Siemens SCADA Hacking Talk Pulled From TakeDownCon 104
alphadogg writes "A planned presentation on security vulnerabilities in Siemens industrial control systems was pulled Wednesday over worries that the information in the talk was too dangerous to be released. Independent security researcher Brian Meixell and Dillon Beresford, with NSS Labs, had been planning to talk Wednesday at a Dallas security conference about problems in Siemens PLC systems, the industrial computers widely used to open and shut valves on factory floors and power plants, control centrifuges, and even operate systems on warships. But the researchers decided to pull the talk at the last minute after Siemens and the US Department of Homeland Security pointed out the possible scope of the problem."
Security through obscurity (Score:4, Insightful)
Perfect example of security through obscurity. Yeah, everyday script kiddies won't be messing around in the systems, but those dedicated to do damage or spy have the time and means to get to know the systems. And it's even easier for them because the systems aren't properly secured.
As the Iranians found out the hard way... (Score:2)
As the Iranians found out the hard way, it's difficult to keep an intruder out despite the obscure nature of PLC (most people probably don't even know what that is.)
Re: (Score:3)
As the Iranians found out the hard way, it's difficult to keep an intruder out despite the obscure nature of PLC (most people probably don't even know what that is.)
Programmable Logic Controllers.
I prefer Allen-Bradley PLCs myself.
Re: (Score:2)
They still making PCLs? I thought they ran out of prefamulated amulite years ago.
Re: (Score:2)
For those who missed this one, look up the Turbo Encabulator on youtube. Too many to link to any specific one. A very long running and hilarious joke..
Re: (Score:3)
Yeah, they're a bit cleaner. The big problem is that it's not just a Siemens problem. It's endemic throughout the industry in varying ways.
Networks that're claimed to be air-gapped- but aren't because of "ease of use" concerns.
Networks that shouldn't have a single Windows box because of that risk that do.
And, so on and so forth.
Re: (Score:3)
Re: (Score:2)
The high ticket projects all attract multinational corporations. Those corporations aren't shy about buying smaller-scale operations with technology they want. Even if you do use technology developed only in your own country, it is not sold elsewhere? Are there vulnerable systems anywhere within the local technology entity? Even if they've got 10 vulnerabilities instead of 100,000+ they're still vulnerable.
I've seen one region that didn't have any kind of electronic or software vulnerability whatsoever.
Re: (Score:2)
Part of the problem is that they're not actually THAT obscure. The documentation exists and can be had if you're a paying customer.
Re: (Score:3)
To the best of my knowledge, they never did prove that the US created Stuxnet. In fact, I've seen Israel blamed far more, based on vague references in the code.
Re: (Score:2)
At this point it doesn't really matter so much who developed it. Regardless, we're still potentially collateral damage or potential targets of a fully disassembled/reverse-engineered/built-fresh-with-a new-twist version as well as whatever the original authors might unleash. Whoever made it was shortsighted if they felt that even versions attempting to be very specific wouldn't be analyzed and modified or cause some collateral damage as-is. Pruning target-filtering code seems it would be a relatively tr
Re: (Score:2)
Iran was just a test case so that we could demonstrate just how vulnerable these things are and secure proper funding to lock ours down.
Security dude: "Some hostile country could sneak somebody in and sabotage our power plants with nothing more than malicious software!"
Congress critter: "OK, I don't really get what you're saying, but let's assume that you're right in theory. We've never seen an attack like that any where in the world - Why worry? Besides I want to put in a giant duck pond and name it afte
Re: (Score:2, Interesting)
That's not the bit that scares me the most. The bit that scares me the most is that anyone with an ounce of skill in reverse engineering can identify the security flaws used, and anyone with an ounce of skill in assembly can disassemble Stuxnet, alter what it targets, and launch the new variant.
By banning the talk, the DHS is preventing US industries from protecting themselves against economic warfare. Plenty of nations (China and Russia especially) are investing in cyber-warfare. There's plenty of amateurs
Re: (Score:2)
That's not the bit that scares me the most. The bit that scares me the most is that anyone with an ounce of skill in reverse engineering can identify the security flaws used, and anyone with an ounce of skill in assembly can disassemble Stuxnet, alter what it targets, and launch the new variant.
