Hackers invade safety system, halt plant operations in ‘watershed’ cyberattack

https://www.japantimes.co.jp/news/2017/12/15/world/crime-legal-world/hackers-invade-safety-system-halt-mideast-plant-operations-watershed-cyberattack/

by pmoriarty • 9 years ago

97 52 9 years ago

japantimes.co.jp

Hasz• 9 years ago

Why are systems like this connected to the internet?

As far as I can see, any safety monitoring system should be air-gapped, or, if remote control is absolutely needed, be connected via a robust physical interface, i.e a thick cable.

There is no good reason for any of these devices to have a public IP address. Physical access should be the only attack vector available when it comes to industrial sabotage.

ggggtez• 9 years ago

You would think that wouldn't you. But for that to happen, the system designer would have had to plan it that way probably 20 years ago.

abritinthebay• 9 years ago

This was predictable 20 years ago too though.

senectus1• 9 years ago

yup, they should NOT be connecting them, but because everyone is going cloud and remote service support.... they got to let "people" in.

Also the PLC administrators refuse to let proper network and systems admins go near their shit. They think their stuff is better left alone from the "geeks".

PinguTS• 9 years ago

It's the IT folks who tell everybody you should connect everything to the Internet, because that makes everything so easy.

It's the embedded folks, who tell that it is not made for this.

It's the manager folks, who demand that it be connected, because the IT folks told that it's is easy and innovative while the embedded folks are so old school.

vog• 9 years ago

It's the embedded folks, who tell that it is not made for this.

Really?

If so, this is just a small minority of the embedded folks.

Think of the whole "Internet of Things" security mess, combined with a large part of "Industry 4.0". That's tons of embedded devices explicitly built to be connected to the Internet.

If it were really the developers of those embedded devices who didn't want them to have Internet connection, they would never have been in charge to build those in the first place.

adrianN2• 9 years ago

Because all kinds of companies are pushing for the Industrial Internet of Things, since that enables new subscription-type business models for sectors that used to sell big expensive machines ~once per customer.

https://en.wikipedia.org/wiki/Internet_of_things#Manufacturi...

mschuster912• 9 years ago

Yeah but then expose to it at least with a VPN... doesn't even have to be a Cisco ASA, a simple box with OpenVPN on it is sufficient - hell, as long as you're not doing heavy traffic on it a $20 throwaway router can do this.

InclinedPlane• 9 years ago

The internet is becoming the de facto way to connect anything. There's increasing automation, communication, and so forth between all these systems, and the internet is the way that's coordinated. But unfortunately the people taking these systems online don't always do so with the proper eye toward security rigor that is deserved. Sometimes that's down to a lack of expertise. Sometimes it's due to lack of resources or spending. Sometimes it's just because management folks refuse to listen to the professionals they've hired. In any event, it's a common problem even at the best of places. At organizations that lack a deep bench of current era IT/software talent (which is actually most organizations) it's very easy to make these mistakes.

If you want to see how to do it right, look at slot machines. There is a crazy amount of oversight on those devices. In comparison, voting machines and our industrial infrastructure is just a huge game of grab-ass. Whatever goes, goes, until something bad happens and then people slowly learn one lesson.

Kurtz79• 9 years ago

If I'm not mistaken, there is no mention in the article that the system was actually connected to the Internet.

The Stuxnet attack (which as another commenter said was the real "watershed" event) managed to infect the target system even if it was air-gapped, by infecting the PC of someone that eventually connected to the private network of the target onsite.

https://en.wikipedia.org/wiki/Stuxnet#Windows_infection

mcgarnagle3• 9 years ago

Okay, then really the comment should be renamed to why is critical infrastructure allow to be tampered with. Say this infection was brought in via hardware or bluetooth exploitation or wifi exploitation. None of those attack vectors should ever be accessible. No human working there should ever be able to "by accident" infect the system.

ams61102• 9 years ago

The article says "In the incident, hackers used sophisticated malware to take remote control of a workstation running a Schneider Electric Triconex safety shutdown system"

"Remote control" certainly implies that it was connected at least indirectly to the internet, though something like a direct dial-up modem or leased line compromise could also be possible.

freeflight• 9 years ago

Stuxnet propagated itself, on a pretty wide scale, through a BadUsb exploit to bypass the Iranian air-gap.

michaelt• 9 years ago

  Why are systems like this connected to the internet?

Because there are some things that need to be safe; some things that need to be connected to other things; and some things that need to be on the internet.

Consider an automated warehouse: https://www.youtube.com/watch?v=dAXdeqcHBp4

Internet <-> Website <-> Stock control system <-> Stock inbound station <-> Conveyor control system <-> Emergency stop monitoring system

It's possible to make such a system safe, of course. But a company making a web browser has their defences tested and their security spending validated by unceasing attack. The same resources might be hard to get in an industrial automation company if the higher-ups think "there hasn't been an attack, and they already have a firewall, a VPN and a virus scanner, whatever those are"

mcgarnagle3• 9 years ago

You don't make an online purchase when you open your tap to get a drink of water or flip on a switch for the lights.

Some systems need to be on the internet. cool story, but, why would critical infrastructure such as this need to be is still unaddressed by your comment.

ams61102• 9 years ago

The emergency stop system should not be connected to the normal conveyor control system. It should be an independent system, since in an emergency the normal controls are presumably malfunctioning.

phkahler2• 9 years ago

> Why are systems like this connected to the internet?

