Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reversing Industrial Firmware for Fun and Backdoors I

reversemode.com

Post reply on HN
Print view View original

11–20 of 24 posts

Re: Reversing Industrial Firmware for Fun and Backdoors I

#11

Post by VMG »

YetAnotherAlias wrote: post #6
joelhaasnoot wrote: post #3

Surprise surprise... PLC and other industrial software is a long way behind in terms of "software engineering". A college classmate did a graduation project/internship figuring out how to do version control and modularize PLC programs with device drivers.

What makes you think that the engineering teams in companies like Siemens, Rockwell Automation, Mitsubishi, GE etc. are "a long way behind in terms of 'software engineering'"? It is extremely misguided to think that all the thousands of engineers working in the Industrial Automation field are somehow behind others. I guess most of the HN crowd has very little exposure to the technologies in this field and most people…

Try to work with Siemens Step7 for just one day.

Re: Reversing Industrial Firmware for Fun and Backdoors I

#12

Post by AndrewDucker »

barik wrote: post #10
munin wrote: post #8

Earlier quoted context omitted.

> What makes you think that the engineering teams in companies like Siemens, Rockwell Automation, Mitsubishi, GE etc. are "a long way behind in terms of 'software engineering'"? data. http://embeddedgurus.com/barr-code/2010/09/the-sad-state-of-... I was in a class taught by this guy and I seem to recall him saying that a large (20-40%) of embedded developers he surveyed reported using no version control software . an…

"I was in a class taught by this guy and I seem to recall him saying that a large (20-40%) of embedded developers he surveyed reported using no version control software." Yeah, but that's a vendor issue; it's not that the Engineers don't want to use version control. We'd like to, for example, but we usually can't. All of the file formats for these PLC tools are binary blobs, and since the language is usually a graphi…

You get a change log, a central repository, and the ability to roll back to previous versions.

That's pretty valuable, even without the ability to merge.

Re: Reversing Industrial Firmware for Fun and Backdoors I

#13

Post by barik »

AndrewDucker wrote: post #12
barik wrote: post #10

Earlier quoted context omitted.

"I was in a class taught by this guy and I seem to recall him saying that a large (20-40%) of embedded developers he surveyed reported using no version control software." Yeah, but that's a vendor issue; it's not that the Engineers don't want to use version control. We'd like to, for example, but we usually can't. All of the file formats for these PLC tools are binary blobs, and since the language is usually a graphi…

You get a change log, a central repository, and the ability to roll back to previous versions. That's pretty valuable, even without the ability to merge.

It's not really as useful as you make it out to be, since PLC code doesn't exist in isolation; there is __usually__ corresponding hardware. Unless you plan on magically "rolling back the hardware" changes as well, rolling back the software isn't all that useful in practice. Even if you can, changes are not made by any one vendor. Plant modifications happen all the time, so it's more often the case that you just end up uploading directly from the controller itself to see what the latest code is. I don't really have a good solution to that.

The exception of course is some very large companies that do everything in house.

Re: Reversing Industrial Firmware for Fun and Backdoors I

#14

Post by barik »

VMG wrote: post #11
YetAnotherAlias wrote: post #6

Earlier quoted context omitted.

What makes you think that the engineering teams in companies like Siemens, Rockwell Automation, Mitsubishi, GE etc. are "a long way behind in terms of 'software engineering'"? It is extremely misguided to think that all the thousands of engineers working in the Industrial Automation field are somehow behind others. I guess most of the HN crowd has very little exposure to the technologies in this field and most people…

Try to work with Siemens Step7 for just one day.

Siemens has quite a peculiar bit of software; it is the only product that I have seen that requires you reboot BEFORE installation of every single Siemens product.

I think installing all of the Siemens software requires something like 15 reboots, at last count. And I have no idea why.

Re: Reversing Industrial Firmware for Fun and Backdoors I

#15

Post by barik »

joelhaasnoot wrote: post #9
YetAnotherAlias wrote: post #6

Earlier quoted context omitted.

What makes you think that the engineering teams in companies like Siemens, Rockwell Automation, Mitsubishi, GE etc. are "a long way behind in terms of 'software engineering'"? It is extremely misguided to think that all the thousands of engineers working in the Industrial Automation field are somehow behind others. I guess most of the HN crowd has very little exposure to the technologies in this field and most people…

You're right, I should have quantified that statement a little better. The PLC manufacturers I'm sure have good software engineering practices. I'm just not sure the rest of the ecosystem is as developed as for instance the "web development" ecosystem, atleast from my experiences. Mind you, I do live in the Netherlands, and it seems lots of PLC systems are designed by electrical engineers who started out in that or s…

"PLC systems are designed by electrical engineers who started out in that or something else and don't know about much on the Joel Test. But I can be proven wrong."

That's probably true, given that PLCs were originally for electrical engineers as means of having "software relays". The concept of computer engineers came much later, and for computer science, they typically have zero electrical background which means that even if they program really well, it can be the case that they don't understand the physical implications of the code that they've just written.

