iTunes has "more robust" security than some of our critical infrastructure.

Security researchers have blown the whistle on serious vulnerabilities in an Internet-connected system used by the US military, hospitals, and private industry to control boilers, air-conditioners, security alarms, and other critical industrial equipment.

The defects in the Niagara Framework, which links more than 11 million devices in 52 countries, could allow malicious hackers to seize control of critical infrastructure, an article published by The Washington Post warned. The vulnerabilities were unearthed by Billy Rios and Terry McCorkle, two researchers who have spent the past 18 months exposing security holes in a variety of ICS, or industrial control systems.

"The ICS software community is light years behind modern software security," Rios wrote in a blog post recounting his odyssey in getting Niagara officials to publicly acknowledge the vulnerabilities after he and McCorkle reported them. "Sadly, we can honestly say that the security of iTunes is more robust than most ICS software."

The 2,000-word Washington Post article recounts the researchers' steps in discovering the vulnerability, which they said makes it trivial for them to retrieve system files that contain user names, hashed passwords, and other sensitive material. "All told, it took me two days to go from zero knowledge to remote password theft," the paper quotes Rios as saying. Niagara allows administrators to remotely control boiler, heating, lighting, fire detection, elevator, and surveillance systems for the Pentagon, the FBI, the US Attorney's Office, and the Internal Revenue Service, to name just a few. The vulnerabilities could allow hackers anywhere in the world to sabotage the equipment using an Internet-connected computer.

A Tridium official told the paper: "We're committed to making our framework more secure. And we know it's our responsibility to educate our community."

Earlier this month, about a year after Tridium officials learned of the weaknesses, they issued a confidential advisory that describes ways customers can mitigate them.

The report is only the latest cautionary tale about the dangers of connecting gasoline pumps, power generation plants, and other critical infrastructure to the Internet. The number of serious security bugs that remain unpatched in ICS software sold by companies including GE, Siemens, Schneider, and ABB has given rise to the term forever-day vulnerabilities. One of the most recently discovered weaknesses affected users of Internet-connected devices made by Canada-based RuggedCom. An undocumented backdoor that couldn't be disabled made it possible for hackers to gain unauthorized access to equipment in electrical power stations. Following the exposure of the weakness, the company pledged to remove it.

Rios said the most disappointing thing he encountered in his interactions with Tridium was its "eagerness to blame the customer." He continued: "It should never be the customer's responsibility to have to compensate for poor design. Many ICS vendors expect customers to ensure their product is implemented securely, yet provide zero (or extremely vague) guidance on how to do so. In many cases, secure deployment is simply impossible due to the extremely poor security design."

Promoted Comments

Exactly -- It's going to take a horrible event caused by someone leveraging a security hole in one of these systems before anything is done.

Or a really well written book/video/etc.

Until we have the Ralph Nader of the Internet(the Internader?) , folks won't be up in arms.

One of the things that's always struck me as 100% bogus about network security is that we rely 100% on automated systems for security. Even when we have a person in the loop, they are only monitoring, they are not actively granting permissions. Many secure facilities require you to talk to a physical guard before letting you in the building, even though they have numerous locking devices and security cameras all over the place. Meanwhile, they let anyone with a password in over the fiber/copper and don't require any human verification of who you are.

Any system that can be automatically accessed can be hacked. That's all there is to it. If your security needs are absolute, then you absolutely should not be connected to the internet.

Why on earth is any of this stuff connected to the Internet anyway? Even if it had the best security, just the mere fact it's online in any way leaves it open to the possibility of being hacked remotely. At least make it hard for them and force them to be on sites.

In a word: Smart Grid. The ability to remotely reroute power down to the level of substations greatly minimizes downtime. Also, meters giving real time feedback allow the utilities to know exactly where outages are and where the links are broken. Also, rerouting power reduces outages by half. We have it here in Chattanooga TN (was part of our fiber layout)

There's no reason for these systems to be directly connected to "the internet".

They've very likely connected through a VPN to a central location. The systems also connected to the VPN are the security problem, not necessarily the VPN itself.

Airgapping the devices won't make it secure if security was not front and center during development. Witness the Iranian centrifuges: they are airgapped, but Stuxnet can still reach them through infected thumb drives. And, IIRC, the US Air Force also had similar incident.

When a 17 year old kid can break Chrome's sandbox feature (which was done at the last pown2own competition) that left Google's engineers gaping and sputtering in surprised amazement - these being some of the best and brightest software writers, with a specific focus on security - how long will it be before some enterprising hackers start messing with our infrastructure for fun and profit?

