to be connected to a Linux machine, that does not auto-mount or run any auto-magic stuff. Then, any files that need to be sent to the server need to be quarantined prior to updating.

4. Same goes for WiFi. Only allow mahcines with known, registered MAC addresses, after pre-auditing and authorising them.

Dealing with the aftermath of such insecure architecture, without Solving them once and for all, is a criminal offence by the IT admins and must be prosecuted as such. Irrespective of the outcome or lack of any infections despite insecure architecture.

Re:Don't DEAL with problems, SOLVE them... (5, Insightful)

Anonymous Coward | about a year and a half ago | (#42600905)

3. Do not ALLOW any USB based access to any of the networked machines, ever. If at all, the USB drive needs to be connected to a Linux machine, that does not auto-mount or run any auto-magic stuff. Then, any files that need to be sent to the server need to be quarantined prior to updating.

The problem is the entire process of adding the software in the first place. The application should have been placed into a sterile test environment and proved out prior to ever being approved, then moved in a secure fashion to a staging environment for actual deployment. This whole thing reeks of massive violations of best practices, no matter what OS you happen to be using.

For example: "ICS-CERT recommended that the power facility adopt new USB use guidelines, including the cleaning of a USB device before each use."
Uh, yea NO SHIT. I work for an ISP and any code deployments which have to be done via USB, flash, or any other removable media MUST be done using company-owned media devices, that media is completely sterilized and staged in a pre-production environment prior to actual deployment. Anybody who let a contractor use his own equipment for such a deployment would be sacked without a second thought, and for this type of critical system we wouldn't rely on an outside contractor in the first place. Whoever is in charge of their practices and network/IT policies needs to be fired immediately and replaced by someone who is at least halfway competent.

Re:Don't DEAL with problems, SOLVE them... (1)

AmiMoJo (196126) | about a year and a half ago | (#42601835)

It must be nice working at a place where money is no object when it comes to security. For most places they will look at something like this and do a cost/risk analysis before deciding to just format USB drives before using them for deployment.

Compared to the cost of setting up a secure staging area and doing proper security management simply recovering from occasional incidents like this is far cheaper. Plus they get free help from the government and look like the victims to most people.

Security doesn't make economic sense unfortunately, which is why we always have to legislate it.

Re:Don't DEAL with problems, SOLVE them... (1)

Locutus (9039) | about a year and a half ago | (#42604341)

because a few Linux stations for USB data staging, scanning and final file relocation onto the network is just so outrageously expensive...

LoB

Re:Don't DEAL with problems, SOLVE them... (2)

AmiMoJo (196126) | about a year and a half ago | (#42605733)

Won't help. You still have to make sure people use them, and all the control software runs on Windows.

Re:Don't DEAL with problems, SOLVE them... (1)

aaarrrgggh (9205) | about a year and a half ago | (#42603013)

Eventually, configuration changes and updates are required. You would need a complete duplicate plant to really test the proposed updates; that generally isn't possible like it would be for a web server or even a banking system. Sure, you can test input and output, but you cannot see all of the complex interactions of the overall process. You cannot tune the process to real-world conditions either.

As for the GP's comment on no remote access, what exactly do you suggest for non-manned sites? Smoke signals? You can argue that there shouldn't be unmanned sites... But 24x7x365 staffing? Do you need two people so one can go on their breaks/lunch/etc? Suddenly you have gone from something that easily fits into an existing employee's role to a $600k/year cost... Just to eliminate non-local access. There are some things where this is a drop in the bucket, but there are a whole lot of facilities that just barely make that much profit in a year.

Re:Don't DEAL with problems, SOLVE them... (0)

Anonymous Coward | about a year and a half ago | (#42600995)

1. Often impossible for software in question.
2. See above.
3. Autorun fuction is easily disabled on Windows, too. Additionally, Windows had software restriction policies at least since Win2000. So, if USB storage was used as attack vector, someone from IT security department needs to be fired (and sued).
4. And see your IT department drown in bureaucracy.