In computer science, writing True might mean it's magically on, but in real life, a valve actually has a small delay before it physically is open. So a time delay has to be placed on the output. That's a simple example, but there are other such nuances of electrical/physical devices. Also, much of PLC programming (especially in process control) is control theory (PID controllers, essentially differential equations so that devices actuate "smoothly" instead of in a "jerky" manner). This also seems to not be covered in a CS curriculum.

Re: Reversing Industrial Firmware for Fun and Backdoors I

#16

Post by andylei »

munin wrote: post #8
YetAnotherAlias wrote: post #6

Earlier quoted context omitted.

What makes you think that the engineering teams in companies like Siemens, Rockwell Automation, Mitsubishi, GE etc. are "a long way behind in terms of 'software engineering'"? It is extremely misguided to think that all the thousands of engineers working in the Industrial Automation field are somehow behind others. I guess most of the HN crowd has very little exposure to the technologies in this field and most people…

> What makes you think that the engineering teams in companies like Siemens, Rockwell Automation, Mitsubishi, GE etc. are "a long way behind in terms of 'software engineering'"? data. http://embeddedgurus.com/barr-code/2010/09/the-sad-state-of-... I was in a class taught by this guy and I seem to recall him saying that a large (20-40%) of embedded developers he surveyed reported using no version control software . an…

> a large (20-40%) of embedded developers he surveyed reported using no version control software.

that's obviously bad, but is it higher than developers across disciplines? i'm sure you guys all use version control, but if you surveyed all web devs, how many of them use version control? i'd bet its a similar number

Re: Reversing Industrial Firmware for Fun and Backdoors I

#17

Post by lawnchair_larry »

DanBC wrote: post #2

> Despite I'm releasing this information when there is still no patch available, It has been my decission. I reported it to the ICS-CERT months ago, I would like to thank the ICS-CERT and the Schneider security team, they have taken these issues very seriously and are working on a patch. During the process they have been keeping me updated on every decission/progress. However, time ago I decided to change my disclosu…

Nope, the only thing lousy is not saying it sooner. I am glad he decided that he will not be complicit in such reprehensible behavior from a vendor. Knowingly exposing your customers to harm without disclosure should have stiff penalties.

Re: Reversing Industrial Firmware for Fun and Backdoors I

#18

Post by pnathan »

barik wrote: post #15
joelhaasnoot wrote: post #9

Earlier quoted context omitted.

You're right, I should have quantified that statement a little better. The PLC manufacturers I'm sure have good software engineering practices. I'm just not sure the rest of the ecosystem is as developed as for instance the "web development" ecosystem, atleast from my experiences. Mind you, I do live in the Netherlands, and it seems lots of PLC systems are designed by electrical engineers who started out in that or s…

"PLC systems are designed by electrical engineers who started out in that or something else and don't know about much on the Joel Test. But I can be proven wrong." That's probably true, given that PLCs were originally for electrical engineers as means of having "software relays". The concept of computer engineers came much later, and for computer science, they typically have zero electrical background which means tha…

It's not really that big a deal to grasp the physical implications of code and timing. Any network code will have the same issue, i.e., any web coding.

The industrial controls industry has a very 1980s/1990s attitude for cybersecurity. I don't envy the public-facing engineers working for the vendors.

Re: Reversing Industrial Firmware for Fun and Backdoors I

#19

Post by anamax »

barik wrote: post #13
AndrewDucker wrote: post #12

Earlier quoted context omitted.

You get a change log, a central repository, and the ability to roll back to previous versions. That's pretty valuable, even without the ability to merge.

It's not really as useful as you make it out to be, since PLC code doesn't exist in isolation; there is __usually__ corresponding hardware. Unless you plan on magically "rolling back the hardware" changes as well, rolling back the software isn't all that useful in practice. Even if you can, changes are not made by any one vendor. Plant modifications happen all the time, so it's more often the case that you just end u…

> It's not really as useful as you make it out to be, since PLC code doesn't exist in isolation; there is __usually__ corresponding hardware.

You never change the SW without changing the hardware?

Wowsers. No new features and no bugs.

Re: Reversing Industrial Firmware for Fun and Backdoors I

#20

Post by eigenvector »

YetAnotherAlias wrote: post #6
joelhaasnoot wrote: post #3

Surprise surprise... PLC and other industrial software is a long way behind in terms of "software engineering". A college classmate did a graduation project/internship figuring out how to do version control and modularize PLC programs with device drivers.

What makes you think that the engineering teams in companies like Siemens, Rockwell Automation, Mitsubishi, GE etc. are "a long way behind in terms of 'software engineering'"? It is extremely misguided to think that all the thousands of engineers working in the Industrial Automation field are somehow behind others. I guess most of the HN crowd has very little exposure to the technologies in this field and most people…

> I guess most of the HN crowd has very little exposure to the technologies in this field and most people probably consider this field uncool.

I'm always reminded of a conversation with a fresh Google hire wherein she said "How can you stand working at a utility, don't you want your work to affect PEOPLE?", as if utilities don't have hundreds of thousands or millions of customers that we provide an essential service to.

Post reply on HN