Why on earth is any of this stuff connected to the Internet anyway? Even if it had the best security, just the mere fact it's online in any way leaves it open to the possibility of being hacked remotely. At least make it hard for them and force them to be on sites.

There are companies which specialize in protecting this sort of stuff. The aptly-named Industrial Defender, for one. ( http://industrialdefender.com/ ). At the time I didn't even know that SCADA existed.

Why on earth is any of this stuff connected to the Internet anyway? Even if it had the best security, just the mere fact it's online in any way leaves it open to the possibility of being hacked remotely. At least make it hard for them and force them to be on sites.

Alot of it was designed with closed systems in mind and never intended to have a connection to the internet. It's quite silly to ask why power plant designs from 40 years ago are not accounting for the internet.....

This ongoing security chaos reminds me of the safety arguments of the automobile industry back in the mid-1900s. No one wanted to talk about seat belts or safety features because it pointed out that cars were inherently unsafe. (And they are, given that they are a rolling violation of entropy.) Now, a half-century later, safety features are prominently displayed in the advertising material, sometimes on the first page.

The same is now happening in the tech industry. We're all living on borrowed time, and few want to talk about security when there are so many other shiny things to chase. We're still using a crude and universally-hated Name/Password process that is the equivalent to the cumbersome early shoulder-belts that car owners routinely ignored. I'm waiting for a security breach that directly affects a high government official before this becomes a real priority.

A Tridium official told the paper: "We're committed to making our framework more secure. And we know it's our responsibility to educate our community."

Are you fucking kidding me? So it's the users who are the problem -- not your shoddy hardware/software? When companies blame their users for their badly thought out or security hole laden products it's a good sign to steer well clear of them.

This ongoing security chaos reminds me of the safety arguments of the automobile industry back in the mid-1900s. No one wanted to talk about seat belts or safety features because it pointed out that cars were inherently unsafe. (And they are, given that they are a rolling violation of entropy.) Now, a half-century later, safety features are prominently displayed in the advertising material, sometimes on the first page.

The same is now happening in the tech industry. We're all living on borrowed time, and few want to talk about security when there are so many other shiny things to chase. We're still using a crude and universally-hated Name/Password process that is the equivalent to the cumbersome early shoulder-belts that car owners routinely ignored. I'm waiting for a security breach that directly affects a high government official before this becomes a real priority.

Exactly -- It's going to take a horrible event caused by someone leveraging a security hole in one of these systems before anything is done.

When I saw the caption picture of the AC unit, I was dearly hoping you were going to discuss how ventilation shafts are a security weakness easily exploitable by individuals such as JC Denton and Adam Jensen. I was greatly disappointed in this article.

On a more serious note, this doesn't surprise me in the least. There is an almost total disconnect between engineering (I can speak to power engineering) and IT. Engineers, while smart at what they do, simply don't understand the nuances of the technology they are specing out. I overheard a conversation the other day about surveillance equipment they were upgrading at a plant. At one point they were talking about storing video on flash cards because they were concerned about taking up as little a footprint as possible with the recorder. That was pure crazy talk in my opinion for several reasons I'll not get into. They also didn't understand that there are different classes of hard drives to consider. They were scoping out Tigerdirect style stuff and didn't know there are enterprise level equipment out there, much less that manufactures are coming out with hard drives specifically speced for the stresses that continual surveillance places on these units. I was wowed.

I was told once that the best engineers all had grey hair. This was because they've been in the business of designing for decades. To a degree that's true but it also means that most, and I don't mean to be offensive, have no clue as the the IT back end and all it's implications.

Come to think of it, all engineering firms involved in critical infrastructure should have an IT sanity check team on standby.

Why on earth is any of this stuff connected to the Internet anyway? Even if it had the best security, just the mere fact it's online in any way leaves it open to the possibility of being hacked remotely. At least make it hard for them and force them to be on sites.

They really shouldn't be connected to the internet at all. At least not until they are designed for that purpose from the ground up. I use to work for a government facility only a few years ago and they were just starting to put cyber security measures in place on all the control systems. They weren't internet connected machines but the process was still excruciating. Even standard Microsoft security patches and updates would cause these systems to fail. Tweaks to the OS were another matter entirely.

I'm going to guess that many in private or public sector still leave their control systems unpatched and even wide open to avoid the hassle (especially with legacy systems).

Why on earth is any of this stuff connected to the Internet anyway? Even if it had the best security, just the mere fact it's online in any way leaves it open to the possibility of being hacked remotely. At least make it hard for them and force them to be on sites.

