Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stuxnet's Secret Twin

foreignpolicy.com

Post reply on HN
Print view View original

51–60 of 61 posts

Re: Stuxnet's Secret Twin

#51

Post by cleaver »

davidgerard wrote: post #17

Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...

It was a while ago, but I worked for a place that was writing software for boxes that could be used to collect telephone toll data from old bar switches in an Eastern European country. The sales manager thought it would sell better if it was on Windows 95. I suggested to him that they could at least use NT so you could lock down access better. His response was: "Oh, I told them that now their staff can use Windows 95 whenever they want." #facepalm

Another bright idea was that rather than just collect the information and forward it to a central hub (the ultimate destination), the data would be transferred according to the organizational structure... first area level, then regional, etc.

The culture at this shop was like this... sales spec'd the software and there was no push-back allowed from the technical staff. Fortunately, I didn't work on that project.

Re: Stuxnet's Secret Twin

#52

Post by ldubinets »

rsync wrote: post #40
davidgerard wrote: post #17

Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...

"Why THE FUCK are industrial controllers connected to the Internet still running Windows?" A followup question I have is this: When all is said and done how much will autorun.inf cost humanity ? Seriously. Is it in the hundreds of billions ? We're almost 20 years into the lifespan of that file and it's still making front page mainstream news.

Q: Disabling AutoRun in Windows will stop USB worms, right?

A: Wrong. There are several other spreading mechanisms USB worms use. The LNK vulnerability used by Stuxnet would infect you even if AutoRun and AutoPlay were disabled.

http://www.f-secure.com/weblog/archives/00002040.html

Re: Stuxnet's Secret Twin

#53

Post by growupkids »

Zigurd wrote: post #47
fragsworth wrote: post #38

Earlier quoted context omitted.

They were able to connect to the centrifuges through the internal facility by infected machines. I remember reading that one of the methods Stuxnet used to transmit data through the facility between two infected machines that were not networked: sound cards and microphones.

They probably bribed an operator to carry in a usb stick.

Or the operator just didn't follow procedure and plugged it in. Work in an ICS environment for one week, and you'll see the probability of this happening is close to 100%. Most of these folks don't even know what a cyber attack even is, or even how it could happen let alone how to stop it. It's science fiction to them, they don't care because it's FICTION. As a friend in the industry one said once: the typical operator is a monkey: press the button get a banana. Horribly offensive, I admit, but I've unfortunately seen it myself. The human factor, that wonderful human factor will get you every, single time. Remember, these are people that have never even heard of a cyber attack except maybe in a movie or TV show, and even then they probably thought it was nonsense. They not only don't care, they don't even know they should care. It's all magic to them. The world is flat, and it makes sense because it's LOOKS flat.

Re: Stuxnet's Secret Twin

#54

Post by _sh »

davidgerard wrote: post #17

Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...

The industrial controllers were not connected to the internet. Part of Stuxnet's sophistication was crossing the air gap via USB sticks that were infected through two never-seen-before 0-day attacks, the infamous shortcut icon attack vector, and autorun trojans.

Why were the control systems running Windows? Because it has a GUI. This helps when monitoring control systems, and of course is the only platform Siemens' monitoring systems run on.

Re: Stuxnet's Secret Twin

#55

Post by runamok »

growupkids wrote: post #53
Zigurd wrote: post #47

Earlier quoted context omitted.

They probably bribed an operator to carry in a usb stick.

Or the operator just didn't follow procedure and plugged it in. Work in an ICS environment for one week, and you'll see the probability of this happening is close to 100%. Most of these folks don't even know what a cyber attack even is, or even how it could happen let alone how to stop it. It's science fiction to them, they don't care because it's FICTION. As a friend in the industry one said once: the typical operat…

All the USB ports should be sealed with epoxy...

Re: Stuxnet's Secret Twin

#56

Post by cnvogel »

walshemj wrote: post #43
davidgerard wrote: post #17

Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...

They where not the controllers where SCADA - which appears to have less security than windows 3.1 Why SCADA doesn't have the equivalent of a write protect switch so that you can physically disable updates is the more interesting Q.

They did have write protection in the past... if I remember correctly, some of these memory cards really had an old-school Eprom you had to erase by UV light and externally erase using a high-voltage parallel programmer:

http://www.classicautomation.com/Siemens_EPROMs.aspx

Re: Stuxnet's Secret Twin

#57

Post by cnvogel »

runamok wrote: post #55
growupkids wrote: post #53

Earlier quoted context omitted.

Or the operator just didn't follow procedure and plugged it in. Work in an ICS environment for one week, and you'll see the probability of this happening is close to 100%. Most of these folks don't even know what a cyber attack even is, or even how it could happen let alone how to stop it. It's science fiction to them, they don't care because it's FICTION. As a friend in the industry one said once: the typical operat…

All the USB ports should be sealed with epoxy...

And all the guys you want to deter to plug in a usb-stick are much more skilled with tools, metalwork, electrical connections than you are...

Better disable the usbstor service so that the USB ports are still working, only they don't make usb storage devices appear as disk drives :-).

(also some software might require a license-dongle to be plugged in)

Re: Stuxnet's Secret Twin

#58

Post by runamok »

cnvogel wrote: post #57
runamok wrote: post #55

Earlier quoted context omitted.

All the USB ports should be sealed with epoxy...

And all the guys you want to deter to plug in a usb-stick are much more skilled with tools, metalwork, electrical connections than you are... Better disable the usbstor service so that the USB ports are still working, only they don't make usb storage devices appear as disk drives :-). (also some software might require a license-dongle to be plugged in)

You could also clip the connections at the motherboard but I am guessing most of them would be too lazy to bring in a new port to solder up.

Re: Stuxnet's Secret Twin

#59

Post by dsuth »

JabavuAdams wrote: post #50
davidgerard wrote: post #17

Serious question: Why THE FUCK are industrial controllers connected to the Internet still running Windows? What is going on here? Why did anyone ever think this was a good idea? Your customers may use Windows, but you don't code your site as a batch script ...

> Why THE FUCK are industrial controllers connected to the Internet? Fixed that for you.

Not really, since the control system wasn't connected to the internet. They did, however, rely on "air gap" security, as you appear to be proposing.

Defense in depth is the only valid model of protection, but this requires intentional inclusion of cyber security concerns in the design stage of your plant, and on-going maintenance and auditing by a skilled IT team, and training of all your employees against social engineering, and...

This is a lot harder to do than just unplugging the Internets and giving a thumbs up.

Re: Stuxnet's Secret Twin

#60

Post by cnvogel »

runamok wrote: post #58
cnvogel wrote: post #57

Earlier quoted context omitted.

And all the guys you want to deter to plug in a usb-stick are much more skilled with tools, metalwork, electrical connections than you are... Better disable the usbstor service so that the USB ports are still working, only they don't make usb storage devices appear as disk drives :-). (also some software might require a license-dongle to be plugged in)

You could also clip the connections at the motherboard but I am guessing most of them would be too lazy to bring in a new port to solder up.

So, often people will image a computer (e.g. to a 2nd harddisk or DVD) after changes had been made. So returning after one year you'll find that the hardware had failed for whatever reason and the image put back on another PC. So, restricting access in Software is more viable, in my oppinion.
Post reply on HN