Live data from Hacker News

Water system controllers don't belong on the internet, says ex-NSA chief

theregister.com

51–60 of 166 posts

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#51

Earlier quoted context omitted.

Okay but then is the RF connection really your biggest concern? I'm kind of worried (probably unnecessarily) that posting ideas would get me on some list, but it seems like there would be many simpler terrorism opportunities once you have physical access.

Historically people just shoot pipelines and transformers.

WWII provides some interesting data points. On the one hand, yes, as Germany occupied numerous neighbours people - even sometimes in the face of group punishment, kept sabotaging the German military and its logistics. In some cases there are literally enemy agents, the Special Operations Executive† but often they're local partisans either working with the SOE or on their own.

But on the other hand, even though the Americans suspected that people who merely looked Japanese might be traitors, AFAIK there aren't any clear examples where the people who were sent to camps actually were enemy spies who'd have sabotaged America given the chance. And in Britain the counter-intelligence operation was so successful that when captured German spymasters revealed their list of agents in Britain, every name was already either working for Twenty Department (20 = XX = Double Cross, we can't resist a pun) or in prison for espionage or dead.

† notably in WWII if as a woman you say you want to be on a ship of the line, or crew front line aircraft and attack the Nazis you will be told women can't serve front line roles and at most you'll be doing delivery runs in relative safety. But if you know the right people to become a spy they will cheerfully send you behind enemy lines even though if caught you will almost certainly be horribly tortured and then probably killed and the government which sent you won't even acknowledge you existed for years.

So, maybe the risk from people who are already where your infrastructure is is much lower that you'd think if you haven't invaded them and occupied their land. On the other hand remote adversaries are definitely always a risk.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#52

Part of my career encapsulates a period where I was a PLC programmer, installer, commissioner, and troubleshooter for massive build outs (sky scrapers, data centers, laboratories, factories). Interestingly, this was after years of teaching myself software engineering, eventually participating in large open source projects. The clash of entering the PLC world was _extremely_ harsh. Let me give an example: I once worke…

Everything you're describing mirrors my experience with remote scientific deployments and lab equipment (wet labs in particular). I support a team which manages dozens of these, and while it's shocking how inefficient and unsafe their practices are, it's similarly shocking how poorly the industry has kept up with or even tried to establish better practices. We get brand new equipment that costs in the realm of $10k f…

Not only is the pay worse (like literally half of what you make doing webdev for a corp), but they mandate you be on site at a factory working first shift like you're on the production floor or something, clocking in and out when you're a salary worker. It's an awful culture.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#53
post #35

Earlier quoted context omitted.

You’d be surprised how insecure some of these facilities are, especially to someone who has working knowledge of what a PLC (or other process controllers) does and how it works. You can easily look like a tech who belongs there either troubleshooting something or working on a project. I’ve been doing industrial controls for 15 years and surprisingly infrastructure is some of the most poorly funded. I believe a lot of…

Forgive my ignorance but isn't a PLC simply a computer with some GPIO ports? I.e., a Raspberry Pi could be called a PLC? Why are we talking about them as if they are something else? Is it an exotic OS that makes them different?

If a Raspberry Pi had industrial environment ratings and was certified hard real time, then yes it could be considered a PLC.

All the ones I've encountered in the wild ran VxWorks

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#54
post #43

With coding agents now being used for hacking, there's a decent chance we'll see a 9/11-scale hacking incident as a result of NSA/DHS negligence in securing American internet-connected services. Similar to how the CIA's negligence allowed 9/11 itself. The USG should be deploying thousands of security engineers armed with the latest coding models and agents, in attempt to secure systems before they're hacked. A few bi…

Unlike the CIA and/or FBI being in charge of preventing attacks like 9/11, NSA and DHS aren't in charge of each state's or city's infrastructure. They could run some opt-in program that local governments could then engage with, but "negligence" is a bit strong for systems they're not in charge of and have no access to.

“Not in charge of” can agree

“Have no access to” I have doubts

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#55

With coding agents now being used for hacking, there's a decent chance we'll see a 9/11-scale hacking incident as a result of NSA/DHS negligence in securing American internet-connected services. Similar to how the CIA's negligence allowed 9/11 itself. The USG should be deploying thousands of security engineers armed with the latest coding models and agents, in attempt to secure systems before they're hacked. A few bi…

https://www.nsa.gov/Cybersecurity/Cybersecurity-Advisories-G...