In a word: Smart Grid. The ability to remotely reroute power down to the level of substations greatly minimizes downtime. Also, meters giving real time feedback allow the utilities to know exactly where outages are and where the links are broken. Also, rerouting power reduces outages by half. We have it here in Chattanooga TN (was part of our fiber layout)

Why on earth is any of this stuff connected to the Internet anyway? Even if it had the best security, just the mere fact it's online in any way leaves it open to the possibility of being hacked remotely. At least make it hard for them and force them to be on sites.

In a word: Smart Grid. The ability to remotely reroute power down to the level of substations greatly minimizes downtime. Also, meters giving real time feedback allow the utilities to know exactly where outages are and where the links are broken. Also, rerouting power reduces outages by half. We have it here in Chattanooga TN (was part of our fiber layout)

Why on earth is any of this stuff connected to the Internet anyway? Even if it had the best security, just the mere fact it's online in any way leaves it open to the possibility of being hacked remotely. At least make it hard for them and force them to be on sites.

In a word: Smart Grid. The ability to remotely reroute power down to the level of substations greatly minimizes downtime. Also, meters giving real time feedback allow the utilities to know exactly where outages are and where the links are broken. Also, rerouting power reduces outages by half. We have it here in Chattanooga TN (was part of our fiber layout)

There's no reason for these systems to be directly connected to "the internet".

They've very likely connected through a VPN to a central location. The systems also connected to the VPN are the security problem, not necessarily the VPN itself.

Oh, I agree wholeheartedly. I failed to make that distinction it seems. I guess I was trying to say, and I alluded to it in another post, is that people who design these things sometimes fail to take into account the ramifications of their actions because they simply have no clue nor prior understanding of how some aspects of technology work. I'm fairly certain you're correct on the VPN issue.

>We're still using a crude and universally-hated Name/Password process

You think my end users are going to love key fobs and other secondary authentication when they barely tolerate passwords? When management doesn't give two shits about this stuff and will side with the end users?

Sorry, this problem can't just be fixed with technology. If this stuff does change it will be via legislation that forces upper management to stop treating IT like a horrid cost center and ignore our suggestions and best practices for sake of saving a buck.

>If this stuff does change it will be via legislation that forces upper management to stop treating IT like a horrid cost center and ignore our suggestions and best practices for sake of saving a buck<

Regulations tend to set up motions and processes which are followed blindly to satisfy the regulatory requirements. In the long run this runs contrary to evolutionary thinking and would be a a mud-bog in which the same execs stupidly ignoring security now would stick their SUVs and never leave.

If we want reasonable change in average thinking, it's going to be up to the better equipped IT people working today to get in the face of the deaf and start signing... and stay there. That goes with or without regulation. Not everyone is up to that challenge.

Exactly -- It's going to take a horrible event caused by someone leveraging a security hole in one of these systems before anything is done.

Or a really well written book/video/etc.

Until we have the Ralph Nader of the Internet(the Internader?) , folks won't be up in arms.

One of the things that's always struck me as 100% bogus about network security is that we rely 100% on automated systems for security. Even when we have a person in the loop, they are only monitoring, they are not actively granting permissions. Many secure facilities require you to talk to a physical guard before letting you in the building, even though they have numerous locking devices and security cameras all over the place. Meanwhile, they let anyone with a password in over the fiber/copper and don't require any human verification of who you are.

Any system that can be automatically accessed can be hacked. That's all there is to it. If your security needs are absolute, then you absolutely should not be connected to the internet.

Why 'virtual' though? It's not as if the power utilities don't know how to string their own cables.

I would think, in this day and age, the cost of interconnecting all the stations/sub-stations with private fiber (and, by the way, pulling some extra strands to lease out to those poor bandwidth-strapped ISPs) would be justified with intelligent, near-instantaneous grid management. I know they're managing the grid now through a mix of network technologies, but again, there's no reason at all for any of this to even touch the Internet. That's simply asking for trouble.

>We're still using a crude and universally-hated Name/Password processYou think my end users are going to love key fobs and other secondary authentication when they barely tolerate passwords?

To clarify, we should move past text-based authentication (which is limiting and cumbersome) and put everything in place for better gesture/graphic-based authentication. While this alone does not guarantee security, it sure as hell bypasses all the clear-text password bullshit we're seeing over and over again.

Why on earth is any of this stuff connected to the Internet anyway? Even if it had the best security, just the mere fact it's online in any way leaves it open to the possibility of being hacked remotely. At least make it hard for them and force them to be on sites.