Re:Don't DEAL with problems, SOLVE them... (0)

Anonymous Coward | about a year and a half ago | (#42601007)

I'd ban WiFi

Re:Don't DEAL with problems, SOLVE them... (4, Interesting)

thegarbz (1787294) | about a year and a half ago | (#42601011)

1. hahahahahahhahahahahah. Ok in all seriousness that is not only laughable but often actually simply illegal. The modern control world will often mandate some form of external data transfer live directly from the control system, and this is before taking into account satellite operated systems and other potentially unmanned sites. If you think that an airgap from other networks is the end of the discussion you've effectively made all your solutions unworkable in the industry.

Much debugging is done over the network looking at live data trends.
Much maintenance is done over the network through the use of smart instruments and asset management systems.
Much analysis and improvement to processes, reliability analysis of critical machinery, and other such activities are done in a way which require some connection to the control system.

Not to mention that airgap gives people a hell of a false sense of security.

2. This is not only a good idea, but it's actually also a requirement by many vendors.

3. Unworkable. Engineers will have your balls in a vice before you get through the commissioning phase. Mainly because you won't get through the commissioning phase as something will be wrong and there's no way to get data on or off the machine in question. The idea of locking it down to prevent autoruns is good. Providing sterilised USB keys for use is good too. Most of the problems are brought in from home, not transferred between work machines and the process network.

4. WiFi ... on a process network? Dear god why! WiFi used for field devices should sit on their own isolated network with very careful and selective routing only to the aforementioned non-airgapped process network.

Re:Don't DEAL with problems, SOLVE them... (0)

Anonymous Coward | about a year and a half ago | (#42601809)

3) The network I work on is airgapped. We deal just fine with having to route all data transfer requests through security. Also, CD-Rs. USB keys are too easy to write to. We require the use of CD-Rs or DVD-Rs to transfer data. You can miss a virus infecting a USB drive, but not your CD burner (which is only installed at the 'CD Burner' desktop) spinning up. All CDs coming in require a virus scan.

1) Meh. Insulating does not me unnetworked. It's perfectly reasonable to have your secure network send information updates (but not READ BACK FROM) to a server which allows the outside world to read that data. Sending commands BACK is where you need to really watch it. If you do not have to allow this, don't.

Re:Don't DEAL with problems, SOLVE them... (0)

Anonymous Coward | about a year and a half ago | (#42602847)

4) WiFi? Hate to disillusion you, that's pretty damn insecure unless you're piling something like SCADASAFE's algorithm in between the RTU and the monitor and control servers talking to the RTU. It's entirely too easy to bash through Pre-shared (rainbow code attacks ARE possible with FPGA hardware in hand...) and I seriously doubt you're using something slightly more robust like LEAP because that'd require quite a bit hardware than most places are willing to field into an otherwise airgapped system. At least the Industrial wireless systems that are used with SCADA tend to have at least AES 128 bit symmetric key implemented on their hardware- which is actually much more robust than most WPA2 implementations.

Re:Don't DEAL with problems, SOLVE them... (0)

Anonymous Coward | about a year and a half ago | (#42602949)

1) You're a fool. Airgapped means PRECISELY that. Anything else is NOT insulated. If you're sending things out, it can be hacked to be sent back the other way. If it's hooked into the corporate network, the ONLY realistic way is to have it going through a one-way NAT firewall. Even then, it's NOT "insulated"- it's got a shielded path. If, for any reason, there's an exploitable surface on your firewall (even a DoS is an exploitable surface) you're going to have serious issues with that design and you're going to have it taken down or worse. It's another attack surface that you'd not have if you were honestly insulated.

Sure, it's inconvenient. Real security IS precisely that.

Re:Don't DEAL with problems, SOLVE them... (0)

Anonymous Coward | about a year and a half ago | (#42603029)

3) Virus scan? Bwhahahaha! What if you've got a zero-day virus- the scanner's not going to catch it. It's better to use something with at least a few less vulnerabilities. I can assure you that you're still going to get zapped with this procedure. It's just slightly more difficult to do so. All you're doing is glossing over that Windows is a BAD choice for these sorts of systems.

