SCADA Hacker: Water District Used 3-Character Password 213
Trailrunner7 writes "In an e-mail interview with Threatpost, a hacker who compromised software used to manage water infrastructure for South Houston, Texas, said the district had HMI (human machine interface) software used to manage water and sewage infrastructure accessible to the Internet and used a password that was just three characters long. The hacker, using the handle 'pr0f' took credit for a remote compromise of supervisory control and data acquisition (SCADA) systems. Communicating from an e-mail address tied to a Romanian domain, the hacker told Threatpost that he discovered the vulnerable system using a scanner that looks for the online fingerprints of SCADA systems. 'This was barely a hack. A child who knows how the HMI that comes with Simatic works could have accomplished this,' he wrote in an e-mail."
duh (Score:5, Funny)
the upside is if you can't afford your own truck landing robot helicopter, it shouldn't be too hard to steal one. access to truck landing robot helicopters should be an inalienable right.
i bet the password was h2o
Re:duh (Score:5, Insightful)
Re:duh (Score:5, Funny)
Of course [xkcd.com], you are correct.
Re: (Score:2, Insightful)
Re:duh (Score:4)
Except that there aren't going to be 6000 "common words" as the base. You're going to see the same inanity as current passwords, you're going to see dictionary file attacks using an actual kiddy dictionary with 1000 words or less. This will break through most passwords. You're going to see users allowed to create their own password, which means "jebusisgodone" and "onelittlefishyswim" followed "jebusisgodtwo" and "twolittlefishyswim" and so on and so forth.
"Bitwise", it sounds secure, until you realize it can trivially be attacked on the token level rather than the bit level.
Re: (Score:3)
Re: (Score:3)
Re: (Score:2)
I hate passphrases (Score:2)
I hate passphrases because I once used one for PGP and then forgot which verbs were in the past tense and which weren't. I guess I could have hacked my passphrase easily, but I didn't really need it, so I gave up.
Re: (Score:3, Insightful)
The comic probably does look retarded, to someone who doesn't grasp the concept. You better go now, I can hear the short bus honking for you!
Re: (Score:2, Offtopic)
I spent the last couple hours trying to get first post on stories so I could make comments with the subject of "Duh" and a joke about a uav helicopter landing on a truck. And you wonder? Really?
Re: (Score:2)
H2o. Need at least one uppercase, one lower case and one non-letter.
They should change it to H2Oiswater, in order to meet the new 10-character minimum requirement.
Re: (Score:2)
It's distressing how often it's `h2o`.
Re: (Score:2)
In the 90s, I used to use "water" for everything..
Re: (Score:2)
Re: (Score:2)
Re:duh (Score:5, Funny)
Re: (Score:2)
This is the second one I've heard of in a week, there was one a few miles from here last week (it was covered in slashdot). SCADA operators better start smartening up or there'll be some serious trouble.
Someone should at least get a reprimand out of this. Three letters? WTF?
Predicting Government Response (Score:5, Funny)
A child who knows how the HMI that comes with Simatic works could have accomplished this...
The obvious course of action to prevent future attacks against SCADA systems is to ban all children. Problem sovled.
Re: (Score:2, Informative)
Credit where credit was due: It was a Siemens system, of Stuxnet fame. Great for launching false-flag attacks to drum up support against "terrorists" and our civil rights.
-- Ethanol-fueled
Re: (Score:3, Funny)
A child who knows how the HMI that comes with Simatic works could have accomplished this...
Well, yeah, I mean, who doesn't have fond memories of studying the Simatic HMI on SCADA systems back in preschool?
Re:Predicting Government Response (Score:5, Funny)
no, our teacher was a doody head. He was too lazy to teach the modules on SCADA and just had us spend extra time "playing with blocks".
Re:Predicting Government Response (Score:5, Interesting)
You think this is funny, eh?
Richard Feynman had a story about how his hobby was safe cracking. He cracked a cabinet that had a combination lock on it and then told the people who mattered the security hole. Did they upgrade the security on the cabinet? No, they banned him from the room. Problem solved.
