Forgot your password?
typodupeerror
Security IT

SCADA Hacker: Water District Used 3-Character Password 213

Posted by samzenpus
from the abc-easy-as-123 dept.
Trailrunner7 writes "In an e-mail interview with Threatpost, a hacker who compromised software used to manage water infrastructure for South Houston, Texas, said the district had HMI (human machine interface) software used to manage water and sewage infrastructure accessible to the Internet and used a password that was just three characters long. The hacker, using the handle 'pr0f' took credit for a remote compromise of supervisory control and data acquisition (SCADA) systems. Communicating from an e-mail address tied to a Romanian domain, the hacker told Threatpost that he discovered the vulnerable system using a scanner that looks for the online fingerprints of SCADA systems. 'This was barely a hack. A child who knows how the HMI that comes with Simatic works could have accomplished this,' he wrote in an e-mail."
This discussion has been archived. No new comments can be posted.

SCADA Hacker: Water District Used 3-Character Password

Comments Filter:
  • duh (Score:5, Funny)

    by stoolpigeon (454276) * <bittercode@gmail> on Monday November 21, 2011 @11:12AM (#38124104) Homepage Journal

    the upside is if you can't afford your own truck landing robot helicopter, it shouldn't be too hard to steal one. access to truck landing robot helicopters should be an inalienable right.

    i bet the password was h2o

    • Re:duh (Score:5, Insightful)

      by NeumannCons (798322) on Monday November 21, 2011 @11:25AM (#38124250) Homepage
      H2o. Need at least one uppercase, one lower case and one non-letter.
      • Re:duh (Score:5, Funny)

        by stoolpigeon (454276) * <bittercode@gmail> on Monday November 21, 2011 @11:28AM (#38124274) Homepage Journal

        Of course [xkcd.com], you are correct.

        • Re: (Score:2, Insightful)

          by rubycodez (864176)
          Except Randall Munroe underestimated how good that is. If there are 6000 "common words", then a four word password is out of 6000 * 5999 * 5998 * 5997 = 1.3 * 10^15 combinations. That's more than 50 bits of entropy (2^50 = 1.1 * 10^15), his time to guess should be multiplied by 2^6, or 35,000 years by his 1000 guesses a second (and no login will allow that many, multipy by a thousan more for 35 million years!)
          • by Moryath (553296) on Monday November 21, 2011 @11:59AM (#38124736)

            Except that there aren't going to be 6000 "common words" as the base. You're going to see the same inanity as current passwords, you're going to see dictionary file attacks using an actual kiddy dictionary with 1000 words or less. This will break through most passwords. You're going to see users allowed to create their own password, which means "jebusisgodone" and "onelittlefishyswim" followed "jebusisgodtwo" and "twolittlefishyswim" and so on and so forth.

            "Bitwise", it sounds secure, until you realize it can trivially be attacked on the token level rather than the bit level.

            • by rubycodez (864176)
              Nope, the computer generates the password from the easy words. you memorize the easy words. problem solved
            • by rb12345 (1170423)
              If you let users pick all four words in the password, yes, but that's not the suggestion. The actual idea is that the password is a 44-bit random number created by a cryptographically secure RNG. You can hex-encode this in 11 hex digits (difficult to remember), or use 4 base 2^11 digits. Since we don't have 2^11 easy to remember/type symbols, we use one word per symbol, defined in advance. The end user does not pick the alphabet/word-set used for this.
        • I hate passphrases because I once used one for PGP and then forgot which verbs were in the past tense and which weren't. I guess I could have hacked my passphrase easily, but I didn't really need it, so I gave up.

      • by McGruber (1417641)

        H2o. Need at least one uppercase, one lower case and one non-letter.

        They should change it to H2Oiswater, in order to meet the new 10-character minimum requirement.

    • It's distressing how often it's `h2o`.

    • Re:duh (Score:5, Funny)

      by masternerdguy (2468142) on Monday November 21, 2011 @12:15PM (#38124916)
      3 letter password? I guess not everything's bigger in Texas.
    • by mcgrew (92797) *

      This is the second one I've heard of in a week, there was one a few miles from here last week (it was covered in slashdot). SCADA operators better start smartening up or there'll be some serious trouble.

