{"id":5037,"date":"2018-06-20T23:37:21","date_gmt":"2018-06-20T15:37:21","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=5037"},"modified":"2018-06-24T15:14:18","modified_gmt":"2018-06-24T07:14:18","slug":"scada-hacking-industrial-systems-woefully-insecure","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2018\/06\/scada-hacking-industrial-systems-woefully-insecure\/","title":{"rendered":"SCADA Hacking &#8211; Industrial Systems Woefully Insecure"},"content":{"rendered":"<p>It seems like SCADA hacking is still a topic in hacker conferences, and it should be with SCADA systems still driving power stations, manufacturing plants, refineries and all kinds of other powerful and dangerous things.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2018\/06\/SCADA-Hacking-Industrial-Systems-Woefully-Insecure-640x360.jpg\" alt=\"SCADA Hacking - Industrial Systems Woefully Insecure\" width=\"640\" height=\"360\" class=\"aligncenter size-medium wp-image-5038\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2018\/06\/SCADA-Hacking-Industrial-Systems-Woefully-Insecure-640x360.jpg 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2018\/06\/SCADA-Hacking-Industrial-Systems-Woefully-Insecure-1024x576.jpg 1024w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2018\/06\/SCADA-Hacking-Industrial-Systems-Woefully-Insecure-1536x864.jpg 1536w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2018\/06\/SCADA-Hacking-Industrial-Systems-Woefully-Insecure.jpg 2048w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<p>The latest talk given on the subject shows with just 4 lines of code and a small hardware drop device a SCADA based facility can be effectively DoSed by sending repeated shutdown commands to suscpetible systems.<\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<blockquote><p>Industrial control systems could be exposed not just to remote hackers, but to local attacks and physical manipulation as well.<\/p>\n<p>A presentation at last week&#8217;s BSides conference by researchers from INSINIA explained how a device planted on a factory floor can identify and list networks, and trigger controllers to stop processes or production lines.<\/p>\n<p>The talk \u2013 Hacking SCADA: How We Attacked a Company and Lost them \u00a31.6M with Only 4 Lines of Code \u2013 reviewed 25 years of industrial control kit, going back to the days of proprietary equipment and X21 connections before discussing proof-of-concept attacks.<\/p>\n<p>Mike Godfrey, chief exec at INSINIA, told El Reg that industrial control kit has long been developed with safety, longevity and reliability in mind. Historically everything was &#8220;air-gapped&#8221; but this has changed as the equipment has been adapted to incorporate internet functionality. This facilitates remote monitoring without having to physically go around and take readings and check on devices, which are often as not in hazardous environments.<\/p><\/blockquote>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>It was ok before everything started getting wired up to networks, but with SCADA systems pre-dating the kind of security controls we need to stay safe, it&#8217;s hard to retrofit them.<\/p>\n<p>Especially with the control software being on outdated versions of Windows dating back to Windows 98, which is so easily popped it&#8217;s laughable (and in this case, scary).<\/p>\n<blockquote><p>Industrial control systems run water supply, power grid and gas distribution systems as well as factories, building management systems and more. INSINIA has developed test rigs to assess the effectiveness of real-world systems that the security consultancy is asked to check. Testing attacks such as spoofing on real-world systems is likely to bring things down, Godfrey added.<\/p>\n<p>Denial-of-service in industrial control environments is easy and fuzzing (trying a range of inputs to see which causes an undesigned effect) also offers a straightforward way to uncover hacks.<\/p>\n<p>INSINIA has developed a device that automatically scans networks and shuts down components. The &#8220;weaponised&#8221; Arduino micro-controller looks like a regular programmable logic controller (PLC) to other devices on the network. If it is physically planted on a targeted environment, it can quickly enumerate networks before sending stop commands. It can &#8220;kill industrial processes with only four lines of code&#8221;, according to Godfrey.<\/p>\n<p>He added that it wouldn&#8217;t be possible to apply a simple reset in the event of such an attack, so a targeted environment could be taken down again and again.<\/p>\n<p>BSides presentations are often accompanied by the release of proof-of-concept code but the software here exploits systemic vulnerabilities that are unlikely to be resolved any time soon, so INSINIA is not releasing the tech even to its ethical hacker peers.<\/p>\n<p>Godfrey said that for industrial control plants, keeping the processes running is the prime concern. He claimed many plants &#8220;self-insure&#8221; to cover for the losses and disruption caused by security incidents, which he said already happen on an under-publicised scale.<\/p><\/blockquote>\n<p>In this case not releasing the code is a good idea as these systems are not likely to get updated ever, the more likely move forward is to decomission them and replace them with more modern, native network connected systems or even cloud based controllers &#8211; which is the direction Industrial IoT is moving in.<\/p>\n<p>It&#8217;s an area which is lagging far behind other industries and is ripe for nation state attacks, if you can take another countries power grid offline, that&#8217;s a pretty significant win.<\/p>\n<p>Source: <a href=\"https:\/\/www.theregister.co.uk\/2018\/06\/18\/physically_hacking_scada_infosec\/\">The Register<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>It seems like SCADA hacking is still a topic in hacker conferences, and it should be with SCADA systems still driving power stations, manufacturing plants, refineries and all kinds of other powerful and dangerous things. The latest talk given on the subject shows with just 4 lines of code and a small hardware drop device [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"It seems like SCADA hacking is still a topic in hacker conferences, and it should be with SCADA systems still driving power stations, manufacturing plants etc.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[10],"tags":[10682],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/5037"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=5037"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/5037\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=5037"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=5037"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=5037"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}