--
BMO
Re: (Score:3)
I do it to piss you, personally, off. Specifically. Indeed, I've been doing it since 1986 to piss you off, even before I met you.
--
BMO
Re: (Score:3)
How much more proof do we need? (Score:5, Insightful)
How about passwords that don't have to charged 30 (Score:5, Interesting)
How about passwords that don't have to charged each 30 days and you can't use the last 4 passwords.
Re:How about passwords that don't have to charged (Score:5, Informative)
That is annoying, forcing me to change my password at the end of the month from H@cker1 to H@cker2 to H@cker3, and H@cker4 before I can go back to the password I like, but they IT work preventers at my work are really good, so when I am working on the road for 2 weeks, they make sure I can't change my login password without being on the intra-net, and once I am 2 days passed the expire date, the prevent me from launching VPN, joining web meetings... So then I have to use gmail to email a co-worker my passwords so he can change them for me on connected laptop first. Lots of fun.
Re: (Score:2)
Re: (Score:2)
At my previous employer we started using the month at the end of our passwords so IT implemented a 24 password history... I just moved to 'yydd'.
Re:How about passwords that don't have to charged (Score:4, Interesting)
At a larger scale: say your China and you are hacking power plant passwords to be able to shut them off (not blow them up). If the passwords are cycled frequently you likely will always have some passwords you've cracked and some you haven't, but the chances that you'll get a sufficient subset of the passwords cracked so you could completely bring the power grid down in a geographical area is remote.
Re: (Score:2, Funny)
Re:abc (Score:5, Funny)
That's the same combination I have on my luggage!
easy as 123 (Score:3)
easy as 123 it's so easy to hack the water system.
Re:easy as 123 (Score:5, Funny)
ABC, 123, PLC baby, you and me girl!
Re: (Score:2)
And "123" (without quotation marks) is my password.
Effective passwords? (Score:5, Funny)
Re:Effective passwords? (Score:5, Insightful)
Yeah, thar's yer problem. Just because these things are second nature to us, doesn't mean that non-experts are any good at making these decisions.
I'd like to see the investigation focus on who approved putting a SCADA system directly on the Internet, why, and then see structural changes to ensure that that sort of person can't make those sorts of decisions anymore.
Yeah, all SCADA systems should use ssh-quality authentication, but in the meantime we have millions of units deployed that need to be secured.
Hey, maybe I should market the pfSense firewalls I sell as SCADA secure access controllers... :P
some PHB who does not want to pay for on site staf (Score:3)
some PHB who does not want to pay for on site staff say make so the work can be done remotely.
Re: (Score:2)
Yeah, all SCADA systems should use ssh-quality authentication, but in the meantime we have millions of units deployed that need to be secured.
I don't want brown turds floating in my water cause the "leap of faith" failed coupled with lack of crypto binding between session and user credentials.
Hey, maybe I should market the pfSense firewalls I sell as SCADA secure access controllers... :P
Maybe you shouldn't.
Re: (Score:2)
It's an improvement. Slight, but an improvement none the less. I personally prefer the SEL 3620 and similar devices for this type of task (ethernet gateway for up to 16 serial links).
The biggest problem with most systems is that they need device-level passwords vs user-level passwords (and the default management passwords are almost always in place). If you at least set up a VPN with certificate-based authentication you have created a significant barrier to the network, without complicating response time
Re: (Score:2)
Use keyfiles w/ passwords & cryptknock, problem solved. It can all be made into one handy script that runs from a flash drive to make it easy for users.
Re: (Score:3)
Would you believe that the SCADA system that runs the water utility I work for has such a button on the screen? You would? Cool. I have this used bridge I'd like to sell you in New York City.
You criticize people for not having an effective password and then promptly say something so ignorant that any plumber, civil engineer, or a fifth grader could tell you you're wrong. Ignorance happens. If you need proof, look in a mirror.
