Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I think the military commissary's freezers were hacked

signalandsilence.substack.com

Post reply on HN
Print view View original

81–90 of 252 posts

Re: I think the military commissary's freezers were hacked

#81

Post by gopher_space »

peterabbitcook wrote: post #49
sidewndr46 wrote: post #33

Earlier quoted context omitted.

Isn't this the industry expectation in that kind of equipment? If it was signed by a real CA the cert. could expire and render the equipment unable to communicate.

That’s a tough question. If your PLC is on an airgapped LAN, admin/admin is not great security hygiene but you’ve reduced most of the risk by airgapping. On my project the service I wrote was doing bidirectional communication with the PLC over OPCUA. The server running this pod was connected to the internet, so it was critical to have proper TLS for the OPCUA client/server. Rotating LetsEncrypt certs on the system ev…

> admin/admin is not great security hygiene but you’ve reduced most of the risk by airgapping.

admin/admin is on a post-it stuck to the monitor because everyone we hire is perfectly capable of rooting a machine they have physical access to.

Re: I think the military commissary's freezers were hacked

#82

Post by TZubiri »

CobaltFire wrote: post #67

As someone who spent over 20 years active duty, and spent a ton of my career in the IT, security, etc. side of the house: Unlikely to be a hack, more likely to be a misconfiguration or update sent incorrectly. That said, the timing of the disclosure and the issue are rather concerning. Regarding the highest value targets to hit with an attack like this, you would want to target Guam, Hawai'i, and other isolated overs…

>Unlikely to be a hack, more likely to be a misconfiguration or update sent incorrectly.

Are these materially different? Assuming that there wasn't a literal command to turn off all freezers, from an organizational, non criminal perspective, to the organization the damage will be the same, the root cause will be a bug (whether exploited by chance or malice), and the fix will be the same(fixing the bug).

Re: I think the military commissary's freezers were hacked

#83

Post by lenerdenator »

peterabbitcook wrote: post #29

A couple years ago I worked on a service that had to communicate with a Siemens S7-1500 PLC. Based on my experience with that project, none of what I’ve read recently about unsecured industrial PLCs is surprising. I opened Siemens TIA Portal and PLCSIM for the first time and thought “wow, I didn’t think the Windows 95 GUI library was still supported.” None of the PLC contractors we had hired knew how to enable TLS on…

> In all fairness, the people who are experts in the field of Siemens PLC programming are usually mechanical-ish engineers and security is not in their skill set or on their mind.

Stuxnet was over a decade ago.

There should be a simple rule that everyone with the ability to understand things like PLCs should be able to grasp: your equipment does not touch the internet or external storage, period.

Those who can't grasp this concept should be shown the door with a recommendation that they find a less mentally-taxing line of work.

Re: I think the military commissary's freezers were hacked

#84

Post by homeonthemtn »

Hovertruck wrote: post #74
homeonthemtn wrote: post #59

Earlier quoted context omitted.

I was getting hints of that as well.

Weirdly I felt like it got more LLM-y the further I got in. Then I hit the part with: But the thing I can’t get past is Fort Huachuca’s failure mode. Not: the freezer compressor died. Not: the power went out. Not even: the refrigeration system stopped cooling. Every freezer went into active defrost.

Yep! Same point for me too. Just a little too Claude-y

Re: I think the military commissary's freezers were hacked

#85

Post by lenerdenator »

lowbloodsugar wrote: post #71
katzenversteher wrote: post #37

Earlier quoted context omitted.

Most factories I know do not allow their PLC be accessed from the internet. They are usually on a separate Network. However, the "engineering" station (the computer running e.g. TIA Portal) sometimes is. The PLC engineers I had contact with usually had an electrical engineering background. That's why they like PLCs in the first place with the ladder logic programming languages, grafcet and if they feel fancy a bit of…

>They are usually on a separate Network. Then someone plugs in a cable because boss wants something "over there" and there's already a network that runs "over there". Or optimizes to a smart switch with vlans, and then someone else optimizes to a single vlan. It's not hard to not give a shit, or not understand, network security.

That someone can be brought into an office and shown a small diagram of the approved network topology. Then they can be shown a small diagram of the current network topology. Next, they can be asked if they're the same. If they're not, they can finally be asked if they're aware that deviating from the approved network topology without consulting infosec is grounds for termination of their employment.

Re: I think the military commissary's freezers were hacked

#86

Post by scheme271 »

ericmay wrote: post #70
CobaltFire wrote: post #67

As someone who spent over 20 years active duty, and spent a ton of my career in the IT, security, etc. side of the house: Unlikely to be a hack, more likely to be a misconfiguration or update sent incorrectly. That said, the timing of the disclosure and the issue are rather concerning. Regarding the highest value targets to hit with an attack like this, you would want to target Guam, Hawai'i, and other isolated overs…

Generally agree with your assessment, but in the case of Guam or other more remote installations if there were catastrophic issues we'd just airlift food in. Costly but certainly manageable. Hawaii I'm not sure why that would be an issue unless the whole island was attacked or shut down. Even if the on-base shops were hacked you could just go shop at Wal-Mart or Costco or any number of other locations on the islands.…

More to the point for Guam and similar locations, canned and non-perishable food can are probably around and more can be airlifted in to get people through it. It was pretty much the standard back in the day.

Re: I think the military commissary's freezers were hacked

#87

Post by quickthrowman »

HardwareLust wrote: post #63

My only question is, why would all refrigeration be under the remote control of DECA? That seems unnecessarily complicated.

Because they’re prefabbed walk-in coolers or freezers (at minimum, they could be purpose built cold storage warehouses) with multiple condensers, evaporators, pumps, temperature sensors, and humidity sensors. The refrigeration equipment needs some sort of control system and direct digital control is the usual way to do that these days.

This is food storage for a commissary, aka a store. They don’t use residential refrigerators.

Re: I think the military commissary's freezers were hacked

#89

Post by fg137 »

quickthrowman wrote: post #87
HardwareLust wrote: post #63

My only question is, why would all refrigeration be under the remote control of DECA? That seems unnecessarily complicated.

Because they’re prefabbed walk-in coolers or freezers (at minimum, they could be purpose built cold storage warehouses) with multiple condensers, evaporators, pumps, temperature sensors, and humidity sensors. The refrigeration equipment needs some sort of control system and direct digital control is the usual way to do that these days. This is food storage for a commissary, aka a store. They don’t use residential ref…

Do regular grocery stores use a similar system? Or are locally controlled, simpler systems?

Re: I think the military commissary's freezers were hacked

#90

Post by Lt_Riza_Hawkeye »

HardwareLust wrote: post #63

My only question is, why would all refrigeration be under the remote control of DECA? That seems unnecessarily complicated.

The article posits that they may just have centralized monitoring, not control. Since this didn't affect every location, I would assume it was a shared default password or something
Post reply on HN