Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Water system controllers don't belong on the internet, says ex-NSA chief

theregister.com

Post reply on HN
Print view View original

101–110 of 166 posts

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#101

Post by ssl-3 »

skinfaxi wrote: post #80
ssl-3 wrote: post #76

Earlier quoted context omitted.

You mean like, just hang a thumb drive on a lanyard inside of the cabinet -- with source code and such? That will probably just disappear. Maybe with good intention or maybe with bad, but it's probably gone either way. If it doesn't disappear, then it's hanging right there for any of the competitors to use. That's a problem for the original installer's ongoing employment. And if it includes the programming software,…

> If it doesn't disappear, then it's hanging right there for any of the competitors to use. That's a problem for the original installer's ongoing employment. Is that really an issue? Do PLC vendors have concerns about other vendors turning up and yanking USB drives out of critical infrastructure with reckless abandon? Do the facilities themselves see no issue with potential vendors yanking operational utilities out o…

Eh?

It's just a thumb drive, on a lanyard, hanging in a cabinet. It's not like it has guards posted. :)

Maybe Joe (from shipping) took it back to his desk to have a squiz at it and try to passively learn something new during some otherwise-downtime and never returned it -- years ago. That cabinet is in his area, so he has the key.

Maybe Tim (the plant electrician) borrowed it to get something else done, and it unintentionally disappeared somewhere along the way. Tim has all of the keys for all of the things.

Maybe Emily (the ubergeek who prides herself on being able to code her way out of a mess on any system) had it in her office before she got hit by a car and lost the ability to communicate with polysyllabic words. She borrowed Joe's cabinet key after he mentioned an issue.

Either way, it was just a thumb drive that had been inside of the cabinet, and now it is gone.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#102

Post by closeparen »

Kim_Bruning wrote: post #9

Don't put your PLCs directly on the internet. In fact most industrial stuff is very not made to be directly connected to the internet. But interpose a firewall+VPN solution and you might be ok, if done competently. And remote access to hardware definitely makes management and maintenance a lot easier and quicker. (else you need to drive out for every minor issue)

If we can beat a security-state airgap by sprinkling USB drives in the parking lot, I think the Iranians can beat an "internal" network by getting someone to click on an email attachment or visit the wrong website on their municipal issued Windows machine.

It's very common for the proprietary software for interfacing with ancient, expensive machines to break after OS upgrades, so they're probably unpatched... you might not even need to burn a 0-day.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#103

Post by closeparen »

judge2020 wrote: post #71
barbazoo wrote: post #41

Earlier quoted context omitted.

If that means you need to at least be physically present then I'd say that's a lot of protection already. Means someone in a foreign country can't simply get lucky fuzzing.

Alternatively, small drones exist, and so do low power devices you could slingshot/shoot into a secure area and set to auto wipe after they've done their job. Maybe could even build it out of biodegradable material so it'll clean up in short time.

If you've got secret agents on enemy soil who can get near targets with drones, you're probably just bombing them.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#104

Post by judge2020 »

closeparen wrote: post #103
judge2020 wrote: post #71

Earlier quoted context omitted.

Alternatively, small drones exist, and so do low power devices you could slingshot/shoot into a secure area and set to auto wipe after they've done their job. Maybe could even build it out of biodegradable material so it'll clean up in short time.

If you've got secret agents on enemy soil who can get near targets with drones, you're probably just bombing them.

Unless you're running out of munitions.

And nuclear isn't exactly a great option.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#105

Post by skinfaxi »

ssl-3 wrote: post #101
skinfaxi wrote: post #80

Earlier quoted context omitted.

> If it doesn't disappear, then it's hanging right there for any of the competitors to use. That's a problem for the original installer's ongoing employment. Is that really an issue? Do PLC vendors have concerns about other vendors turning up and yanking USB drives out of critical infrastructure with reckless abandon? Do the facilities themselves see no issue with potential vendors yanking operational utilities out o…

Eh? It's just a thumb drive, on a lanyard, hanging in a cabinet. It's not like it has guards posted. :) Maybe Joe (from shipping) took it back to his desk to have a squiz at it and try to passively learn something new during some otherwise-downtime and never returned it -- years ago. That cabinet is in his area, so he has the key. Maybe Tim (the plant electrician) borrowed it to get something else done, and it uninte…

Things like thumb drives physically connected to cabinets can just disappear in your environment with no followup whatsoever? And that's regular, expected, and desired?

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#106

Post by ssl-3 »

procarch2019 wrote: post #93
ssl-3 wrote: post #76

Earlier quoted context omitted.