      Someone should at least get a reprimand out of this. Three letters? WTF?

  • by itchythebear (2198688) on Monday November 21, 2011 @11:16AM (#38124140)

    A child who knows how the HMI that comes with Simatic works could have accomplished this...

    The obvious course of action to prevent future attacks against SCADA systems is to ban all children. Problem sovled.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      Credit where credit was due: It was a Siemens system, of Stuxnet fame. Great for launching false-flag attacks to drum up support against "terrorists" and our civil rights.

      -- Ethanol-fueled

    • Re: (Score:3, Funny)

      by Anonymous Coward

      A child who knows how the HMI that comes with Simatic works could have accomplished this...

      Well, yeah, I mean, who doesn't have fond memories of studying the Simatic HMI on SCADA systems back in preschool?

    • by bmo (77928) on Monday November 21, 2011 @12:34PM (#38125154)

      You think this is funny, eh?

      Richard Feynman had a story about how his hobby was safe cracking. He cracked a cabinet that had a combination lock on it and then told the people who mattered the security hole. Did they upgrade the security on the cabinet? No, they banned him from the room. Problem solved.

      --
      BMO

    • "Why a four year old child could understand this. Run out and get me a four year old child, I can't make head or tail out of it." -- Groucho Marx
  • by AngryDeuce (2205124) on Monday November 21, 2011 @11:20AM (#38124178)
    The weak point is always going to be the human being. Pile on as much security as you want and people are going to find ways to disable it and make themselves vulnerable. Thousands of jobs in the tech support industry depend on it.
    • by Joe_Dragon (2206452) on Monday November 21, 2011 @11:28AM (#38124272)

      How about passwords that don't have to charged each 30 days and you can't use the last 4 passwords.

      • by Dare nMc (468959) on Monday November 21, 2011 @12:13PM (#38124902)

        That is annoying, forcing me to change my password at the end of the month from H@cker1 to H@cker2 to H@cker3, and H@cker4 before I can go back to the password I like, but they IT work preventers at my work are really good, so when I am working on the road for 2 weeks, they make sure I can't change my login password without being on the intra-net, and once I am 2 days passed the expire date, the prevent me from launching VPN, joining web meetings... So then I have to use gmail to email a co-worker my passwords so he can change them for me on connected laptop first. Lots of fun.

        • by WarlockD (623872)
          Before I left Unisys, I think mine got from 01 to 18. For some reason I was excited about reaching the big 2-0.:P
          • by nschubach (922175)

            At my previous employer we started using the month at the end of our passwords so IT implemented a 24 password history... I just moved to 'yydd'.

  • abc (Score:2, Funny)

    by gapagos (1264716)

    is the password.

  • by Anonymous Coward on Monday November 21, 2011 @11:22AM (#38124210)
    Damn it Jim, im a water guy not a computer expert!
    • by bill_mcgonigle (4333) * on Monday November 21, 2011 @11:29AM (#38124284) Homepage Journal

      Yeah, thar's yer problem. Just because these things are second nature to us, doesn't mean that non-experts are any good at making these decisions.

      I'd like to see the investigation focus on who approved putting a SCADA system directly on the Internet, why, and then see structural changes to ensure that that sort of person can't make those sorts of decisions anymore.

      Yeah, all SCADA systems should use ssh-quality authentication, but in the meantime we have millions of units deployed that need to be secured.

      Hey, maybe I should market the pfSense firewalls I sell as SCADA secure access controllers... :P

      • some PHB who does not want to pay for on site staff say make so the work can be done remotely.

      • Yeah, all SCADA systems should use ssh-quality authentication, but in the meantime we have millions of units deployed that need to be secured.

        I don't want brown turds floating in my water cause the "leap of faith" failed coupled with lack of crypto binding between session and user credentials.

        Hey, maybe I should market the pfSense firewalls I sell as SCADA secure access controllers... :P

        Maybe you shouldn't.

        • by aaarrrgggh (9205)

          It's an improvement. Slight, but an improvement none the less. I personally prefer the SEL 3620 and similar devices for this type of task (ethernet gateway for up to 16 serial links).