In a word: Smart Grid. The ability to remotely reroute power down to the level of substations greatly minimizes downtime. Also, meters giving real time feedback allow the utilities to know exactly where outages are and where the links are broken. Also, rerouting power reduces outages by half. We have it here in Chattanooga TN (was part of our fiber layout)

>Any system that can be automatically accessed can be hacked. That's all there is to it. If your security needs are absolute, then you absolutely should not be connected to the internet. <

I couldn't agree more. It's a difficult proposition when businesses rely more and more on connecting and conducting commerce over the Internet. It's a matter of being aware of and planning for the risk... much like with finances. Every business operating with any Internet presence needs a plan for those resources being "hacked to dirt". Well, that and a living securtity policy and practice, and hopefully great engineers and a responsible public persona.

It's prohibitively expensive to build isolated circuits for all this stuff.

It's also prohibitively expensive to clean up after a major power outage that cripples the country and, worst case, destroys expensive equipment. Ounce of prevention and all that (even if it winds up costing a pound).

Hell, the cost of cleaning up after Enron and the California blackouts might have paid for rewiring the entire power infrastructure with money left over for a few hookers and blow. Isn't that what they wanted anyway?

The defects in the Niagara Framework, which links more than 11 million devices in 52 countries, could allow malicious hackers to seize control of critical infrastructure, an article published by The Washington Post warned.

Why on earth is any of this stuff connected to the Internet anyway? Even if it had the best security, just the mere fact it's online in any way leaves it open to the possibility of being hacked remotely. At least make it hard for them and force them to be on sites.

In a word: Smart Grid. The ability to remotely reroute power down to the level of substations greatly minimizes downtime. Also, meters giving real time feedback allow the utilities to know exactly where outages are and where the links are broken. Also, rerouting power reduces outages by half. We have it here in Chattanooga TN (was part of our fiber layout)

There's no reason for these systems to be directly connected to "the internet".

They've very likely connected through a VPN to a central location. The systems also connected to the VPN are the security problem, not necessarily the VPN itself.

Airgapping the devices won't make it secure if security was not front and center during development. Witness the Iranian centrifuges: they are airgapped, but Stuxnet can still reach them through infected thumb drives. And, IIRC, the US Air Force also had similar incident.

When a 17 year old kid can break Chrome's sandbox feature (which was done at the last pown2own competition) that left Google's engineers gaping and sputtering in surprised amazement - these being some of the best and brightest software writers, with a specific focus on security - how long will it be before some enterprising hackers start messing with our infrastructure for fun and profit?

"...the most disappointing thing he encountered in his interactions with Tridium was its "eagerness to blame the customer." "

And why not! It's the Spirit Of The Age in biznizz:Abuse Thy Customer!

This is how business FAILs. This is why we continue to be stuck in our ongoing worldwide economic depression, the second worst in a century.

Until we rid the world of what I call 'Marketing-Morons', those people who insist upon selling products with total disregard for respecting the customer, our system of world business it totally fracked.

In 1998 the country of China was provided 'Most Favored Nation' status by the Clinton Administration.

At that point, the government of China became involved with Chinese computer hackers and assisted them in forming what became the 'Red Hacker Alliance'. (Please Search for this term for references).

Through 2007 the China government assisted Red Hacker Alliance succeeded in 'PWNing' (OWNing) or botting every single US government Windows-based computer exposed to the Internet. All of them. The infection bots were able to send all data on those computers directly to China. Despite this having gone on for over eight years, it was not until 2007 that the US government publicly acknowledged the problem.

Last month the 'Flame' malware and its bot network were discovered, exposed and shut down. It has been estimated that Flame had been running on the Internet for at least five (5) years before its discovery. This malware was found to be the most ambitious, best designed and capable malware ever created, to our knowledge (!). Experts have stated that Flame could only be the work of a consortium of malware developers or a major government. Flame took advantage of what was, until its discovery, an extremely old zero-day exploit in Windows. Flame was capable of performing literally any computer task assigned to it by the bot wranglers, whoever they were. It was the perfect multi-functional malware, the ultimate spyware. It could infect and PWN any Windows-based computer by a mere drive-by Internet infection. That means no Windows machine connected to the Internet was immune unless the bot wranglers designed them so. The only data we have regarding its activity and purpose was its proliferation across the Middle East.

That's how CRAP Internet computer security has been, across the world, for the last 14 years.

Connecting critical infrastructure to the Internet opens up a wide attack vector from the 5 billion Internet-connected devices and the 2 billion people that use them, but regardless if the network is public facing (Internet) or physically closed many of the same security issues will persist. The Pentagon and US Military alone have shown how often non-Internet connected devices get compromised.

Besides, the whole grid will inevitably be brought down by a GE employee uploading the latest Coldplay album from their thumbdrive along with a payload courtesy of the Iranian government.