While that’s not the job of the NSA, they do produce a lot of good cybersecurity guides.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#56

With coding agents now being used for hacking, there's a decent chance we'll see a 9/11-scale hacking incident as a result of NSA/DHS negligence in securing American internet-connected services. Similar to how the CIA's negligence allowed 9/11 itself. The USG should be deploying thousands of security engineers armed with the latest coding models and agents, in attempt to secure systems before they're hacked. A few bi…

https://www.nsa.gov/Cybersecurity/Cybersecurity-Advisories-G... While that’s not the job of the NSA, they do produce a lot of good cybersecurity guides.

NSA's job is SIGINT, so it's at least partly their responsibility when the threat is foreign.

For example, the NSA should be successfully infiltrating every major foreign hacking team in the world and monitoring and/or disrupting their activities.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#57

Part of my career encapsulates a period where I was a PLC programmer, installer, commissioner, and troubleshooter for massive build outs (sky scrapers, data centers, laboratories, factories). Interestingly, this was after years of teaching myself software engineering, eventually participating in large open source projects. The clash of entering the PLC world was _extremely_ harsh. Let me give an example: I once worke…

The worst part -as I mentioned in another comment few days earlier- is most of the network is ancient, dialup, poor architecture designed by people who barely touched a computer, very old OSes, one utility had windows 3.1 a couple years ago! For them as long as it’s working, don’t touch it, because a downtime is far more costly and it will bring many eyes and attention to them than just sit and hope nothing will happen. Physical security is a major gap too, I have been to many locations where the field server panels are just behind the door, the RTUs are just closed with panel keys, even the whole facility are using some old HID cards that you can unlock in few seconds, this is even in R&D that beyond automation but also in robotic ones.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#58

With coding agents now being used for hacking, there's a decent chance we'll see a 9/11-scale hacking incident as a result of NSA/DHS negligence in securing American internet-connected services. Similar to how the CIA's negligence allowed 9/11 itself. The USG should be deploying thousands of security engineers armed with the latest coding models and agents, in attempt to secure systems before they're hacked. A few bi…

How is it NSA/DHS negligence? Neither is responsible for securing the infrastructure of state and local governments nor private companies.

They should provide guidance, but I’m not sure we really want the NSA inside of networks more than they already are.

If voters and CEOs don’t want to spend the money required to secure their infrastructure, that’s on them.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#59
post #5

There are many wireless pump-and-reservoir systems that while not internet connected, use insecure RF links. These local RF (and casting a wider net, Bluetooth) interfaces are also ripe for abuse.

Wouldn't the physical facilities themselves have security?

RF as in radio. Radio waves have this nasty habit of leaking out past the fence: https://cyote.inl.gov/content/uploads/24/2025/12/CyOTE-Case-...

In water/wastewater much of infrastructure is physically remote and physical security is the typical engineering trade offs. https://validmfg.com/product/lift-station/

Inside this box you have access to the “production” network, if you will. Unfortunately, most SCADA systems implicitly trust their RTUs/PLCs, so this has always been a weak point for the system. Hopefully the situation has improved.

The reality is that critical infrastructure is rarely tested against genuine hostility, except in times of war. There is “cyber” activity going on all the time, but attacks that require physical proximity will probably only happen when things have escalated to hardware. Hopefully the NSA’s of the world run “pen testing” for these companies from time to time.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#60
post #35

Earlier quoted context omitted.

You’d be surprised how insecure some of these facilities are, especially to someone who has working knowledge of what a PLC (or other process controllers) does and how it works. You can easily look like a tech who belongs there either troubleshooting something or working on a project. I’ve been doing industrial controls for 15 years and surprisingly infrastructure is some of the most poorly funded. I believe a lot of…

Forgive my ignorance but isn't a PLC simply a computer with some GPIO ports? I.e., a Raspberry Pi could be called a PLC? Why are we talking about them as if they are something else? Is it an exotic OS that makes them different?

Not really, sure you can use a rpi to control some hw but they are not the same, a PLC usually run rtos, is deterministic (you can predict timing) while rpi relies on linux OS and its scheduler, the PLC also uses ladder language or function block compared to rpi high level language, and obviously PLC industrial grade I/O both analog and digital that also deal with voltage noise that usually happens by field sensors, and environmentally rugged and rated to run non stop compared to rpi.

Now, if you really want to use rpi as a plc, you need something like openplc or codesys as a runtime, add some HATs for I/O, and use protocols like modbus. It will be a software plc but you are missing the hardware certification and other features. Rpi is good as edge computing rather than plc, like processing vision or data logging, it’s why in drones you need the autopilot AND rpi or companion computer, each does certain functions.

Post reply on HN