          The biggest problem with most systems is that they need device-level passwords vs user-level passwords (and the default management passwords are almost always in place). If you at least set up a VPN with certificate-based authentication you have created a significant barrier to the network, without complicating response time

        • Use keyfiles w/ passwords & cryptknock, problem solved. It can all be made into one handy script that runs from a flash drive to make it easy for users.

        • by AB3A (192265)

          Would you believe that the SCADA system that runs the water utility I work for has such a button on the screen? You would? Cool. I have this used bridge I'd like to sell you in New York City.

          You criticize people for not having an effective password and then promptly say something so ignorant that any plumber, civil engineer, or a fifth grader could tell you you're wrong. Ignorance happens. If you need proof, look in a mirror.

          Now as for the password, yes, it is foolish. There is more truth in the character

      • by Patch86 (1465427)

        I would have assumed that a major water utility would have employed some IT specialists to run their IT systems (that is, "some of us"). I sincerely doubt that the SCADA system was installed and administered by a sewage treatment chemist.

        There really is no excuse for it; I very much hope the idiot in charge of their IT security is fired.

  • by nitehawk214 (222219) on Monday November 21, 2011 @11:22AM (#38124212)

    How many children know how Simatic works?

    • by vlm (69642)

      How many children know how Simatic works?

      Lets just say that management has had a focus for decades on taking a sewer plant worker off the streets and having them be "productive" within a couple days despite no previous computer experience.

      If you had to write JCL card decks for SCADA work, that would be fairly child proof, but it wouldn't be "user friendly" enough for anyone to buy it.

  • and why... (Score:5, Insightful)

    by Lumpy (12016) on Monday November 21, 2011 @11:25AM (#38124246) Homepage

    Is a FRACKING SCADA system on the internet?

    The Plant manager needs to be fired on the spot. there is ZERO need to have a full connection from a SCADA system to any internet accessable networks.

    An airgap for data is standard operating proceedure for these things. Hell even crap SCADA software like "wonderware" supports a unidirectional ethernet cable and UDB broadcasting of the data stream so that you can airgap it from the administrative computers doing data collection.

    Note: if you don't know what a "unidirectional ethernet cable" is, think standard Cat 5 with the TX wires clipped off on one end http://www.stearns.org/doc/one-way-ethernet-cable.html [stearns.org] and YES they do work PC to PC with the right settings or by using a switch where you can force a port on without negotiation.
        No hacker on this planet can crack a system that is at the other end of this type of cable, unless he has physical access.

    • Re:and why... (Score:5, Insightful)

      by Nidi62 (1525137) on Monday November 21, 2011 @11:51AM (#38124604)

      Is a FRACKING SCADA system on the internet?

      The Plant manager needs to be fired on the spot. there is ZERO need to have a full connection from a SCADA system to any internet accessable networks.

      But how else is the plant manager or a supervisor going to get to read his favorite blogs and news sites, or see that email with the newest picture of a cute kitten doing something funny?

    • by rubycodez (864176)
      sadly, what is common is for so-called "isolated SCADA network" to be hooked to a card in a PC that also is also on LAN, and then the guy install remote access software so he doesn't have to come into work if there is a problem at 3am....... or just cracking the PC into a router is all it takes to p0wn the works
    • and why Is a FRACKING SCADA system on the internet?

      Possible answer - to allow the support team (in India?) to remote in when there are out-of-hours problems.

  • I want to have a guess! It would probably have been something relevant to what they do, and then they'd have removed the vowels (cunning), so:

    wtr

  • by brxndxn (461473) on Monday November 21, 2011 @11:34AM (#38124326)

    I'm in this line of work.. The password was not the problem. Even the hacker is thinking like 'corporate IT' would think in terms of security. The plant floor is different.

    Here's the rule: A computer that controls industrial machinery should not be connected to the Internet. The only part of an industrial process that can even possibly be connected to the Internet is historical data and alarming.