Re:Don't DEAL with problems, SOLVE them... (1)

Anonymous Coward | about a year and a half ago | (#42601113)

> Only allow mahcines with known, registered MAC addresses, after pre-auditing and authorising them.
right. a 6 byte mac is such a strong protection measure.

Re:Don't DEAL with problems, SOLVE them... (1)

dkf (304284) | about a year and a half ago | (#42601397)

Only allow mahcines with known, registered MAC addresses, after pre-auditing and authorising them.

right. a 6 byte mac is such a strong protection measure.

Just because some people have lockpicks doesn't mean that you shouldn't put a lock on your front door. Same principle.

Which isn't to say that the devices should then allow anyone on the network to connect — sane security is always in depth — but neglecting a simple measure that keeps a lot of trouble off the network is foolish. Most people inclined to try are just looking to get free networking, and don't care which network they use. Wireless MAC filtering is how you deal with them, along with implementing other orthogonal security measures like WPA2.

Re:Don't DEAL with problems, SOLVE them... (1)

Anonymous Coward | about a year and a half ago | (#42601511)

MAC filtering is useless. Anyone that gets that far can easily bypass the "security". The only thing it adds is a lot of manual labor to update - and hassle for users when it doesn't work correctly. (eg. typo, replaced wifi card, etc)

Re:Don't DEAL with problems, SOLVE them... (1)

Svartalf (2997) | about a year and a half ago | (#42602873)

MAC filtering keeps the absolutely low pikers out. When I can sniff your MACs OTA and can spoof them trivially it means nothing. WiFi isn't a good answer for anything involved with SCADA- it's a disaster waiting to happen.

Re:Don't DEAL with problems, SOLVE them... (0)

Anonymous Coward | about a year and a half ago | (#42601503)

4) Faking a MAC on wifi is dead simple. This only adds a false sense of security and a lot of manual work - for no useful protection.

Re:Don't DEAL with problems, SOLVE them... (1)

marevan (846115) | about a year and a half ago | (#42601599)

What you're saying is, or at least SHOULD be the standard in nuclear power plants (in Europe, dunno about USA NPP:s). The process network has no connections whatsoever to outside, or even to office network. USB-media is strictly forbidden. Mind you, only thing to make sure of this (oversights and carelesness happens) would be filling the usbports of all the computers with polyurethane. And wireless? IT Security will get in a shitstorm-mode even if you mention wireless anywhere else than in visitor network.

Re:Don't DEAL with problems, SOLVE them... (0)

Anonymous Coward | about a year and a half ago | (#42602447)

I can't help but laugh at the infantile levels of thinking and ignorance that goes into slashdot comments about securing infrastructure systems.

You have absolutely no idea of the complexity of these systems and their need to communicate across-site, across-town, across-county, across-region, across-country. You think that the power plant just guesses when it should increase or decrease power? Things tend to go Bang! if you screw that up.

End of.

Re:Don't DEAL with problems, SOLVE them... (1)

dbIII (701233) | about a year and a half ago | (#42602731)

It used to be done like that - then middle management with MBA's in shouting wanted to show off instrument status displays to other MBA's in the comfort of their offices so that they sould win pissing contests. That meant closing the air gap and letting dedicated p0rn surfing machines onto sensitive networks.

Good (2, Insightful)

Anonymous Coward | about a year and a half ago | (#42600881)

Good, if USB's are the infection route, then it probably means they've been smart enough to not connect these systems to the internet.
Good, they're not screaming 'cyber war' and conflating script kiddies with the country of the p0wned PC that sent the infection.

Bad, However, why have they left the USB ports open? And why are the ports autoexecuting this malware? I mean, even my Dad (82 years old) has the auto execute registry flag turned off. He can plug malware infected keys till his hearts content and it won't run. It's just really sloppy! You pay people to secure critical systems like this and they don't do their job, so you need to sack them and hire competent people instead.

Well at least as competent as an amateur 82 year old.

Re:Good (1)

c0lo (1497653) | about a year and a half ago | (#42601033)

Bad, However, why have they left the USB ports open?

My guess? Tight budgets didn't allow for super-glue purchase.