By banning the talk, the DHS is preventing US industries from protecting themselves against economic warfare. Plenty of nations (China and Russia especially) are investing in cyber-warfare. There's plenty of amateurs out there with axes (albeit often as delusionary as the DHS') to grind. It is simply not excusable for the US to be placed in this kind of danger.
That is why Stuxnet needs to be classified.
Re: (Score:2)
Perhaps the intent is insecurity through obscurity. Can't sabotage your enemy's systems if you tell them where all the holes are.
Re: (Score:1)
Re: (Score:3)
Why would Siemens bother fixing holes nobody knows about?
Re: (Score:2)
Re: (Score:2)
Now that people know the holes exist, the race is on. They can't afford not to.
Re: (Score:2)
Everyone knows holes exist. Every non-trivial piece of software has holes in it.
Re: (Score:1)
Re: (Score:2)
The whole industry is riddled with massive holes because we're all tied to legacy OPC which relies on that massive dogs breakfast called DCOM. The slow adoption of OPC UA and even OPC WCF keeps the whole industry in a situation where it is easier to disable all security than deal with DCOM. Which makes the siemens issue too easy to exploit. Every single bloody version of windows has a different way of being configured, so no one bothers to do it right...
Siemens needs to fix their issues. So does everyone e
Re:Security through obscurity (Score:5, Informative)
"The vendor had proposed a fix that turned out not to work, and we felt it would be potentially very negative to the public if information was put out without mitigation being available." ... In the past, technology companies have threatened legal action against researchers, but Moy said that in this case the lawyers were not involved. "It's a temporary hold on the information; it's not that it's being buried," he said. "We just don't want to release it without mitigation being out there for the owners and operators of the SCADA equipment."
Re: (Score:2)
Re: (Score:3)
Heh... If they think that those patches will get deployed in a timeframe measured in anything other than months or years, they're kidding themselves...
SCADA systems typically don't get patched- and when they do or get upgraded, it's a "big thing".
Re: (Score:2)
Mod parent up. Mostly when you patch or upgrade your scada everything breaks causing a massive headache. So most people would really rather not.
Re: (Score:1)
Re:Security through obscurity (Score:4, Informative)
It makes doing work more difficult, and there are still some attack vectors.
Re: (Score:1)
Fuck you.
--skynet
Re: (Score:1)
Re: (Score:2)
Depends on the design. Properly designed setups will have an air-gap and only data transfer via sneakernet in the form of a hard-disk or similar coming from the SCADA to the corporate systems. Real-time's desirable- but for some networks, having the hole's too much of a risk- especially if you've got a Windows based HMI system or similar in the mix. Seriously.
Re:Security through obscurity (Score:4, Informative)
And stuxnet was transmitted via USB sticks doing the sneakernet stuff...
Re: (Score:2)
...Properly designed setups will have an air-gap...
Very very few industrial site have the "air-gap" any more. I suppose all the rest are improperly designed?
Real-time's desirable- but for some networks, having the hole's too much of a risk- .
For whom is it too much of a risk? Power stations? Mines? Water Treatment? None of the sites I work with have an air-gap any more.
especially if you've got a Windows based HMI system or similar in the mix. Seriously.
I'd say that the vast majority of SCADA/HMI systems run on Windows. In critical infrastructure. Without an air gap.
I sure as hell hope there are other ways of securing a network
Re: (Score:2)
I work on a PLC system that has a single ethernet TX pair to the rest of our network. It transmits stats blindly (with the help of a static entry in its ARP table) to a PC on the outside where a small program listens and collates data. I've heard of similar things with serial, fiber and radio modems,etc.
Re: (Score:2)
Do you audit it often to make sure it's still air-gapped like you think it is? Many of the audits at power utilities where they had the same thinking had pro-sumer routers or switches tying the networks together that were done in a pinch for some ease of deployment thing or ease of use thing and then got forgotten.
