Iranian Hackers Probe US Infrastructure Targets 203
Taco Cowboy points out reports in The Register and The Jerusalem Post (along with a paywalled article at the WSJ) that say "[Iranian hackers are] responsible for a wave of computer attacks on U.S. corporations, with targets including oil, gas and electricity companies. Unlike the cyber incursions from China, the goal of the Iranian attacks is sabotage rather than espionage. The cyber attacks are seen as attempts to gain control of critical processing systems. The attacks on oil, gas and power firms have so far concentrated on accruing information on how their systems work – a likely first step in a co-ordinated campaign that would eventually result in attacks aimed at disrupting or destroying such infrastructure."
blowback (Score:5, Interesting)
Maybe launching destructive malware at Iranian infrastructure wasn't such a good idea.
Re:Internet facing? (Score:5, Interesting)
The big question is why "critical" infrastructure is tied directly to the internet?
Why not? "Critical" does not mean "vulnerable". IAAESE*. It is not that hard to create a system that is not "hackable" in a dangerous way. You just need to design in multiple levels of safety:
1. Top level GUI
2. Control system running in a separate process, that sanity checks any input from the GUI.
3. A firmware monitor running on a hardened 8-bit processor (8051, AVR, etc.), that runs a watchdog timer and scans the system to ensure all parameters are within safe limits.
4. Mechanical interlocks, governors, brakes, fuses, etc.
I have read plenty of stories about how hackers will drop elevators full of passengers into the basement, and turn traffic lights "all green". But anyone that works on those systems will tell you that it is all baloney. It is physically impossible to do that from software. That kind of sabotage would need at least a crowbar and a soldering iron.
I think that what is really going on is the industry is promoting these scare stories in the hope of getting government pork dollars to "fix the problem".
* I Am An Embedded System Engineer.