31–40 of 42 posts
So let's take bets. Was this hack attack made possible through: 1) A SQL injection 2) A default admin password
Did anyone else notice this choice comment: “They just figured it’s part of the normal instability of the system,” Weiss told Wired.com. “But it wasn’t until the SCADA system actually turned on and off that they realized something was wrong.” That's a pretty bad sign that the system is so buggy that at first it seems like a hacking attempt is just "normal" instability.
Good. Malicious crackers, please destroy as many non-safety-critical water pumps as it takes for people to take security on these systems seriously. It seems most of the industrial controls industry is used to operating on a proprietary network, and when moving to IP their guess at security is "uh, firewall?".
I'm amazed that the concept of "air gap" isn't standard operating procedure at any utility.
Earlier quoted context omitted.
This is indeed odd. On my home network, I have a firewall at the edge, a firewall on each machine, and every service requires authentication (cryptographic where possible; username+password over SSL otherwise). It took me about a day to set up, and I'm not even a security person. It's unacceptable that people whose jobs are to secure computer networks do a worse job than I do for the little computer under my TV. (Yup…
SCADA systems often rely on time-deterministic routing of packets, which TCP/IP doesn't make easy. There are a number of issues with securing them, including the fact that unscheduled downtime can be catastrophic (ergo, no hotpatching without massive work). There are some good posts on the SCADASEC mailing list. There are some lousy posts as well. Culturally, SCADA system security is approximately where IT systems we…
*edit, inferring that instability can drive people to network these devices for support reasons.
So let's take bets. Was this hack attack made possible through: 1) A SQL injection 2) A default admin password
The article mentions that the intrusions involved a security hole in PHPMyAdmin, so, likely neither (unless the attackers just got access to the database through PHPMyAdmin using the default admin password rather than a security hole).
So let's take bets. Was this hack attack made possible through: 1) A SQL injection 2) A default admin password
Stanford EE Computer Systems Colloquium Control System Cyber Security - State of the State http://www.stanford.edu/class/ee380/Abstracts/111012.html "Industrial control systems are used in electric power, water, pipelines, etc. These systems were designed for performance and safety considerations, not security. Traditional IT security technologies, policies, and testing may not apply to these systems. Moreover, there…
From the abstract/slides, it seems like it could be quite interesting.
Earlier quoted context omitted.
how many users does your home system have? what is your budget like to support them? what is your pain point for "at this overhead we just go out of business?" it's a lot more complicated than "just do it right". I'm not saying we shouldn't take effort to do it right, but right now the market doesn't price for security so ...
How many users does a water pump have? Hell, this probably shouldn't have been networked in the first place.
Earlier quoted context omitted.
The article mentions that the intrusions involved a security hole in PHPMyAdmin, so, likely neither (unless the attackers just got access to the database through PHPMyAdmin using the default admin password rather than a security hole).
Why isn't using PHP for security sensitive work considered illegal yet?
Earlier quoted context omitted.
I would say any system whose failure quickly results in the loss of life should always have properly trained staff either on location or trivially close. Anything less than that would be, as you put it, criminally irresponsible, as is the idea of connecting such infrastructure to publicly accessible networks.
I don't think you'd like what your power bill would look like if your distribution company had to have staff trivially close to all of its infrastructure, 24/7. I work at a utility and all (yes, all) of our stations and substations are unmanned. To have a crew on site at every station, 24/7, you'd be looking at nearly 1,000 employees at $65-90k, assuming 8-hour shifts.
Pretty sure that's not the case since internet controlled systems are solidly in the minority.