Now as for the password, yes, it is foolish. There is more truth in the character
Re: (Score:2)
I would have assumed that a major water utility would have employed some IT specialists to run their IT systems (that is, "some of us"). I sincerely doubt that the SCADA system was installed and administered by a sewage treatment chemist.
There really is no excuse for it; I very much hope the idiot in charge of their IT security is fired.
How many... (Score:3)
How many children know how Simatic works?
Re: (Score:2)
How many children know how Simatic works?
Lets just say that management has had a focus for decades on taking a sewer plant worker off the streets and having them be "productive" within a couple days despite no previous computer experience.
If you had to write JCL card decks for SCADA work, that would be fairly child proof, but it wouldn't be "user friendly" enough for anyone to buy it.
and why... (Score:5, Insightful)
Is a FRACKING SCADA system on the internet?
The Plant manager needs to be fired on the spot. there is ZERO need to have a full connection from a SCADA system to any internet accessable networks.
An airgap for data is standard operating proceedure for these things. Hell even crap SCADA software like "wonderware" supports a unidirectional ethernet cable and UDB broadcasting of the data stream so that you can airgap it from the administrative computers doing data collection.
Note: if you don't know what a "unidirectional ethernet cable" is, think standard Cat 5 with the TX wires clipped off on one end http://www.stearns.org/doc/one-way-ethernet-cable.html [stearns.org] and YES they do work PC to PC with the right settings or by using a switch where you can force a port on without negotiation.
No hacker on this planet can crack a system that is at the other end of this type of cable, unless he has physical access.
Re:and why... (Score:5, Insightful)
Is a FRACKING SCADA system on the internet?
The Plant manager needs to be fired on the spot. there is ZERO need to have a full connection from a SCADA system to any internet accessable networks.
But how else is the plant manager or a supervisor going to get to read his favorite blogs and news sites, or see that email with the newest picture of a cute kitten doing something funny?
Re: (Score:2)
Re: (Score:2)
and why Is a FRACKING SCADA system on the internet?
Possible answer - to allow the support team (in India?) to remote in when there are out-of-hours problems.
Re: (Score:3, Funny)
Unique = One of
United = Made into one
Stop me if you see a pattern.
Re:and why... (Score:5, Insightful)
Understanding what the term means is completely different from understanding how it is accomplished.
I've been building and maintaining networks for over a decade and have never even considered a uni-directional connection before I read this today. Of course, the systems I'm familiar with are specifically for internet access, so bi-directional communication and firewalls had become my norm.
Thanks for the education Lumpy!
Re: (Score:2)
I'm kind of glad, really. It would be very interesting to be in a meeting with someone as seasoned as yourself offering thousands of $currency's worth of new kit as the best solution, and for a "Lumpy" like me to say "Why not cut the Tx pair?".
I guess formal education really can get in
Re: (Score:3, Informative)
I was referring to the person who had something constructive and informative to say.
Simply cutting the TX pair won't do the trick, there are many more configurations necessary for the network to accept this type of connection. Negotiation is a process where two end points determine the capabilities of the other end and "negotiate" a connection. Without bi-directional communication, you must configure the transmitting end with static values, then inform the receiving end what those values are. Simply cutt
Re: (Score:3)
Yeah, but this could have just as easily been one of those *Monster* unidirectional cables. You know, the ones with the arrows printed on them telling you which way the bit flow. These only have one arrow printed.
Re: (Score:2)
Re: (Score:2)
I don't see how TCP could possibly work over a unidirectional ethernet cable. Only UDP. And even then only if the higher level network code was designed to handle generic broadcast to an IP address without anything initiating the connection or any kind of handshaking, etc. My point being that virtually no software would work with such a cable unless it was specifically designed to handle that scenario.
syslog, in continuous use since the 80s. The advantage of being old is everything old is new again. I'm sure someone will reinvent syslog and sell it for millions to SCADA operators.
And yes, having done this, you do have to hard code the ARP table entries in the sender on the local lan, hence the appeal of putting a router in front of the doctored up cable such that it's the only device than need be configured with the MAC address of the syslog sink machine.