    HMI software is typically a set of screens representing the automation parts of a plant process. This means that in order to start/stop a motor or energize a valve, the screen is required. It is insecure to put a password on that screen. Yes.. insecure. The priorities at a plant are different. It is always the most secure to allow control of the plant to the people at the plant. There are physical E-stop buttons on control panels in case of emergency, but the E-stop is not the end all to prevent industrial disasters. For example, if a person has his hand caught in a valve, hitting the E-stop may cause the valve to move. Another example would be an exothermic process where explosive gases could accumulate in the wrong parts of the process, hitting the E-stop may not get rid of the gas. The operator at the plant is in charge of the process - it is critical that he or she always have control over the system.

    Therefore, don't connect your plant floor to the Internet.. unless you want China to be able to control it. If white-collar executive-type people want to see pretty screens, give them historical data.

    • by Thud457 (234763)
      what's wrong with using physical keys for this kind of situation -- proves you're there at the console, proves you've been entrusted with access (or took a wrench to somebody who had been entrusted with access).

      Everybody understands keys. And what happens if you lose them.
      • by brxndxn (461473)

        Physical keys are used for the lockout/tagout procedure during maintenance cycles. But, there is usually no reason for physical keys at the operator terminal. Usually, you have to check in at a guard shack before you enter the plant. Then, often, you have a key card that swipes you into the area you are authorized to be. After that, further security starts to just get in the way of plant operations. Plants can typically trust the people that have physical access to the area.

    • by vlm (69642) on Monday November 21, 2011 @11:52AM (#38124616)

      Its just engineering malpractice, pure and simple. No different than trying to claim we don't need those OSHA required safety guards because no one would ever do something stupid or malicious in the plant.

      The other way to hook up to the internet, as described to me by a guy who works at a "real" chemical plant where dangerous stuff is done, is you use two separate systems both of which would have to be hacked to cause damage, plus non-SCADA automatic control.

      In this scenario, where they blew the water pump up by power cycling it, there are two series control relays supplying power to the VFD and if EITHER scada system decides there is a problem with the plant or the other SCADA, that scada cuts input power to the VFD until its convinced its OK. Most VFDs like a 0-10 volt DC input to control their output, and its not all that difficult to hard wire a physical time delayed relay that says you need to output more than a volt for more than a minute to close the relay contacts connecting the VFD to the SCADA and start the pump, so the SCADA literally cannot physically turn the pump on and off more often than once per minute. You can also drive the time delayed relay off the other SCADA system, so one system decides to turn on the pump, while the other decides how fast to run the pump, and either can shut down the pump if they feel the need. Most VFDs can be configured to not allow operation outside certain limits, like drawing more than X amps where X is larger than normal but less than theoretical VFD limit, and not to turn on if a thermocouple says its too hot or a pressure gauge somewhere has an open loop signal. Similar design such that NPSH and output pressure have to be within certain limits or again, the time delayed relays open circuit the AC input to the VFDs and/or the control input to the VFDs. Finally its no heroic effort to wire up two safety bypass relays in series so that if you have control of both SCADA systems, and both independent scada systems agree, you can bypass the safety relays (and the enabling of this bypass also turns off a green light inside the safety directors office, resulting in management involvement, formal written reports and investigation, etc)

      This is cheaper to install and operate than you think, because both suppliers know darn well they can be replaced individually with no real impact to plant operations, unlike the traditional "one ring to bind them all" scada design where the consultants and suppliers know they've got you over a barrel and can charge what they want.

      • by vlm (69642) on Monday November 21, 2011 @12:20PM (#38124994)

        And a guy I know at another plant described "adversarial SCADA" to me where two separate systems from two separate mfgrs and two separate consultants, one run by an "operator" and reporting up the operations management chain all the way to the board, and another run by "safety" and reporting up the safety management chain all the way up to the board.

        The operations guy and his SCADA system do whatever they want whenever they want, but if the safety guy and his SCADA detect an overspeed or an overtemp or underpressure then safety guy and his scada cuts power to the operations guy and his scada. Also operations guy can "get even" with safety guy because he has relays installed that can simulate sensor failure, and the safety guy has to respond within X minutes following whatever procedures, and the operations guy is presumably intelligent enough to only perform those tests when operationally convenient.

