Stuxnet's Secret Twin • Hacker News Board

Re: Stuxnet's Secret Twin

#31

Post by dsuth » Wed, Nov 20, 2013, 10:02 PM UTC

davidgerard wrote: post #17

Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...

It's a great question, and as someone heavily involved in industrial control systems, I ask myself and others that a lot.

The only real reason I've heard comes down to cost and support. It's easy to develop software for Windows, easy to find developers, easy to support the operating system, easy (debatable) to use in an industrial environment. It's a known factor.

Always remember that people on the shop floor (or hydrocarbons refinery equally) aren't interested in maintaining a PC they don't understand, and their management aren't interested in maintaining a well-educated IT department. It's a simple cost/benefit equation, and so far the benefits have been completely ignored.

Likewise, vendors of control systems don't want to put the time and effort in to develop their IDE's, display tools etc for a Unix variant. System integrators (ICS programmers and configurators)... well, we'd be cool with a Linux-based control system, if it worked well.

That's why you see Windows in industrial control environments. Couple this with the extremely conservative nature of industry, and you have a huge, glaring problem. We (ICS engineers) know it's a problem, clients are starting to realise it's a problem, but the wheels move slowly.

At least Stuxnet has made the wider industrial community aware of just how deep the shit is. Now begins the slow process of crawling back out of it.

Re: Stuxnet's Secret Twin

#32

Post by gcb1 » Wed, Nov 20, 2013, 10:19 PM UTC

dsuth wrote: post #31

davidgerard wrote: post #17

Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...

It's a great question, and as someone heavily involved in industrial control systems, I ask myself and others that a lot. The only real reason I've heard comes down to cost and support. It's easy to develop software for Windows, easy to find developers, easy to support the operating system, easy (debatable) to use in an industrial environment. It's a known factor. Always remember that people on the shop floor (or hyd…

what proves that running windows is the least concern. they would have added some suid crap listening out for reason had this been linux or anything else. this is just negligence. it is the same as bridge falling it two trucks drive there at the same time. everyone would be fine blaming the architect, engineer, construction company, politician that paid for etc... that happens in software, it is nobody business.

Re: Stuxnet's Secret Twin

#33

Post by gcb1 » Wed, Nov 20, 2013, 10:24 PM UTC

sp332 wrote: post #8

thesimpsons1022 wrote: post #7

Earlier quoted context omitted.

that one requires registration as well.

Full text http://pastebin.com/z7XxVHVx

that is 5 to 10 years of computer crime you are looking at, sp332.

Re: Stuxnet's Secret Twin

#34

Post by angrydev » Wed, Nov 20, 2013, 10:32 PM UTC

Readability link: http://www.readability.com/articles/6ycbi4jx

I highly recommend downloading this extension for websites with crappy overlays like this one!

Re: Stuxnet's Secret Twin

#35

Post by sp332 » Wed, Nov 20, 2013, 10:42 PM UTC

gcb1 wrote: post #33

sp332 wrote: post #8

Earlier quoted context omitted.

Full text http://pastebin.com/z7XxVHVx

that is 5 to 10 years of computer crime you are looking at, sp332.

I was aiming for $9k in statutory damages :)

Re: Stuxnet's Secret Twin

#36

Post by atmosx » Wed, Nov 20, 2013, 10:45 PM UTC

dsuth wrote: post #31

davidgerard wrote: post #17

Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...

It's a great question, and as someone heavily involved in industrial control systems, I ask myself and others that a lot. The only real reason I've heard comes down to cost and support. It's easy to develop software for Windows, easy to find developers, easy to support the operating system, easy (debatable) to use in an industrial environment. It's a known factor. Always remember that people on the shop floor (or hyd…

Sorry but in this scenario maintaining a 5-person skilled IT department was/is imperative. The TCO should of the IT department, even if you hire D. Hartmeier[1] to configure the firewalls, should be negligible compared to the operation's TCO.

That said, in this case I believe that the software to manage the centrifuges is made by Siemens (Germany) and it's written on Windows. So partially it wasn't the consumer's choice to use windows. Even if they used linux, is not hard to think that the NSA could have written a Linux clone worm. The only thing that can keep away such threats is "security" as Schneir mentions here[2] "security is a process" and that process can secure any operating system out there imho.

[1] http://www.benzedrine.cx/index.html

[2] https://www.schneier.com/crypto-gram-0005.html

Re: Stuxnet's Secret Twin

#37

Post by dsl » Wed, Nov 20, 2013, 10:53 PM UTC

thesimpsons1022 wrote: post #7

hangonhn wrote: post #5

Try this link if you get hit with registration: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&c...

that one requires registration as well.

Right Click on the background, AdBlock..., Block This Ad

Re: Stuxnet's Secret Twin

#38

Post by fragsworth » Wed, Nov 20, 2013, 11:02 PM UTC

tcoppi wrote: post #18

davidgerard wrote: post #17

Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...

If you'd bother to read the article, you'd know that the infection vector was not direct Internet access to the affected systems.

They were able to connect to the centrifuges through the internal facility by infected machines.

I remember reading that one of the methods Stuxnet used to transmit data through the facility between two infected machines that were not networked: sound cards and microphones.

Re: Stuxnet's Secret Twin

#39

Post by 0xdeadbeefbabe » Wed, Nov 20, 2013, 11:10 PM UTC

Q: How could governments get something so complex right?

A: Trick question. Nice. Next question.

-http://www.f-secure.com/weblog/archives/00002040.html

Re: Stuxnet's Secret Twin

#40

Post by rsync » Wed, Nov 20, 2013, 11:30 PM UTC

davidgerard wrote: post #17

Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...

"Why THE FUCK are industrial controllers connected to the Internet still running Windows?"

A followup question I have is this:

When all is said and done how much will autorun.inf cost humanity ? Seriously. Is it in the hundreds of billions ?

We're almost 20 years into the lifespan of that file and it's still making front page mainstream news.