(ducks)

Re:Good (0)

Anonymous Coward | about a year and a half ago | (#42601097)

[ quack! ]

Re:Good (1)

Locutus (9039) | about a year and a half ago | (#42604717)

this is the first time a USB devices has been found to pass an infection on to a host computer.

Sorry about all the coffee or Coke on your keyboard.

LoB

ICSCERT? (1)

jasmusic (786052) | about a year and a half ago | (#42600883)

U.S. Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team (ICS-CERT)

What a long ass name for such a useless agency. Who gives a fuck about their opinions? What, do you think the government knows more about power plants than the fucking people who actually build them?

Re:ICSCERT? (2)

azalin (67640) | about a year and a half ago | (#42601063)

Well I'm not advocating this specific agency but
a) Companies will not publish incident details, unless forced to in one way or the other. It is not in their, or their shareholders best interest to be open about mistakes. The systems used are probably not unique and are in use by several other companies as well. So if a flaw/known attack vector exists, others should be warned, so they can secure them.
b) A single incident is not a big deal, but what about ten, or a hundred? Power is a strategic resource in this country and must be treated as such.

Apply hot glue (1)

Anonymous Coward | about a year and a half ago | (#42600945)

To all the orifices of the employees who plug random usb stickies to supah secret guberment computators... ...and to the admins of the said machines.

AutoIT (0)

Anonymous Coward | about a year and a half ago | (#42600985)

I run IT security for an entire country for an aerospace company, the most prevalent virus that we've detected is some unsophisticated and annoying worm that spreads via removable media and network file shares, it's based off AutoIT. Lucky for us sensitive areas don't even have USB controllers or have them disabled at BIOS level so it's only prevalent in low security areas and they've all been caught by our IDS & IPS.

Why are essential services organisations... (0)

Anonymous Coward | about a year and a half ago | (#42601047)

...running Windows at all? Seriously, that's just asking for trouble.

Be careful of the back port (4, Funny)

unix_core (943019) | about a year and a half ago | (#42601049)

I've heard the infection spreads more easily if you stick it in the port on the backside. I know for most people, its a PITA to do that. you might have to get down on your knees an so on, though there are those who prefer it and for them it's especially important to use adequate protection.

Re:Be careful of the back port (1)

Pieroxy (222434) | about a year and a half ago | (#42601321)

I've heard the infection spreads more easily if you stick it in the port on the backside. I know for most people, its a PITA to do that. you might have to get down on your knees an so on, though there are those who prefer it and for them it's especially important to use adequate protection.

Yes, it's always more painful from behind, I agree.

Re:Be careful of the back port (0)

oodaloop (1229816) | about a year and a half ago | (#42601499)

I'm still not sure if OP was trying to make the joke you did, or completely missed all those double entendres.

Re:Be careful of the back port (0)

Anonymous Coward | about a year and a half ago | (#42602793)

Both were making the joke, and YOU missed it...

But then this is /., afterall...

Re:Be careful of the back port (1)

hraponssi (1939850) | about a year and a half ago | (#42602081)

you have to lube your stick

Re:Be careful of the back port (1)

virgnarus (1949790) | about a year and a half ago | (#42604819)

...and for them it's especially important to use adequate protection.

An anti-static wrist-strap?

Well known tactic (2)

PacRim Jim (812876) | about a year and a half ago | (#42601175)

Hackers know that if you leave a dozen or so thumb drives around the parking lot of a target company, at least one person will be unable to resist looking to see what's on it.

Informative psot (-1, Flamebait)

ukmobilebd (2784865) | about a year and a half ago | (#42601331)

Thank’s for information. I in significance enjoyed reading this post.

Headline wrong. (0)

Anonymous Coward | about a year and a half ago | (#42601345)

Malware infects Windows OS through USB drives.

Headlines like this are why we have the majority of our boxes running linux scanning for windows viruses. It's why we aren't allowed to stick USB drives into the Linux machines.

I don't know why the people making standards for security never mention the elephant in the room: Windows.

Almost every security restriction is due to how WINDOWS does things "for" you.

Re:Headline wrong. (0)

Anonymous Coward | about a year and a half ago | (#42601525)

It's why we aren't allowed to stick USB drives into the Linux machines.