Re:and why... (Score:4, Interesting)
No one can hack it? Yeah right, until someone stuffs some firmware into the ethernet driver that reverses the RX and TX lines.
And they would install this firmware on the PLC how?
Re: (Score:2)
Shit, good point 8-(
http://www.transition.com/pshelp/cross.html [transition.com]
Assuming that it can run commands when receiving traffic only, this could work...
Re: (Score:2)
Ooh, ooh! (Score:2)
I want to have a guess! It would probably have been something relevant to what they do, and then they'd have removed the vowels (cunning), so:
wtr
Password not the problem (Score:5, Interesting)
I'm in this line of work.. The password was not the problem. Even the hacker is thinking like 'corporate IT' would think in terms of security. The plant floor is different.
Here's the rule: A computer that controls industrial machinery should not be connected to the Internet. The only part of an industrial process that can even possibly be connected to the Internet is historical data and alarming.
HMI software is typically a set of screens representing the automation parts of a plant process. This means that in order to start/stop a motor or energize a valve, the screen is required. It is insecure to put a password on that screen. Yes.. insecure. The priorities at a plant are different. It is always the most secure to allow control of the plant to the people at the plant. There are physical E-stop buttons on control panels in case of emergency, but the E-stop is not the end all to prevent industrial disasters. For example, if a person has his hand caught in a valve, hitting the E-stop may cause the valve to move. Another example would be an exothermic process where explosive gases could accumulate in the wrong parts of the process, hitting the E-stop may not get rid of the gas. The operator at the plant is in charge of the process - it is critical that he or she always have control over the system.
Therefore, don't connect your plant floor to the Internet.. unless you want China to be able to control it. If white-collar executive-type people want to see pretty screens, give them historical data.
Re: (Score:2)
Everybody understands keys. And what happens if you lose them.
Re: (Score:3)
Physical keys are used for the lockout/tagout procedure during maintenance cycles. But, there is usually no reason for physical keys at the operator terminal. Usually, you have to check in at a guard shack before you enter the plant. Then, often, you have a key card that swipes you into the area you are authorized to be. After that, further security starts to just get in the way of plant operations. Plants can typically trust the people that have physical access to the area.
Re: (Score:3)
shit! fuck! my hand's stuck!
hang on, lemme get my OTP calculator out.
Re:Password not the problem (Score:5, Informative)
Its just engineering malpractice, pure and simple. No different than trying to claim we don't need those OSHA required safety guards because no one would ever do something stupid or malicious in the plant.
The other way to hook up to the internet, as described to me by a guy who works at a "real" chemical plant where dangerous stuff is done, is you use two separate systems both of which would have to be hacked to cause damage, plus non-SCADA automatic control.
In this scenario, where they blew the water pump up by power cycling it, there are two series control relays supplying power to the VFD and if EITHER scada system decides there is a problem with the plant or the other SCADA, that scada cuts input power to the VFD until its convinced its OK. Most VFDs like a 0-10 volt DC input to control their output, and its not all that difficult to hard wire a physical time delayed relay that says you need to output more than a volt for more than a minute to close the relay contacts connecting the VFD to the SCADA and start the pump, so the SCADA literally cannot physically turn the pump on and off more often than once per minute. You can also drive the time delayed relay off the other SCADA system, so one system decides to turn on the pump, while the other decides how fast to run the pump, and either can shut down the pump if they feel the need. Most VFDs can be configured to not allow operation outside certain limits, like drawing more than X amps where X is larger than normal but less than theoretical VFD limit, and not to turn on if a thermocouple says its too hot or a pressure gauge somewhere has an open loop signal. Similar design such that NPSH and output pressure have to be within certain limits or again, the time delayed relays open circuit the AC input to the VFDs and/or the control input to the VFDs. Finally its no heroic effort to wire up two safety bypass relays in series so that if you have control of both SCADA systems, and both independent scada systems agree, you can bypass the safety relays (and the enabling of this bypass also turns off a green light inside the safety directors office, resulting in management involvement, formal written reports and investigation, etc)
This is cheaper to install and operate than you think, because both suppliers know darn well they can be replaced individually with no real impact to plant operations, unlike the traditional "one ring to bind them all" scada design where the consultants and suppliers know they've got you over a barrel and can charge what they want.