Re: (Score:2)
Certainly audits are a good thing, but we mustn't forget that we're talking about something that gets in and hides itself well, even deleting itself from some hardware along the way. An audit of hardware still only gives a snapshot in time. That laptop that was briefly plugged in, or machine that briefly had a USB key plugged in, may be long gone. Intrusion detection can help, but with things like traffic to a PLC using the normal ports, it may take deep inspection of every packet to see what's going on,
Re: (Score:2)
As it should be. But isolation does not require a complete elimination of remote monitoring. Our Process Control Network has a Server on it, which via a hardware firewall pumps data one way to another machine outside which emulates the view of the process network. This basically gives us complete remote monitoring without the ability to send data back to the network.
It makes it easy and there are few if any attack vectors, and when malware spreads around the business network (frequent) it so far has never m
Re: (Score:2)
Re: (Score:2)
Ture, not necessarily expensive in absolutes. Just more expensive than the alternative. You'd be amazed at what some people come up with when "value engineering".
Re: (Score:1)
At my workplace, all our PLCs are on a process control network. It is isolated from the business network and internet completely.
You are utterly kidding yourself if you think that your PLC network is "isolated". Does anyone ever request data from it? How do you transfer the data...with a USB key maybe? How are the controllers programmed? With a workstation that is plugged into which network...and never the internet? I would strongly suggest that you read up a bit on stuxnet. The details may blow your mind...
Re: (Score:2)
It's not difficult.
1. decide what parameters are going to be reported from the secure system to the outside world and how frequently. Say "widget-count" and "sprocket-temperature", three sprocket temperatures per widget count.
2. code your PLC network to count widgets, measure sprocket temperature
Reponsible Disclosure (Score:5, Insightful)
Re: (Score:2)
Perfect example of security through obscurity. Yeah, everyday script kiddies won't be messing around in the systems, but those dedicated to do damage or spy have the time and means to get to know the systems. And it's even easier for them because the systems aren't properly secured.
I'll be at work for a few more hours. In my living room at home there is a suitcase with a lot of cash in it. I didn't lock my front door, I didn't even close it. I won't tell you where I live. Security through obscurity.
Re: (Score:2)
You live in LA. Took me all of five minutes to figure that out.
As soon as hackers know there's an attack vector and there's something worthwhile to obtain, you can be sure they'll figure it out pretty quickly.
You're looking in a ginormously huge, and wrong, city.
Re: (Score:2)
Admins at /. have your IP address, they may try to bribe the admins at your ISP to get your street address. How much cash is in the suitcase?
I said I'm at work. I also said you only have hours to get it. What you don't know is still preventing you from getting the cash.
Re: (Score:2)
1) it doesn't matter what secret *I* don't know about the location of the suitcase, what matters is whether *you've* been under surveillance for the last couple of weeks. If so, your suitcase is already gone by the time you go back home.
Not everybody gets hacked, but if it's a juicy target the attack is going to be properly organized and when a vulnerability window appears for a few hours, it will get used.
2) even if I don't know the location of your suitcase full of mone
Re: (Score:2)
1) it doesn't matter what secret *I* don't know about the location of the suitcase...
Yes it does. You need information in order to actually pull it off.
Not everybody gets hacked, but if it's a juicy target the attack is going to be properly organized and when a vulnerability window appears for a few hours, it will get used.
All you are really saying here is that there is no such thing as security because nothing can be protected against an attack by an entity with infinite energy and resources.
2) even if I don't know the location of your suitcase full of money, I can break into all my neighbours' places and steal their suitcases full of money
Right, my obscured info is protecting me.
If a vulnerability exists on one person's computer, then that vulnerability exists on all the computers throughout the world which use the same OS and relevant settings. The bad guys don't need to hack *your* computer, they only need to hack *some* computer.
Sure. However, here's another way of saying it: If they know you have a vulnerability, they can get in. You are right, though, in that they are saved the trip over there to find out about it.
In the real world, security through obscurity is no security.