I guess you meant: "into the Windows machines"?

Nope, unfortunately. (0)

Anonymous Coward | about a year and a half ago | (#42605587)

USB drives can't be put in to Linux PCs beause Windows uses Autorun on them.

I don't know if they're afraid of pointing out Windows being insecure (therefore have to say "Don't use Windows" and get in a whole shitload of trouble because Microsoft doesn't like it) or whether they're just writing it that way because it isn't their problem.

Everything is ok (-1)

Anonymous Coward | about a year and a half ago | (#42601763)

The global economy is reviving and soon prosperity will be abundant. We will be frugal yet happy and sustain small families with less of a draw on resources and the environment. The internet is opening up and will continue to be more free - only being regulated to a limited scale according to people personal wishes. There are no missing laptops and there will soon be no reports of it again. Peace is in and soon there will be world peace. There will be 3 competing global business models and people will be free to live under whatever system they prefer - socialism, communism, and free market capitalism. These systems will be sand-boxed from each other and ripple through all nations. The major banking dynasties will retire into luxurious gulags, and their funds will be used for the above reforms. Everything is great. The free market capitalists are going back to the moon to establish permanent settlements with the aid of the Communists and the Socialists are developing plans for an inter-stellar drive. They are at peace as they are free to move between their respective systems at will. All is well. People all over the world will have the right to carry and possess firearms, but they have to give up their right local law enforcement protection. Federal and global law enforcement is a thing of the past because of the above unions. The dark sarcasm in the classroom is dissipating and civic classes will return again soon. Schools are becoming more workshop orientated, and artists are starting to become more valued as professionals, and soon they will be more in demand than IT professionals as mankind embarks on a neo renaissance. There is also a spiritual revival as people return to simple religions and faiths like paganism and buddhism are thriving. Strong agnosticism is dieing out and only it's weaker variant is surging. Safe nuclear fission and fusion is becoming abundant. There are very few paranoid people abounding but everyone is vigilant and safeguard the new world we live in. Almost everyone has a garden, even is it's indoors, or on roof tops. People who do not grow at least some of their own food consumption are looked down upon. There are multiple competing internets, but more of them are derived from the Socialist and free-market systems. The most popular are ones that only allow e-ink technology that is not a strain on the eyes and a whole series of protocols have been developed that integrate directly with e-ink devices. All manned space vehicles and space stations feature e-ink displays, though most are in color now. GMO food is used mainly in labs and is clearly labelled.It is mainly harmless with such offerings as giant pumpkins, strains of marijuana are cross-bred with prehistoric plants from Australia. There are underground parks and sky parks in blimps as well as several zero g orbital parks. People are free to eat the food in these parks but most are trying to find ways to grow more than consume more plants. TV has been replaced by telepresence, especially in the free market locals. People explore the internet as if they were a part of it. In the socialist locals, people mostly use the internet to test and operate interactive machines spanning vast distances, and for science experiments. In the communist locals, people carry the internet only with them using Google glass and other competing products. The leaders of the 3 dominant systems collaborate also, working on new telesopes in search of extrasolar planets. There are already treaties underway to share the resources and land of any new planets they discover so that one day they can continue to prosper in peace on those worlds as they do here on Earth, though the Earth is known by many names, and nicknames nowadays.

Get this BS story out (0)

Anonymous Coward | about a year and a half ago | (#42601791)

Welp folks, here's another "PROBLEM" story queued for the problem, reaction, solution machine.
Fuckers are borrowing 42 for every 1 dollar and we have the DHS in opposition to the constitution stamping their name on mission creep everywhere they can find it.
ICS-CERT didn't get any better by having DHS stamped in front of the name

And so the psyop goes

shouting down the street, "malware's in the primary control grid" until the jouralizts get ahold of it on ABC, BBC, CBS, FOX, PBS, NBC and get public out cry, oh we can't have these malware's in the primary control grid so we have to spy some more, and take away more rights, charge more, and degrade the existing services, More smart meters, that way we can tell which house had the USB stick they'll trot out complete fucking fantasy to get to the end of their means.

repeat after me. Enron (1)

decora (1710862) | about a year and a half ago | (#42601833)

is the only organization to succesfull shut down the power grid - and it did it with the help of the US government

most of the people in it kept their profits and many went on to work in the subprime mortgage industry.