        Also although technically either the safety guy OR the operations guy can punch the "give up" buttons, because the safety guy does not answer to the bean counters, that means the dump tank and suppression buttons are for all intents and purposes exclusively operated by the safety guy... The operations guys have training issues in not bothering to even know how to operate the fire suppression valves, for example. Which is bad, because the centers are geographically separate, so if a tornado wiped out the safety center, or even just a failure or a hack event took it out, the ops guys might literally not know how to put out a fire at the plant, even though they are technically capable.

        This is a fail when weird plant conditions require jury rigging and close coordination, and also a financial failure because the independent supplier of the operations scada knows the plant shuts down if they try to change out, so he's free to charge as much as he pleases.

        Hack our safety scada yesterday? who cares, ops will safe the plant. Hack our ops today? who cares, safety will safe the plant. Hack both separate systems with separate designs and separate manufactures tomorrow at the same time? who cares, that has to be an inside job...

    • by statusbar (314703)

      Most likely no one DID connect a computer that controls industrial machinery to the internet.

      They probably connected a DIFFERENT computer on the same network to the internet.

    • by tlhIngan (30335)

      Here's the rule: A computer that controls industrial machinery should not be connected to the Internet. The only part of an industrial process that can even possibly be connected to the Internet is historical data and alarming.

      Therefore, don't connect your plant floor to the Internet.. unless you want China to be able to control it. If white-collar executive-type people want to see pretty screens, give them historical data.

      Tell that to Iran. I heard their nuke program was set back a few years, even though t

  • Weren't we told that this did -not- happen? I distinctly recall seeing a denial from the authorities that any water system was compromised at any time.

  • I assume that a tech guy set up the system: "here your current password is 'Password1' Please change it, for security reasons...
  • By contrast... (Score:5, Interesting)

    by RogueWarrior65 (678876) on Monday November 21, 2011 @11:36AM (#38124356)

    Some government sites have these onerous password requirements e.g no fewer than 15 characters, no consecutive characters even if they are a different case, at least one numeric and at least one punctuation. It's not surprising that coming up with something you can remember that fulfills these requirements is a bitch. Oh, and you have to change it periodically. IMHO, this naturally leads to writing the damn thing down somewhere.

    • A password difficult enough not to get cracked is a password difficult enough that it can't be remembered. Smart card and relatively simple password is probably better but that costs money (readers and cards but also lost time because "I left my card at home") where as password complexity requirements are just a simple software configuration away.
  • by Anonymous Coward on Monday November 21, 2011 @11:41AM (#38124422)

    Network admin for another city govt in Texas here... albeit a very much smaller city.

    1) first of all, it's absolutely nuts to place your water purification SCADA (or even your wastewater plant's SCADA) onto any network segment that's accessible from the public Internet, and we in the IT department know that all too well, however we're not "in charge" of the SCADA systems and have essentially zero authority to do anything about it. Part of the problem here is that the folks who *are* in charge of these systems are thoroughly aware that we in IT know how to better secure their systems, but do not want us involved in any way because our security will "make things too hard for them to do their jobs".

    2) The folks who run the SCADA systems on a daily basis know only two things about systems security: 1) diddly and 2) squat. They are water process and industrial chemistry people, not computer people, and it shows big time.

    3) The vendors who supply and support the SCADA systems feverishly demand that the SCADA systems be easily accessible over the Internet for their convenience for remote support, and frankly do not give a rat's ass about the customers' security... their response is that security is not their problem it's ours.

    So, it's no wonder these systems are getting hacked and it's going to get worse as time progresses.

    • by vlm (69642)

      3) The vendors who supply and support the SCADA systems feverishly demand that the SCADA systems be easily accessible over the Internet for their convenience for remote support, and frankly do not give a rat's ass about the customers' security... their response is that security is not their problem it's ours.