For convenience. In business they call it "cost".

AnIdiotOnTheNet5• 9 years ago

There is no good reason for any of these devices to have a public IP address.

That's a bold statement to make for someone who, I'm assuming, has absolutely no idea what these systems are or what the company wants to do with them.

Security policy is super easy when you don't actually have to get anything done.

deadmetheny3• 9 years ago

As somebody who is responsible for security policy: there is no good reason for any of these devices to have a public IP address. Full stop. We did fine back when they weren't networked, we don't need to start now.

tzs• 9 years ago

Why are systems like this connected to the internet?

Probably a variety of reasons. Here's one.

There was something I saw on my local PBS station that was about security and the electrical grid. They talked to some manager of a major power plant who had a phone app that could monitor that plant over the internet and pretty much completely control it.

They talked about how this app came about. The manager decided it would be convenient so he could keep up on things when he was away at conferences and such. There were no security experts involved in writing this thing, or in analyzing what the risks were of adding outside internet access to the LANs that control systems were on. It was all as casual as you or I might make a phone app that can turn on our garage lights.

The thought that there might be some danger in the control systems being directly accessible from the internet simply did not occur to anyone.

ihsw2• 9 years ago

Any network security authority worth their salt would tell this manager (and those like him) that "checking up on things" is a hopeless and useless endeavor. Like all log monitoring systems, only actionable items should be presented to end-users.

Set thresholds on monitoring systems where the monitors trigger alarms when thresholds are outside of normal operating parameters. It's monitoring 101.

pc86• 9 years ago

The saddest thing about this is that manager likely got a bonus, either directly (great initiative!) or indirectly (more hours micromanaging everything), when he should have gotten fired and found it impossible to get a job in the industry.

nsnick• 9 years ago

It is usually a result of a fight between control system engineers and IT people. The IT people see an ethernet cable and think that they should control it and in order to do that they connect the two networks. There are ways to do it safely, like placing a database in a DMZ that the PLCs write to and have computers on the other side read from the database without ever connecting to the PLCs, but that requires expertise and a security mindset.

r00fus• 9 years ago

Is it wrong for me to want those IT folks reprimanded or reassigned?

It's like they don't understand the first rule of Fight Club or something.

joe_the_user• 9 years ago

So, a virus-based cyber attack on the computer system of a Saudi Arabian industrial operation, supposedly by Iran.

If "watershed" mean fundamentally new, this isn't a watershed event since this event was proceed by the Stuxnet attack on Iran, by many accounted committed by the US and Israel.

Still, it seems to reinforce the general situation that the gloves are off between nation states, every cyber avenue of attack that can be pursued, will be pursued - a war of all against all. Since not only are cyber attacks cheap, they offer endless plausible deniability.

willvarfar• 9 years ago

"Watershed moments" are those that cause everyone to take something seriously instead of beliving it couldn't happen to them. It's about people's reactions.

freehunter• 9 years ago

I still think we're a long way out from the real "watershed" moment, and I say that as a lifelong security engineer.

Nothing fundamental changed after Stuxnet. Nothing fundamental is changing from this. Nothing fundamental changed after Target, Home Depot, Equifax, nothing. We're still vulnerable to the exact same types of attacks in the exact same way, saved only by the fact that easier targets exist to draw away the attention of attackers. These "watershed" attacks only happen when someone specifically wants to go after that target as opposed to just any target.

We've been at cyber WWIII for a long time, nation-state attackers are nothing new. Problem is, loss of life is the only reason we have any reservations at all about attacking other nations. Until cyber war ends the life of a Western media-friendly victim, we will continue not caring.

Actual human casualties will be the real watershed moment.

PeterisP2• 9 years ago

This isn't a watershed - Stuxnet kind of was, but the people who didn't start to take it seriously after Stuxnet will still believe it won't happen to them after this case.

Dylan168072• 9 years ago

Stuxnet was a virus that was sent in. It's not the same as direct remote control.

GCU-Empiricist• 9 years ago

If malicious logical access is used to destroy industrial machinery, potentially killing operators, does it really matter if it came in via network or connection or physical access?

DyslexicAtheist• 9 years ago

"The malware, which FireEye has dubbed Triton, is only the third type of computer virus discovered to date that is capable of disrupting industrial processes."

This sounds incorrect ... Wasn't there (at least):

  1) Stuxnet (2010)
  2) Shamoon (2012)
  3) HAVEX (2013)
  4) BlackEnergy (2015)
  5) Industroyer (CrashOveride) (2016)
  6) Triton (??)

Naming it Triton is unfortunate since there has been a malware from 2004 with the same name[¹] that is totally unrelated.

[¹] https://www.pandasecurity.com/cyprus/homeusers/security-info...

dwyerm• 9 years ago

I got quite a sense of whiplash just in the first page of the article. It is an article from Japan Times, with a leading photo from California, over a byline from Toronto, about an attack on equipment from a French firm in a site in Saudi Arabia.

...just in case you forgot that the internet is international.

cordite• 9 years ago

One of my relatives is a safety engineer at a plant. Remotely he can connect to a read only console, if there are any changes he has to call someone on the inside to make them.

I don’t know how robust that read only aspect is, but it seems like a good middle ground if faithfully implemented.

Hackers invade safety system, halt plant operations in ‘watershed’ cyberattack

Related Stories