Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Google's HVAC Systems

cylance.com

Post reply on HN
Print view View original

31–40 of 46 posts

Re: Hacking Google's HVAC Systems

#31

Post by f- »

tptacek wrote: post #23
swalkergibson wrote: post #4

This is not a part of the vulnerability rewards program? Why?

Presumably because addressing it does not meaningfully improve the security of Google's customers and users.

Well, it's actually a bit more complicated than that. The bug is definitely something we wanted to know about, and we're thankful for the report. That said, there are some constraints that we put in place for the reward program to protect researchers from harm.

For example, we don't want physical security or the police second-guessing the intent of someone trying to sneak into one of our buildings - so we set a very clear scope for the program, pragmatically focusing on our user-facing applications and excluding things such as attacks on our facilities and corporate infrastructure. It's a broad exclusion, but it's hard to come up with something finer-grained yet clear enough.

In the same vein, we ask researches that they don't go after any systems unless it's perfectly clear that the application is owned and operated by us - for example, because it's in an IP range registered to us. Again, while this may be more limiting than we'd like, it protects the community against overly litigious parties if the system proves to belong to somebody else.

In several unusually serious cases, we have made case-by-case exceptions and have paid external researchers for nominally non-qualifying bugs; but it's a tricky balance, and we use this power very cautiously.

Source: I authored a good chunk of the current rules for Google VRP ;-)

Re: Hacking Google's HVAC Systems

#32

Post by rtkwe »

mseebach wrote: post #21

> [Pic: After hours button] > (We don’t know what this button does… and we were afraid to test it :-)) How do you hack HVACs and not know what an after hours button does? (it extends operation of the system so if you're working after hours, you won't freeze/boil to death, without wasting energy running the HVAC out of hours when no-one is there.)

Their hack wasn't really specific the HVAC systems though. It's just grabbing a poorly secured password file from a web server more than anything HVAC specific.

Re: Hacking Google's HVAC Systems

#33

Post by CaveTech »

driverdan wrote: post #15

Just a reminder to anyone interested in doing this kind of research, what Billy did here is illegal under CFAA. As we've seen from recent cases, he could be prosecuted and imprisoned even if Google declined to press charges.

This worried me also. I've seen many articles here on HN where people have done far less and have had serious crimes pressed. Glad Google takes the high road but with the state of the current US legal system regarding "hacking" I definitely would not be so bold.

Re: Hacking Google's HVAC Systems

#34

Post by cylanceinc »

watty wrote: post #10

You don't need a "custom exploit" or a "custom developed tool" to access a public file called config.bog and base64 decode the user:pass. This Tridium exploit was well publicized in the past year but too many people (including this contractor who installed it) failed to upgrade the security or install the patches.

"Custom exploit" might be a bit of a misnomer, Billy and Terry (the same researchers that are credited on the initial ICS-CERT Advisory regarding the Niagara framework) were referencing a set of utilities/scripts they put together to automate testing.

Original ICS-CERT Advisory: http://ics-cert.us-cert.gov/advisories/ICSA-12-228-01

(Edit: Disclaimer, I work for Cylance.)

Re: Hacking Google's HVAC Systems

#35

Post by Smerity »

packetslave wrote: post #16
HoochTHX wrote: post #14

Earlier quoted context omitted.

And potentially shutting down the HVAC for the web servers has no relation?

What is it that led you to believe Google hosts web servers out of the Sydney office building?

Google Sydney has servers on site, but they may well just be to be local productivity aids (mirrors for development etc). Google generally don't publicise where their servers are or what they're for. Even if the servers are just like any standard office's servers, this exploit could result in some serious issues.

When I was at Google Sydney a few years ago for an internship, the AC died prompting an interesting response. The server temps were rising to unsafe levels and the AC wasn't expected to come back in time. The MacGyver solution was to buy portable AC units and pump the heat into the coder's workspace. That was a distinctly unpleasant afternoon =]

If the machines weren't important for production or productivity I'm certain they'd save us the hassle and shut them down. If nothing else, abuse of this office's AC system could severely impact the productivity of the office and spring dozens of people into action.

Whilst not under the usual purview of the rewards program, I'd still think it's noteworthy of recognition.

Re: Hacking Google's HVAC Systems

#36

Post by kybernetyk »

tiredofcareer wrote: post #29
watty wrote: post #10

You don't need a "custom exploit" or a "custom developed tool" to access a public file called config.bog and base64 decode the user:pass. This Tridium exploit was well publicized in the past year but too many people (including this contractor who installed it) failed to upgrade the security or install the patches.

Running on Windows on the developer's workstation, no less... Let me quickly clarify that I'm not anti-Windows, it was just a double-take to see it used as a workstation for security research like this (though I'm using the word 'research' lightly). Strange article all around, lots of it caught my eye.

Maybe they have only windows licenses of IDA pro? There are a few very useful tools for windows - especially for reverse engineering and hardware/embedded stuff.

Re: Hacking Google's HVAC Systems

#37

Post by jrockway »

If Google can fall victim to an ICS attack, anyone can.

Did Google write this software? If not, it's kind of like writing "Google locks vulnerable to lock picks". Well yeah, just like every other pin tumbler lock ever made.

Re: Hacking Google's HVAC Systems

#38

Post by BHSPitMonkey »

jrockway wrote: post #37

If Google can fall victim to an ICS attack, anyone can. Did Google write this software? If not, it's kind of like writing "Google locks vulnerable to lock picks". Well yeah, just like every other pin tumbler lock ever made.

I think the point was that if any company should have awareness of what internal tools are pointing web servers at the outside world, should be capable of auditing its own security, should easily understand what that software is doing and how it should be secured, it should be Google, a company whose primary output is web software.
Post reply on HN