No, it's a Slashdot meme that puts
Re: (Score:2)
Correct in a sense. The analogy I'd use is the lottery: Pick any one person you like, and their chance of winning is zero. But the chance that someone will win is close to 1. It's correct for a single person to assume they will not win, but it's incorrect for the lottery organisers to assume that they will not have to pay out the
Secrecy (Score:1, Insightful)
The argument that some knowledge is too dangerous to know is specious and flawed. But I can't tell you how or why for fear of undermining our existing regime of ignorance and ineptitude.
Re:Secrecy (Score:5, Insightful)
Re: (Score:1)
How many times in this topic are you going to ask people if they RTFA?
This is /., we already know they didn't.
Not what is being argued (Score:2)
Re: (Score:2)
> The argument that some knowledge is too dangerous to know is specious and flawed.
That's not the reasoning given. The knowledge IS known. Some knowledge is dangerous to disseminate. This is a sad fact of humanity, but a fact. Given opportunity and knowledge of vulnerability, you will get attempts to use and abuse knowledge with similar results. People are eager to exercise their imagination and reluctant to exercise restraint or critical thought. I can understand their position.
Re: (Score:2)
> The argument that some knowledge is too dangerous to know is specious and flawed.
That's not the reasoning given. The knowledge IS known. Some knowledge is dangerous to disseminate. This is a sad fact of humanity, but a fact. Given opportunity and knowledge of vulnerability, you will get attempts to use and abuse knowledge with similar results. People are eager to exercise their imagination and reluctant to exercise restraint or critical thought. I can understand their position.
Thank you for replying instead of simply down-modding an argument you don't agree with. Others seem to prefer retaliation to debate.
Let's look at this from another perspective. Everyone knows there are problems with Siemens' PLCs. That's been known since Stuxnet got reverse engineered. While there's no problem whatsoever with sharing the information about specific vulnerabilities with Siemens - indeed, making sure they're the among the first to know - what additional danger would be presented by sharing tha
In other words (Score:3)
Re:In other words (Score:5, Interesting)
Other facilities were less secure. I remember getting a panicked call from someone shouting "The Damns gonna bust!!!" They had a single "Circuit" they paid about $20 a month for that was nothing more that a single copper that ran from some building to the local damn. They'd apply +5 volts to the line to open the damn, and -5volts and it would close. They'd reacted too slowly to rising waters and it had flooded the copper pair they used to control the damn. They wanted us to send a phone tech into their overflowing damn to repair the circuit so they could open it from the safety of their administrative building. They had a hard time understanding my near hysterical laughter.
Re: (Score:2)
We usually use dams to hold back water, not damns. Sure, sometimes the damn dam breaks, but that's no reason to damn it from the beginning.
Re: (Score:2)
Heh... All it takes is a bit more effort- but it'd be a bit more obvious to pop a passive tap in a fiber run since they're not small. Sadly, it's not sound thinking all the same. The attackers are as likely to attack the end-nodes of the system where the security is much, much weaker and there's copper to be compromised before it gets to the fiber loops. You can do as much or more damage by dinking with a substation's setup as with the generation
Re: (Score:2)
Re: (Score:1)
It's not fair to pick on Siemens, there isn't a secure PLC out there.
Re: (Score:1)
It's not fair to pick on Siemens, there isn't a secure PLC out there.
That's correct. PLCs do exactly what they're told...no matter who is telling them
Re: (Score:2)
No in other words you better hope you have good network design.
At our workplace an attacker would need to get through a firewall, ... another firewall, ... and another firewall as they work their way through the business network, the information network, down to the process control network. That last firewall is a doozy too, one way communication between 2 computers only.
"pointed out the possible scope of the problem" (Score:1)
But the researchers decided to pull the talk at the last minute after Siemens and the US Department of Homeland Security pointed out the possible scope of the problem."
Don't you mean the DHS told them not to do it or they would get a thorough anal probing in the airport security check on their way out of town. I'm pretty sure they understood the "scope of the problem" before they started doing the research (which was also probably the motivation for the research).
Re: (Score:3, Informative)
Idiot.
First of all, don't you realize every time you make a joke about "anal probes" at the airport, you're being not-so-subtly homophobic? Same thing with prison-rape jokes. I'm about as much a fan of those jokes as I am of the acts.