      Can't allow VPNs instead of wide open access? Even the place I'm at now, has exclusively VPN access for "outside engineering suppliers"

      Historically, back when dial up support was the way to go, I worked at a place where IBM had remote access to "our" multiple mainframes only when a orange cable was draped across the desk of our security officer (this is before orange meant fiber, it was just orange "silver satin" 4 conductor modular phone wire).... Being a "mahogany row" level management position, this cab

  • http://youtu.be/Xy0NU-rAlT8

    4:40

  • by xyourfacekillerx (939258) on Monday November 21, 2011 @11:43AM (#38124464)
    As usual, blame the owners and operators of the target, not the hacker. Because if I don't lock my front door, it's totally OK for you to come in and run up my utility bill and eat out of my fridge, help yourself to my stereo and tv while you're at it... and if I have a spare key under my hood that you find on my car, by all means, how could anyone be held accountable if they take it for a joy ride and/or steal it?
    • by FBeans (2201802)
      If I see you bent over, I'm guna kick you up the ass. That's just how this world works. It's my fault, but your at some fault for bending over so easily. Good and Bad in black and white forms doesn't exist, in reality there a number of parties at blame for this.
    • If you walk down the street, dropping hundred dollar bills from your pocket, are you going to demand that the kids running after you, and rescuing the bills be locked up?

    • by canajin56 (660655)
      Yeah, if your car gets stolen and you say to your insurance company "Yeah I keep the keys in the ignition and never lock it, don't you fucking assholes blame the victim here, he had no right to steal my property!" you're not getting your claim approved. Just like if, say, a prison's doors aren't designed to be kick-proof, and a prisoner kicks one down and escapes, that's his fault, not the prisons! Don't blame the victim!
  • DHS Response (Score:5, Insightful)

    by TheRedSeven (1234758) on Monday November 21, 2011 @11:49AM (#38124580) Homepage
    I first found this incident via Bruce Schneier & Wired [wired.com].

    The most telling thing, for me, was this section of the linked article:

    “DHS and the FBI are gathering facts surrounding the report of a water pump failure in Springfield, Illinois,” according to a statement released by DHS spokesman Peter Boogaard. “At this time there is no credible corroborated data that indicates a risk to critical infrastructure entities or a threat to public safety.”

    So...in the instance of a single shoe bomber, stopped by his own stupidity and the efforts of other airline passengers, TSA (a section of DHS) responds by calling it a systemic risk to air travel, and we must all take off our shoes. In the instance of a plot to use liquid explosives, which probably wouldn't have worked and was stopped in the planning stages, TSA responds by calling it a systemic risk and we must all limit ourselves to 3oz bottles of liquids that fit in a quart size bag. In the instance of a single underwear bomber, stopped by his own stupidity, TSA responds by calling it a systemic risk to air travel, and we must all be subject to X-ray/millimeter wave scanners and/or the big Grope.

    In the instance of SCADA hacking, which could conceivably harm our infrastructure on a significant and systemic level from afar, with little/no risk of the perpetrators being caught, DHS responds by saying, "No big deal."

    There's something very...wrong here.

    • by FBeans (2201802)
      I hate airports: "Those our my shoes..."
  • Child knows (Score:5, Funny)

    by jones_supa (887896) on Monday November 21, 2011 @11:58AM (#38124720)

    A child who knows how the HMI that comes with Simatic works could have accomplished this,' he wrote in an e-mail.

    And a child knows too that you shouldn't break into other people's property...

  • I wonder if this is why my water pressure has been crap the last couple of days.

  • by ILongForDarkness (1134931) on Monday November 21, 2011 @12:37PM (#38125210)
    Things that need external service technicians often have very simple passwords. For example I work in health care and I know of at least two major companies who's components have the same login for every site for administrator access. You probably as a customer could insist on changing it but the vast majority of sites don't. So need to give someone some radiation? You know the password. That said it isn't going to affect a whole community but the 30-100 patients that get treated before the problem is detected? Very doable. Similarly wifi routers from ISPs almost always have a default password most people I know change the WPA key but don't touch the admin account password. So anyone allowed into the network (or who can plug a network cable into the back of the box for a couple minutes) can take it over pretty easy. Not a real big deal I realize because if they change the password to login (since they don't know yours presumably that is what they would do to get internet access) you'd realize it isn't working and work to set it back. But if you are running a wired network primarily but it is a wifi device could be an issue.

If money can't buy happiness, I guess you'll just have to rent it.

Working...