You mean like, just hang a thumb drive on a lanyard inside of the cabinet -- with source code and such? That will probably just disappear. Maybe with good intention or maybe with bad, but it's probably gone either way. If it doesn't disappear, then it's hanging right there for any of the competitors to use. That's a problem for the original installer's ongoing employment. And if it includes the programming software,…

Even more so, if it’s just there you’re making it easy for the customer to find someone bidding less to execute new projects. Guess who they’re calling if they don’t have the plc project (or don’t understand they need it). Job security. Plus, yea, someone could really make a mess even if they have the best intention. A guy from my company almost uploaded the wrong program to a large bioreactor. At best it would have…

I don't get into PLCs, per se, but I've done some stuff with other building-scale gear.

Like: We took care of the centralized controls for the inmate portion of a jail that was built in the 1980s. We rejiggered the controls for that whole jail back around 2010 or so with new kit and had been taking care of it since then.

All the wiring for all of the individual doors and intercoms was documented in one old 3-ring binder. (There were probably 3 copies originally -- for the architect, the maintenance room, and the equipment room, but just 1 remained and it had hand-written notes.)

One day, around 2020-ish, they called us because the book was missing. I didn't have it (I never once left the equipment room with it), and the co-workers who had been there insisted that they didn't have it either.

As time passed, we'd get occasional phone calls of "Hey, we really could use the book for our building back if you guys ever find it." They weren't angry calls, but sheesh: That book had real value and getting stuff done without it was difficult. So every time when they'd call again, I'd ask around our shop -- again -- if it had turned up anywhere.

And then, finally: One of our guys cleaned out his truck and found it. He must have taken the book out to look at and have a smoke about some problem or other, and then it just stayed in his truck. For years.

This shit happens. People are imperfect and sometimes we screw stuff up.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#107

Post by ssl-3 »

skinfaxi wrote: post #105
ssl-3 wrote: post #101

Earlier quoted context omitted.

Eh? It's just a thumb drive, on a lanyard, hanging in a cabinet. It's not like it has guards posted. :) Maybe Joe (from shipping) took it back to his desk to have a squiz at it and try to passively learn something new during some otherwise-downtime and never returned it -- years ago. That cabinet is in his area, so he has the key. Maybe Tim (the plant electrician) borrowed it to get something else done, and it uninte…

Things like thumb drives physically connected to cabinets can just disappear in your environment with no followup whatsoever? And that's regular, expected, and desired?

So they conduct a formal investigation. Top Men descend upon the facility to figure out whether we blame Joe, or Tim, or Emily. Heads roll.

And the thumb drive is still gone, isn't it?

---

No, it's not regular. It's not desired.

Does shit never go wrong in your world? If not, then: Perhaps you should start expecting it to. :)

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#108

Post by cyberax »

amelius wrote: post #35
procarch2019 wrote: post #25

Earlier quoted context omitted.

You’d be surprised how insecure some of these facilities are, especially to someone who has working knowledge of what a PLC (or other process controllers) does and how it works. You can easily look like a tech who belongs there either troubleshooting something or working on a project. I’ve been doing industrial controls for 15 years and surprisingly infrastructure is some of the most poorly funded. I believe a lot of…

Forgive my ignorance but isn't a PLC simply a computer with some GPIO ports? I.e., a Raspberry Pi could be called a PLC? Why are we talking about them as if they are something else? Is it an exotic OS that makes them different?

Technically it is, but in practice they often speak very obscure protocols over non-Ethernet links.

Honestly, I think it's an advantage at this point. Way too much diversity to easily attack remotely.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#109

Post by hackernud3s »

tedd4u wrote: post #85
technion wrote: post #42

Earlier quoted context omitted.

Im supposed to be doing endpoint work with people working in this field amd basically have to convince compliance they'll need to be local administrators to do their job. They get onsite and dont know what app they'll need until they look at a plc model. They'll download something from a .tw ftp server and its an unsigned executable that absolutely must run as admin to program these things. It is amazing how much of…

Oof, that's bad. Iran got burned real bad by Stuxnet, you know they would love to score big with PLC sabotage.

I feel like this is, worst case scenario, people drinking bottled water for a week. It's no stuxnet.

Re: Water system controllers don't belong on the internet, says ex-NSA chief

#110

Post by vharuck »

pigbearpig wrote: post #58
jacobgold wrote: post #38

With coding agents now being used for hacking, there's a decent chance we'll see a 9/11-scale hacking incident as a result of NSA/DHS negligence in securing American internet-connected services. Similar to how the CIA's negligence allowed 9/11 itself. The USG should be deploying thousands of security engineers armed with the latest coding models and agents, in attempt to secure systems before they're hacked. A few bi…

How is it NSA/DHS negligence? Neither is responsible for securing the infrastructure of state and local governments nor private companies. They should provide guidance, but I’m not sure we really want the NSA inside of networks more than they already are. If voters and CEOs don’t want to spend the money required to secure their infrastructure, that’s on them.

DHS has the Cybersecurity & Infrastructure Security Agency. Their job is to help organizations in the US with protecting public services and physical infrastructure. They are partially responsible for the outcomes.

https://www.cisa.gov/

Post reply on HN