Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

most factories, power plants, chemical plants or oil fields don't have internet.

Some don't have internet. Most shouldn't have internet.

But given the number of SCADA exploits I've heard about recently... there's an awful lot of places which shouldn't have internet but do.



ouch now the theme goes to 5th world war (3rd world war = cold war 1945-1990, 4th world war = unilateral war 1990-2010, 5th world war = cyberwar and arab spring)

We had at least two housebreakings, where nothing was stolen! Instead someone tried to deploy a trojan by rebooting systems from USB the first time, but reboots had been noticed by Nagios, and failed totally 2nd time, because desktop systems had been migrated to use truecrypt and server systems had been locked behind a stable metal door.

I don't think that this was related to WW5 (stuxnet/flame), but normal industrial espionage. But industrial plants are extremely vulnerable to cyberwar, because they don't have internet, and are therefore badly maintained, and often never updated after installation.

My preferred remote maintenance is to use a cell phone USB stick, that is normally locked in a safe at the customer, and only plugged in on demand after a phone call. Our system will use this stick, if its the right one, to create an internet connection and OpenVPN.


Link for such SCADA exploits?


You can search the news for them, but if you're looking to verify the anecdote: I don't have time to do anything more than pile them on, but you should know that SCADA evaluations of factories and utilities have been a mainstay of IT security for the past 6-8 years; there are hundreds of consultants who have found ridiculous exposures to insanely sensitive sites.


Anecdote: "You can do what with an email to factory-control+wethinkthispasswordissecure@example.com? What possessed you to implement that? You didn't make e.g. a web service because the corporate policy kept restricting you from operating potentially lethal machinery from outside the firewall? That wasn't a strong enough hint?"


Sorry, no links. It was all personal discussions (aka. "war stories") with people working in the industry.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: