Over the last ten years, we’ve lived through the rapid adoption of remote connectivity in industrial environments around the world.
[…]
Now that we understand the chaos of connectivity in modern industrial environments, we can talk about what’s getting hacked right now, and why. Why water? Why refrigerators?
A few unfortunate, incredibly predictable factors have led us here, and my colleagues and I have been screaming about them for years: [ …]
[…]
Fixing the vulnerability isn’t easy, even if the organisation is aware of it. Industrial systems have long lifecycles, sometimes 10 to 30 years. They’re engineered and tested by the OEM to work in a very specific technology stack and topology. Any alteration can, at best, disrupt the process and, at worst, lead to injury or death. Either outcome can be far more damaging than a casual hacker. Because of these lifecycles, and the inability to replace systems, I still deal with Windows 2000, CE, and XP every week. They can’t be removed from production or modified without express authorisation from the OEM and engineers, plus a significant outage and testing window.
Yes, the choice to cut labor and feed bloated corporate profits by replacing local tech support with offshored MSPs is definitely the root of it. I think everyone knows that and the outrage is because everyone whose job title doesn’t include the word “Chief” realizes its phenomenally stupid to take all the slack capacity out of our economy in order to goose stocks an extra 0.5%. I’m not convinced the author of this article quite realizes how much everyone with two eyes can see that the last three decades of “conventional business best practices” have been toxic and corrosive and how big of a generational project it will be to dig us out of worshipping “just in time” production and “ultra-lean” (read: understaffed) workplaces.
Thats not entirely true… there are some good arguments for just in time and lean production.
And mostly arent cost.
A lot has to do with understanding what is required and work towards that goal and only that goal.
There is absolutely no excuse for generated passwords like the day’s date. That is NOT A PASSWORD. And if that is considered a sufficient password, then they should not have even bothered with a password.
I think this is the most important point in all of this.
As usual, the security chain is only as strong as its weakest link, if you have ridiculous passwords you have no security even if everything else is state of the art (which I doubt btw)
Exactly. When one of the passwords reminds me to change the password on my luggage… heh
The mess is metaphorically a result of a kind of hasty, brainless merger of the mindsets of Internet and server companies with those of companies that construct field buses and factory floors. These two ways of connecting things are not very compatible. And the factory floor corps don’t even understand why security is necessary.
To sum it up, the problem is systemic. It is not just that Danish connected thermostat manufacturer.
To sum it up, the problem is systemic. It is not just that Danish connected thermostat manufacturer.
The problem is that security is always seen as a pure cost and since there is no punishment for wrongdoing there is no incentive to have it implemented right, or even impemented at all, at every level.
… And what about put all of this shit behind a secure front end before connecting to anything?
That’s too complicated and costs too much money. Software and security are afterthoughts in industrial sectors.
Yup, all this insecure crap needs to be in a DMZ and firewalled up the wazoo, but that’s, I was going to say a band-aid, but a pressure bandage is more appropriate, considering how hard it can bleed. Of course, you could just airgap things and actually pay someone to manage the software as needed (like savages), but you know, that’d hit the bottom line. You get what you pay for.
Can’t speak for the situation in other countries, but in the US as a business you can get a cheap lte modem and put it on a custom APN that’s completely airgapped (as in: inaccessible from the public internet) for less than $1/mo/sim with fairly minimal setup costs. So I agree, this is just silly that these are on public networks.
How is it airgapped if it has an LTE modem?
You’re in your own VRF in the cellular ISP’s network. You typically get one or more RFC-1918 private subnets to assign IPs to your devices from. You can set strict ACLs on those devices. They have no internet access and can only communicate with each other (if you allow it) and optionally your network via carrier peering. The carrier peering is typically BGP over IPSEC or MPLS (although good old fashioned carrier hotel cross connects are also an option)
I’m assuming you were asking a serious question and so I provided a serious answer. Hopefully you find it interesting.
Source: I design cellular private networks for a living.
Curious… vehicles that send back telemetry and accept remote commands. I always assumed they had their own private cell networks.
But while we’re on wireless CarPlay or Android Auto… does ALL phone traffic get routed through the car/vehicle manufacturer?
That is still not what air gapped means.
No network interfaces.
That’s one of the two definitions, see: https://en.wikipedia.org/wiki/Air_gap_(networking) And https://www.ibm.com/think/topics/air-gap
air-gapped networks are networks that have been isolated from all external networks, including cloud and wifi. Air-gapped networks are disconnected from the internet and provide a strong layer of protection from a broad range of cybersecurity threats.
In any case, pedantry aside the point stands that it’s possible to connect these in a way that’s isolated from the public internet.
These are pretty frequently used well in most utilities I’ve been around. What scares me is their faith in the cellular telcos to keep everything secure so they don’t lock down the devices connected to that modem. 🤦
Yeah absolutely. I’ve seen that as well and it’s very concerning. You need layers of security. Especially if the private APN doesn’t have P2P traffic blocked, as otherwise a single field-compromised device becomes an ingress point.
Nonetheless, miles better than devices on the public net. Especially when compared to devices with public static IPs that don’t even have the protection of the carrier’s cg-nat.
No wires, air-gapped!
I mean . . .