Didn't you read the part where the DHS CERT (a part of US-CERT, which falls under DHS but has nothing to do with the TSA...) told NSS something like, "Um, guys, the patch Siemens released doesn't work, and there are thousands of these devices deployed all over the place, includ
Re: (Score:3)
Nonsense; it's a reference to bodily violation which works no matter what your gender and orientation. Just because a man is gay doesn't mean he wants the TSA up his ass.
Disclosure delayed is disclosure which does
Re: (Score:2)
You, my familial-basement-dwelling troll, assume coercion and conspiracy is how everything gets done by three-letter agencies.
I didn't assume it. I learned it by reading the memos from the U.S. government that were leaked.
First of all, don't you realize every time you make a joke about "anal probes" at the airport, you're being not-so-subtly homophobic?
Why do you assume that every gay likes a government agent to stick his gloved hand up his ass? Way to stereotype......
Ummmm.... (Score:2, Insightful)
...doesn't the existance of a virus that can attack such devices make this a zero-day flaw? The hack is public, since anyone can disassemble the virus that's in the wild and see how it works.
And, frankly, I don't see it being awfully difficult for any Black Hat with a mind to to rip out the prior payload and install one that can attack a wider range of devices. Surely it is in the interests of security for corporations to understand what they can do to mitigate the risk of this.
The DHS, IMHO, is acting in a
Ok, bad guys... (Score:2)
... stick your fingers in your ears and repeat after me, "La-la-la-la-la-la-la..."
Asking people not to listen (such as the US government telling college students, of all people, not to read ANYTHING about Wikileaks) makes as much sense as telling the speakers not to speak.
"shh, don't tell" is pointless (Score:2)
The people you don't want to know about this stuff, already know. The only reason Siemens or others don't want the info made public is to save face.
Hallelujah, Siemens gets it (Score:5, Informative)
A lot of people seem to want to scream about censorship, but they're missing the point. This is one of the best case scenarios I've seen in relations between companies and security researchers.
For those who can't be bothered to RTFA, here's a summary.
Researchers found a serious flaw. The company developed a fix. It turned out that the fix was flawed. The company told the researchers about the potential impact of giving the talk before the flaw was fixed, and the researchers voluntarily postponed the talk while a better fix is built.
That's it, and it looks like everybody did the best thing they could. Isn't this what we'd want Siemens to do? "You've got a right to give your talk, but we'd like you to postpone it. Here's why. Your call."
Re: (Score:2)
The info exists. The info is valuable to people who want to do something bad. Valuable information will find a supplyer, provided the demand (and pay) is high enough.
People who want information for nefarious reasons don't care about legal troubles connected with the acquisition of said information. People who want information to prevent said nefarious actions usually cannot ignore the law when trying to get it.
Question for 100: Who will now that this talk is not being held have the information, and who will
Re: (Score:2)
The same (good and bad) people have it without the talk, but the rest of the world does not. Although the risk level is still there, it's not increased. If TFA is correct and Siemens is working on a fix, then what's wrong with giving them the time they need and/or working with them?
Re: (Score:3)
Responsible disclosure says that you should give the responsible party a reasonab
Just so I get that straight (Score:2)
So it would decrease security to give that information to people who pay for a sec talk, people who are most likely sent there by companies, companies possibly that use the technology in question?
Let's think for a while: Someone who wants to blow up a dam or nuke a power plant probably doesn't really care too much about "virtual trespassing", aka hacking and the legal implications thereof, and neither would he bother to second guess spending some 1000 bucks on someone who would provide this information, whi
Re: (Score:2)
By not conducting the talk, the risk level is not increased, at least. It's still there, obviously. The companies that would have attended this talk should already be working on isolating SCADA and similar systems as much as possible, with or without the specifics of the talk. I doubt companies are going to be patching SCADA systems themselves without help from Siemens or their vendor. If Siemens is indeed honestly working on a solution, then _delaying_ the talk is entirely reasonable.
The big picture. (Score:2)
If the US intelligence services and Siemens had worked together in the past to exploit SCADA vulnerabilities in systems owned by unfriendly nations.
Why would they want to increase awareness of SCADA problems?