21–30 of 61 posts
Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...
Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...
And afaik they didn't have internet access directly for the control boxes at Natanz. Stuxnet got into the plant via USB sticks.
Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...
Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...
someone should have told the iranians that linux computers have no security vulnerabilities
http://philosecurity.org/2009/01/12/interview-with-an-adware...
Don't tell me you aren't familiar with this.
Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...
Most of the people working on these devices are far from being computer experts. I went to an advanced class for them, where the instructor took pains to advise the class that it was an advanced class and you would probably be lost if you hadn't taken the beginner class. I hadn't, and I breezed right through all of their material. Not that I'm that much smarter than anyone there, just from having experience using and figuring out a lot of different types of computer systems. This type of software is made for people who are experts in stuff like chemical plant operations, but who think Excel would be a great way to program their control systems. I'd bet that not one of them have even heard of the Nataz attack.
Given the total lack of interest or experience in computer security that seems to be prevalent in the industry, I expect it will get a lot worse before it gets better.
Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...
Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...
That's because a lot of industrial "control" is still done via classic OPC [1] for communication. That's Microsoft DCOM. I kid you not!! And afaik they didn't have internet access directly for the control boxes at Natanz. Stuxnet got into the plant via USB sticks. [1] http://en.wikipedia.org/wiki/OLE_for_process_control
http://www.matrikonopc.com/products/opc-data-management/opc-...
DCOM is such a headache that these guys sell a $1000 program whose sole purpose is to make it easy to make remote DCOM connections. And I've recommended it as a screaming deal at that price. Given what it costs to get myself or a proper tech to a remote site for a day, I'd much rather use that and spend my time solving the actual problem than spend a day trying to get DCOM working before working on the actual problem.
This is incredibly interesting and extremely important. It has clear implications for infrastructure and security, particularly energy infrastructure which I am most interested in. This is the future of war.
When I was in college and the internet got big I and I was touting all this cool stuff you could do, he told me about this project they did way back in the 70's. He said it terrified him at the time because it took the human element out of the equation. If something went wrong, it could do some serious damage. A misplaced decimal point here and it could basically bring down an entire region of the power grid.
He always said the software was great, but it made the people using it lazy - which is where the real danger is.