They aren't even talking about what happened in San Diego :-\ SCADA controls those power systems too ;-)
So the Blackout was due to a SCADA hack?
Hackers destroy water pump via SCADA abuse
11–20 of 42 posts
Re: Hackers destroy water pump via SCADA abuse
#12This seems like an exciting decade we are about to enter where hackers can mess with actual physical infrastructure. Sooner or later somebody is going to do something really destructive with that power.
Fortunately it shouldn't be that hard to secure the systems. At the very least use a two factor authentication system, if possible the same way gmail does since it is pretty simple, or just store the passwords in a big physical folder and access as necessary.
Re: Hackers destroy water pump via SCADA abuse
#13This seems like an exciting decade we are about to enter where hackers can mess with actual physical infrastructure. Sooner or later somebody is going to do something really destructive with that power. Fortunately it shouldn't be that hard to secure the systems. At the very least use a two factor authentication system, if possible the same way gmail does since it is pretty simple, or just store the passwords in a bi…
Exactly what good does "two factor authentication" do when every verb in the protocol was designed with the assumption that the protocol would only ever be addressed with an authorized client? These things are insecure by design, insecure in implementation, and insecure at deployment. Don't trivialize the problem; it's immense.
Maybe password theft was involved this time, but that's a trivial detail. I don't feel like endorsing feel-good measures. A lot of this code really needs to be forklifted out, which is a fact made especially painful because a lot of this code is already pushing the limits of the 8 bit TI microcontrollers it runs on.
Re: Hackers destroy water pump via SCADA abuse
#14Good. Malicious crackers, please destroy as many non-safety-critical water pumps as it takes for people to take security on these systems seriously. It seems most of the industrial controls industry is used to operating on a proprietary network, and when moving to IP their guess at security is "uh, firewall?".
This is indeed odd. On my home network, I have a firewall at the edge, a firewall on each machine, and every service requires authentication (cryptographic where possible; username+password over SSL otherwise). It took me about a day to set up, and I'm not even a security person. It's unacceptable that people whose jobs are to secure computer networks do a worse job than I do for the little computer under my TV. (Yup…
SCADA systems often rely on time-deterministic routing of packets, which TCP/IP doesn't make easy. There are a number of issues with securing them, including the fact that unscheduled downtime can be catastrophic (ergo, no hotpatching without massive work).
There are some good posts on the SCADASEC mailing list. There are some lousy posts as well.
Culturally, SCADA system security is approximately where IT systems were in in 1995 with Windows 95.
Re: Hackers destroy water pump via SCADA abuse
#15This seems like an exciting decade we are about to enter where hackers can mess with actual physical infrastructure. Sooner or later somebody is going to do something really destructive with that power. Fortunately it shouldn't be that hard to secure the systems. At the very least use a two factor authentication system, if possible the same way gmail does since it is pretty simple, or just store the passwords in a bi…
Sadly, that decade was two years ago. It's been well known how broken SCADA systems are, and shouted from the rooftops, but no one cares. We have been on borrowed time now for ages. It finally happened.
Re: Hackers destroy water pump via SCADA abuse
#16So let's take bets. Was this hack attack made possible through:
1) A SQL injection
2) A default admin password
Re: Hackers destroy water pump via SCADA abuse
#17They aren't even talking about what happened in San Diego :-\ SCADA controls those power systems too ;-)
So the Blackout was due to a SCADA hack?
The system is redundant, and no single operator should be able to do what was done that day. The military bases went delta-5. Largest military port city, and China's looking to let the fire out of their dragon...
Dark days, eh?
Re: Hackers destroy water pump via SCADA abuse
#18Good. Malicious crackers, please destroy as many non-safety-critical water pumps as it takes for people to take security on these systems seriously. It seems most of the industrial controls industry is used to operating on a proprietary network, and when moving to IP their guess at security is "uh, firewall?".
I'm amazed that the concept of "air gap" isn't standard operating procedure at any utility.
Re: Hackers destroy water pump via SCADA abuse
#19Earlier quoted context omitted.
This is indeed odd. On my home network, I have a firewall at the edge, a firewall on each machine, and every service requires authentication (cryptographic where possible; username+password over SSL otherwise). It took me about a day to set up, and I'm not even a security person. It's unacceptable that people whose jobs are to secure computer networks do a worse job than I do for the little computer under my TV. (Yup…
how many users does your home system have? what is your budget like to support them? what is your pain point for "at this overhead we just go out of business?" it's a lot more complicated than "just do it right". I'm not saying we shouldn't take effort to do it right, but right now the market doesn't price for security so ...
How many users does a water pump have?
Hell, this probably shouldn't have been networked in the first place.
Re: Hackers destroy water pump via SCADA abuse
#20Did anyone else notice this choice comment:
“They just figured it’s part of the normal instability of the system,” Weiss told Wired.com. “But it wasn’t until the SCADA system actually turned on and off that they realized something was wrong.”
That's a pretty bad sign that the system is so buggy that at first it seems like a hacking attempt is just "normal" instability.