Reversing Industrial Firmware for Fun and Backdoors I
reversemode.com
Reversing Industrial Firmware for Fun and Backdoors I
1–10 of 24 posts
Re: Reversing Industrial Firmware for Fun and Backdoors I
#2> Despite I'm releasing this information when there is still no patch available, It has been my decission. I reported it to the ICS-CERT months ago, I would like to thank the ICS-CERT and the Schneider security team, they have taken these issues very seriously and are working on a patch. During the process they have been keeping me updated on every decission/progress. However, time ago I decided to change my disclosure policy.
That's a lousy disclosure policy.
Re: Reversing Industrial Firmware for Fun and Backdoors I
#3Surprise surprise...
PLC and other industrial software is a long way behind in terms of "software engineering". A college classmate did a graduation project/internship figuring out how to do version control and modularize PLC programs with device drivers.
Re: Reversing Industrial Firmware for Fun and Backdoors I
#4> Despite I'm releasing this information when there is still no patch available, It has been my decission. I reported it to the ICS-CERT months ago, I would like to thank the ICS-CERT and the Schneider security team, they have taken these issues very seriously and are working on a patch. During the process they have been keeping me updated on every decission/progress. However, time ago I decided to change my disclosu…
Playing devil's advocate: As the title says, the vendor included backdoors in the application. I'm not sure I can trust them and their clearly irresponsible development practices to patiently wait for them to handle this on their own.
Re: Reversing Industrial Firmware for Fun and Backdoors I
#5> Despite I'm releasing this information when there is still no patch available, It has been my decission. I reported it to the ICS-CERT months ago, I would like to thank the ICS-CERT and the Schneider security team, they have taken these issues very seriously and are working on a patch. During the process they have been keeping me updated on every decission/progress. However, time ago I decided to change my disclosu…
Playing devil's advocate: As the title says, the vendor included backdoors in the application. I'm not sure I can trust them and their clearly irresponsible development practices to patiently wait for them to handle this on their own.
> Playing devil's advocate: (...)
No you aren't. The parent post is playing devel's advocate; you are a down-to-earth, honest, practical user of software.
Re: Reversing Industrial Firmware for Fun and Backdoors I
#6Surprise surprise... PLC and other industrial software is a long way behind in terms of "software engineering". A college classmate did a graduation project/internship figuring out how to do version control and modularize PLC programs with device drivers.
What makes you think that the engineering teams in companies like Siemens, Rockwell Automation, Mitsubishi, GE etc. are "a long way behind in terms of 'software engineering'"? It is extremely misguided to think that all the thousands of engineers working in the Industrial Automation field are somehow behind others. I guess most of the HN crowd has very little exposure to the technologies in this field and most people probably consider this field uncool. But that doesn't mean the engineers working on these technologies are dumb and lagging behind others.
Re: Reversing Industrial Firmware for Fun and Backdoors I
#7> Despite I'm releasing this information when there is still no patch available, It has been my decission. I reported it to the ICS-CERT months ago, I would like to thank the ICS-CERT and the Schneider security team, they have taken these issues very seriously and are working on a patch. During the process they have been keeping me updated on every decission/progress. However, time ago I decided to change my disclosu…
Playing devil's advocate: As the title says, the vendor included backdoors in the application. I'm not sure I can trust them and their clearly irresponsible development practices to patiently wait for them to handle this on their own.
Almost all PLCs have back doors. Just because it uses Ethernet doesn't mean it does anything fancy. Almost all the PLCs I am aware of simply wrap existing RS 232 protocols over IP from the 80s and even earlier. Most of the plants actually seem to want these back doors, because downtime at a production facility is incredibly expensive.
PLCs are not designed to externally accessible, ever. The back doors are completely irrelevant anyway given that the PLC will accept any packet from anywhere, and perform the operation. The RS-232 commands are functions such as "enable bit", "disable bit", "set value", "read value", for actuating inputs and outputs.
Re: Reversing Industrial Firmware for Fun and Backdoors I
#8Surprise surprise... PLC and other industrial software is a long way behind in terms of "software engineering". A college classmate did a graduation project/internship figuring out how to do version control and modularize PLC programs with device drivers.
What makes you think that the engineering teams in companies like Siemens, Rockwell Automation, Mitsubishi, GE etc. are "a long way behind in terms of 'software engineering'"? It is extremely misguided to think that all the thousands of engineers working in the Industrial Automation field are somehow behind others. I guess most of the HN crowd has very little exposure to the technologies in this field and most people…
> What makes you think that the engineering teams in companies like Siemens, Rockwell Automation, Mitsubishi, GE etc. are "a long way behind in terms of 'software engineering'"?
data.
http://embeddedgurus.com/barr-code/2010/09/the-sad-state-of-...
I was in a class taught by this guy and I seem to recall him saying that a large (20-40%) of embedded developers he surveyed reported using no version control software.
and look at some of the responses in that thread!
"I think that gcc -Wall -Wextra can be subtituted by lint tool (if you use gcc)."
Re: Reversing Industrial Firmware for Fun and Backdoors I
#9Surprise surprise... PLC and other industrial software is a long way behind in terms of "software engineering". A college classmate did a graduation project/internship figuring out how to do version control and modularize PLC programs with device drivers.
What makes you think that the engineering teams in companies like Siemens, Rockwell Automation, Mitsubishi, GE etc. are "a long way behind in terms of 'software engineering'"? It is extremely misguided to think that all the thousands of engineers working in the Industrial Automation field are somehow behind others. I guess most of the HN crowd has very little exposure to the technologies in this field and most people…
You're right, I should have quantified that statement a little better. The PLC manufacturers I'm sure have good software engineering practices. I'm just not sure the rest of the ecosystem is as developed as for instance the "web development" ecosystem, atleast from my experiences.
Mind you, I do live in the Netherlands, and it seems lots of PLC systems are designed by electrical engineers who started out in that or something else and don't know about much on the Joel Test. But I can be proven wrong.
A contributing factor is probably that each vendor has his/her toolkit which in some sense is proprietary, and so the market for general tools is smaller, and it's an enterprise market making it harder to sell to.
Re: Reversing Industrial Firmware for Fun and Backdoors I
#10Earlier quoted context omitted.
What makes you think that the engineering teams in companies like Siemens, Rockwell Automation, Mitsubishi, GE etc. are "a long way behind in terms of 'software engineering'"? It is extremely misguided to think that all the thousands of engineers working in the Industrial Automation field are somehow behind others. I guess most of the HN crowd has very little exposure to the technologies in this field and most people…
> What makes you think that the engineering teams in companies like Siemens, Rockwell Automation, Mitsubishi, GE etc. are "a long way behind in terms of 'software engineering'"? data. http://embeddedgurus.com/barr-code/2010/09/the-sad-state-of-... I was in a class taught by this guy and I seem to recall him saying that a large (20-40%) of embedded developers he surveyed reported using no version control software . an…
"I was in a class taught by this guy and I seem to recall him saying that a large (20-40%) of embedded developers he surveyed reported using no version control software."
Yeah, but that's a vendor issue; it's not that the Engineers don't want to use version control.
We'd like to, for example, but we usually can't. All of the file formats for these PLC tools are binary blobs, and since the language is usually a graphical language (ladder logic) the conventional idea of diff is pretty meaningless unless someone writes a proprietary version control to handle the binary blobs + representing ladder logic through diffs.
We still try to use it, but we lose most of the benefits. I suppose you still get a changelog, but you can't ever merge branches since merging binary blobs with binary blobs will not go well for you.