Just disable USB drives through a machine GPO (0)

benjymouse (756774) | about a year and a half ago | (#42601991)

http://www.techrepublic.com/blog/datacenter/disable-removable-media-through-windows-server-2008s-group-policy-configuration/452 [techrepublic.com]

Really easy and simple. No need to script anything or to remove files from local systems.

How would you do that in Linux (which has had *many* vulnerabilities in USB drivers in *kernel* space)

A handful of tainted Windows machines .. (1)

dgharmon (2564621) | about a year and a half ago | (#42602315)

Do these handful of tainted machines run on Windows?

stuxnet (1)

trexd___ (2799583) | about a year and a half ago | (#42602329)

Isnt this is similar to the time when Stuxnet invaded Iranian nuclear power plant and was also infected through its PLC's. man i thought that would be warning enough.

porn.exe, Sexy.exe virus variants are most likely (1)

mastagee (26015) | about a year and a half ago | (#42602513)

Seen several cases of this across several different companies. I would think that the power/utility company admins are subject to the same oversights that most are. This has been seen in several different variants, and the major AV vendors have trouble identifying it accurately.

Main route of infection is via autoplay.inf. It also spreads to all available drive letters, including external drives and network shares. Easy prevention would be to disable autoplay.inf across the forest with a GPO. Windows XP machines are usually the ones the culprit that allows the first infection. It goes through and hides and sets system attribs on folders (and sometimes changes permissions) on the network share (and any accessible drive letter) using the (domain) credentials of the currently logged in user. If that user has more access, more things get screwed up.

Pain to clean up; to do it thoroughly, each machine must be scrubbed clean while disconnected from the network. Also, all usb drives should be scrubbed as well.

Can't be sure that's what they were hit with, but I would not be surprised if this was it.

Management Failure (1)

Lumpy (12016) | about a year and a half ago | (#42602539)

Why does the SCADA systems even HAVE accessable USB ports? What moron bought Dell PC's instead of rackmount systems with locking face plates?

All of this is the fault of the Managers and upper managers of the facilities as well as the project manager that did not specify the PROPER EQUIPMENT for the systems.

You can set up windows to ignore USB memory devices, it's really easy if you have competent staff on hand that can do it.

Only two? (1)

tippe (1136385) | about a year and a half ago | (#42602737)

Based on all of the other articles posted on /. regarding compromised corporate and military networks, it's amazing that these guys have limited the infection to only two computers. That's amazing! Way to go guys! Way to show up your peers! Bonuses for everyone (or at least the executives who I'm sure are the real heroes of this story)!

</sarcasm>

critical infrastructure endangered by... (1)

Jawnn (445279) | about a year and a half ago | (#42602775)

...failure to follow simple best practices. Nothing new here. Move along... move along.

mYod up (-1)

Anonymous Coward | about a year and a half ago | (#42603455)

writing is on the rotting corpse 4arties). At THE

Ho-hum - The oldest attack vector (1)

jtara (133429) | about a year and a half ago | (#42604363)

This is something new?

I was working as a developer at a nuclear power station (S.O.N.G.S.) in the early 90's. The developer across the cubicle from me had a persistent "beeeping" problem with his PC, which he ignored. I asked him about it, and he said "the damn thing just beeps every now and then". He was pretty unconcerned about it. Like "yea, it beeps, so what?"

Turns out it was a virus.

The vendor that provided the PC was always very helpful. They were so helpful, that when a new BIOS update came out for the video cards they were using in some of the PCs, they helpfully went from desk to desk installing the BIOS upgrade - from an infected floppy disk.

No idea if the virus ever made if off of developer PCs and onto more critical systems. I suppose the "if it goes in it doesn't come out, except in a barrel" policy for the Red Zone helped contain it. (I worked in Health Physics, so potentially this could have affected systems that measure and track worker dosage.)

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>