Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Water system controllers don't belong on the internet, says ex-NSA chief

theregister.com

Post reply on HN
Print view View original

171–177 of 177 posts

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#171

Post by KetoManx64 »

amluto wrote: post #156
spauldo wrote: post #114

Earlier quoted context omitted.

A microcontroller based solution is rarely a good replacement for a PLC. You can find integrators willing to come out and troubleshoot your device in the field a lot more easily than embedded progammers and vendor support is usually excellent. When your plant is down, that sort of thing matters. PLCs handle harsh environments for decades, whereas with a microcontroller all the thermal issues and power conditioning ar…

This system barely deserves a PLC. The modules are only a couple of extremely basic analog inputs and outputs, plus a wildly outdated and unsupported HMI. And the entire plant could possibly be replaced with something more modern for less money than upgrading the PLC. (Or I could get something cheap from AutomationDirect - I have no idea how good their PLCs are.)

I worked at a manufacturing plant that had originally been setup in ~2003 or so and they had a bunch of servers and desktops still hanging on by a fingernail when started there. It took me about a year of but I was able to clone and virtualize them all and they all ran fine on a 6 core Proxmox server with 32GB of RAM. Really drove home the realization of how far technology has progressed and how commoditized manufacturing/enterprise tools have become.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#172

Post by mikestew »

tda wrote: post #150
aliasxneo wrote: post #31

Part of my career encapsulates a period where I was a PLC programmer, installer, commissioner, and troubleshooter for massive build outs (sky scrapers, data centers, laboratories, factories). Interestingly, this was after years of teaching myself software engineering, eventually participating in large open source projects. The clash of entering the PLC world was _extremely_ harsh. Let me give an example: I once worke…

Yep, everything is lacking. No version control, ladder diagrams instead of written code, goto statements as primary control flow in code. A $500 PLC with less processing power than a 1985 086 and 1 whole MB of memory. Upgradable with a $200 license to 1.5MB, only programmable with a 20GB monstrosity of a piece of software in which download means copying a program.e to the PLC, and upload means downloading a backup to…

Hey, hey, a little trigger warning over here? My last job before retirement was in that world. If it had been my first software job, it would have been my last.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#173

Post by procarch2019 »

andyjohnson0 wrote: post #138
amelius wrote: post #35

Earlier quoted context omitted.

Forgive my ignorance but isn't a PLC simply a computer with some GPIO ports? I.e., a Raspberry Pi could be called a PLC? Why are we talking about them as if they are something else? Is it an exotic OS that makes them different?

In addition to the other replies here: PLCs are ruggedised and built to survive for years in the kinds of hostile environment that are frequently found in industrial settings. And PLC vendors typically provide guaranteed support periods that are much longer (like a decade or more) than those commonly provided by conventional computer OEMs.

The hardware my company uses has a lifecycle of 15-20 (aka what we typically look at when we consider lifecycle of a plant). This is not meant to be the whole life of a plant, but possibly the life of the current controls. Things/people/companies change. I’ve seen some really shortsighted people rip and replace a sub-decade control system because of “bad experiences”. The industry can be great where it’s great and terrible where it’s terrible.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#174

Post by rgblambda »

psunavy03 wrote: post #168
rgblambda wrote: post #126

Earlier quoted context omitted.

The security vulnerabilities the NSA would use to spy on a system, or even just use as a jumping point to another system, can also be used by bad actors for other purposes, such as screwing with people's water.

Absolutely true. It's just tiresome to hear internet people decide the NSA is $GENERIC_VILLAIN when they're an intelligence agency with a given remit. Of course their job is to hack and penetrate foreign systems to get intelligence information for the Federal government. That's well-documented. But that's not the same as claiming their job is to create chaos for $PARANOID_REASON. That's internet tinfoil-hattery.

I don't think anyone was claiming that or anything remotely close to it. I was explaining why the NSA wouldn't necessarily be in favour of more digitally secure infrastructure, because you seemed to be the only person in the thread who didn't understand.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#175

Post by clbrmbr »

Wowfunhappy wrote: post #18
clbrmbr wrote: post #5

There are many wireless pump-and-reservoir systems that while not internet connected, use insecure RF links. These local RF (and casting a wider net, Bluetooth) interfaces are also ripe for abuse.

Wouldn't the physical facilities themselves have security?

The range on one RF system I worked on was 2mi with a wet noodle for an antenna.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#176

Post by [deleted] »

MajorTakeaway wrote: post #117
xtajv wrote: post #98

Earlier quoted context omitted.

Storytime: Once upon a time, I was a young grasshopper at a small consulting firm at which every employee was issued a Windows machine, our source control system was "\Customers" on C: drive, and our deployment strategy was "putty + copy-paste + hot-reload". One morning, I heard something terrible while my boss's boss's machine was booting. Something akin to grinding. The thing was angry. I gave boss^2 a heads-up tha…

Nasty looks seems to be the sign of them realizing how you proved them to be incompetent. Incompetence will cost them their job. If I had fuck you money I'd just call them incompetent fucks and laugh at them.

[deleted]

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#177

Post by giantg2 »

black6 wrote: post #151
giantg2 wrote: post #149

Earlier quoted context omitted.

"but you won't need to do it again for another quarter century." Hmm, so how do they handle the new cyber threats, since most of these are connected? It seems upgrades would need to be performed to address new threats. And just because something is not internet connected doesn't make it immune (eg stuxnet).

They shouldn't be connected is the point of the article. All PLC and DCS manufacturers are constantly working on threat mitigation and pushing out updates to address vulnerabilities. It's on the Process Controls team to decide what is an actual threat that requires patching.

Iran's PLC weren't connected. How did that turn out?
Post reply on HN