Re:Password not the problem (Score:5, Interesting)
And a guy I know at another plant described "adversarial SCADA" to me where two separate systems from two separate mfgrs and two separate consultants, one run by an "operator" and reporting up the operations management chain all the way to the board, and another run by "safety" and reporting up the safety management chain all the way up to the board.
The operations guy and his SCADA system do whatever they want whenever they want, but if the safety guy and his SCADA detect an overspeed or an overtemp or underpressure then safety guy and his scada cuts power to the operations guy and his scada. Also operations guy can "get even" with safety guy because he has relays installed that can simulate sensor failure, and the safety guy has to respond within X minutes following whatever procedures, and the operations guy is presumably intelligent enough to only perform those tests when operationally convenient.
Also although technically either the safety guy OR the operations guy can punch the "give up" buttons, because the safety guy does not answer to the bean counters, that means the dump tank and suppression buttons are for all intents and purposes exclusively operated by the safety guy... The operations guys have training issues in not bothering to even know how to operate the fire suppression valves, for example. Which is bad, because the centers are geographically separate, so if a tornado wiped out the safety center, or even just a failure or a hack event took it out, the ops guys might literally not know how to put out a fire at the plant, even though they are technically capable.
This is a fail when weird plant conditions require jury rigging and close coordination, and also a financial failure because the independent supplier of the operations scada knows the plant shuts down if they try to change out, so he's free to charge as much as he pleases.
Hack our safety scada yesterday? who cares, ops will safe the plant. Hack our ops today? who cares, safety will safe the plant. Hack both separate systems with separate designs and separate manufactures tomorrow at the same time? who cares, that has to be an inside job...
Re: (Score:2)
Most likely no one DID connect a computer that controls industrial machinery to the internet.
They probably connected a DIFFERENT computer on the same network to the internet.
Re: (Score:2)
Tell that to Iran. I heard their nuke program was set back a few years, even though t
Wait... (Score:2)
Weren't we told that this did -not- happen? I distinctly recall seeing a denial from the authorities that any water system was compromised at any time.
The default password could have been stronger... (Score:2)
By contrast... (Score:5, Interesting)
Some government sites have these onerous password requirements e.g no fewer than 15 characters, no consecutive characters even if they are a different case, at least one numeric and at least one punctuation. It's not surprising that coming up with something you can remember that fulfills these requirements is a bitch. Oh, and you have to change it periodically. IMHO, this naturally leads to writing the damn thing down somewhere.
Re: (Score:2)
Epic Fail & no-win situation (Score:5, Interesting)
Network admin for another city govt in Texas here... albeit a very much smaller city.
1) first of all, it's absolutely nuts to place your water purification SCADA (or even your wastewater plant's SCADA) onto any network segment that's accessible from the public Internet, and we in the IT department know that all too well, however we're not "in charge" of the SCADA systems and have essentially zero authority to do anything about it. Part of the problem here is that the folks who *are* in charge of these systems are thoroughly aware that we in IT know how to better secure their systems, but do not want us involved in any way because our security will "make things too hard for them to do their jobs".
2) The folks who run the SCADA systems on a daily basis know only two things about systems security: 1) diddly and 2) squat. They are water process and industrial chemistry people, not computer people, and it shows big time.
3) The vendors who supply and support the SCADA systems feverishly demand that the SCADA systems be easily accessible over the Internet for their convenience for remote support, and frankly do not give a rat's ass about the customers' security... their response is that security is not their problem it's ours.
So, it's no wonder these systems are getting hacked and it's going to get worse as time progresses.
Re: (Score:2)
3) The vendors who supply and support the SCADA systems feverishly demand that the SCADA systems be easily accessible over the Internet for their convenience for remote support, and frankly do not give a rat's ass about the customers' security... their response is that security is not their problem it's ours.
Can't allow VPNs instead of wide open access? Even the place I'm at now, has exclusively VPN access for "outside engineering suppliers"
Historically, back when dial up support was the way to go, I worked at a place where IBM had remote access to "our" multiple mainframes only when a orange cable was draped across the desk of our security officer (this is before orange meant fiber, it was just orange "silver satin" 4 conductor modular phone wire).... Being a "mahogany row" level management position, this cab
Was it GOD? (Score:2)
http://youtu.be/Xy0NU-rAlT8
4:40
Well that makes it OK, then! (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
If you walk down the street, dropping hundred dollar bills from your pocket, are you going to demand that the kids running after you, and rescuing the bills be locked up?
Re: (Score:2)
DHS Response (Score:5, Insightful)
The most telling thing, for me, was this section of the linked article:
So...in the instance of a single shoe bomber, stopped by his own stupidity and the efforts of other airline passengers, TSA (a section of DHS) responds by calling it a systemic risk to air travel, and we must all take off our shoes. In the instance of a plot to use liquid explosives, which probably wouldn't have worked and was stopped in the planning stages, TSA responds by calling it a systemic risk and we must all limit ourselves to 3oz bottles of liquids that fit in a quart size bag. In the instance of a single underwear bomber, stopped by his own stupidity, TSA responds by calling it a systemic risk to air travel, and we must all be subject to X-ray/millimeter wave scanners and/or the big Grope.
In the instance of SCADA hacking, which could conceivably harm our infrastructure on a significant and systemic level from afar, with little/no risk of the perpetrators being caught, DHS responds by saying, "No big deal."
There's something very...wrong here.
Re: (Score:2)
Re: (Score:2)
It has in fact been successfully used in an airplane attack. And someone actually died as a result.
Mind linking some proof of that?
I've done some googling for that and the closest I can come is 4 failed bombings on buses in the UK where one person died of an asthma attack.
Re: (Score:2)
I don't know what attacks the other poster was referring to, but the UK courts established that the liquid bomb plot would probably have worked, based on evidence from explosives experts, including testimony and video of experimental explosions.
Here's a pretty convincing video. [bbc.co.uk] Note the bomb is liquid held in one 500ml soft drinks container, which could be carried through most airport security checks. To make the point that 100ml was just as unsafe, the liquid for this particular bomb was actually combine
Re: (Score:2)
Apparently that notion was wrong.
Nonetheless, I stand by the rest of my statement. DHS/TSA responds to awkward a
Re: (Score:2)
Per that Wikipedia article they used nitroglycerin which is not what the binary liquid explosives would produce.
Re: (Score:2)
To elaborate, TSA is afraid that people could bring separated liquid components of a binary explosive, mix them together in flight, and end up with an explosive. Mixing TATP on an airplane would be very challenging, and likely to arouse suspicion before it could actually explode:
http://www.theregister.co.uk/2006/08/17/flying_toilet_terror_labs/ [theregister.co.uk]
Re: (Score:2)
Child knows (Score:5, Funny)
A child who knows how the HMI that comes with Simatic works could have accomplished this,' he wrote in an e-mail.
And a child knows too that you shouldn't break into other people's property...
Huh (Score:2)
I wonder if this is why my water pressure has been crap the last couple of days.
not uncommon (Score:3)
Coral cached link (Score:2)
http://threatpost.com.nyud.net/en_us/blogs/hacker-says-texas-town-used-three-digit-password-secure-internet-facing-scada-system-112011 [nyud.net]
Pretty sure it was better than that... (Score:3)
H2O
Re: (Score:2)
Re: (Score:2)
...4...5.
That's the kind of password an idiot would have on his town's water control system!
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Interesting)
Disabling access after X tries might be enough where the token to uniquely identify access is relatively well-defined, like say your ATM card, and disabling access for that user doesn't de-facto terminate the system (i.e. other ATM users can still use the machine with their credentials after it eats your card).
For admin-access to such systems over the internet it's dangerous to disable the admin account after X tries, because
Re: (Score:2)
Re: (Score:2)