Support Forums Reveal SCADA Infections 66
chicksdaddy writes "We hear a lot about vulnerabilities in industrial control system (ICS) software. But what about real evidence of compromised SCADA and industrial control systems? According to security researcher Michael Toecker, a consultant at the firm Digital Bond, the evidence for infected systems with links to industrial automation and control systems is right under our eyes: buried in public support forums. Toecker audited support sites like bleepingcomputer.com, picking through data dumps from free malware scanning tools like HijackThis and DDS. He found scans of infected systems that were running specialized ICS software like Schweitzer Engineering Labs (SEL) AcSELerator Software and GE Power's EnerVista Software (used to configure GE electric power protection products). The infected end user systems could be the pathway to compromising critical infrastructure, including electrical infrastructure. 'With access to a protection relay through a laptop, a malicious program could alter settings in the configuration file, inject bad data designed to halt the relay, or even send commands directly to the relay when a connection was made,' Toecker wrote."
First-hand experience (Score:5, Informative)
I'm a sysadmin for a small municipal office with a SCADA system. I manage every computer except the one used for SCADA, which is the responsibility of the vendor. Their only concern is that the computer stays unmodified from their "standard" set up, but it still requires unrestricted Internet access. This means:
*Windows XP SP2
*Automatic Updates turned off
*No third-party software (ex: antivirus)
*No domain/group policy
*Symantec pcAnywhere 11 host (this is the version Symantec admited to being breached and to stop using)
As the sysadmin I can stick it on a VLAN to keep it away from the computers I'm responsible for, but other than that, my hands are tied.
Re:First-hand experience (Score:3, Informative)
As the sysadmin I can stick it on a VLAN to keep it away from the computers I'm responsible for, but other than that, my hands are tied.
Until your boss calls and asks why can't he view setup on his phone from the internet like was shown in the promotion video? Please unblock internet access. ... then an employee who is trying to get around the facebook firewalling software uses it to browse the internet. Oh, yeah fun times.
As someone who installs lots of protective relays (Score:3, Informative)
I can tell you that none of the protective relays I've installed, the engineers involved didn't care one bit for security and all the SEL relays, Square D SEPAM relays, GE Relays, they are all installed with the default password with full access to anyone that has a RS-232 or Modbus cable. None of these relays are set correctly and barely anyone knows what setups to use on them. If someone really wanted to create a disaster, these relays are wide open, and someone with a laptop can easily just make a quick script to upload malicious settings and code to these relays very easily and quickly. The ones that are networked via status updates are even worse. As for SCADA systems, the majority of them are running Windows XP with no updates on, no antivirus, no anything and have full unrestricted access to the internet with full access to the PLC's on machines. These vulnerabilities have been known for YEARS by many installers, so I really don't find this article that surprising.
Re:I'm confused.. (Score:4, Informative)
Almost all situations fall into the first category. The SEL relays have rear ports for permanent connections and a front port for service. Usually they are set up so programming can't be changed over the serial or Ethernet network, but the front port has no ability for lock-down. SEL even has a cute little "data transporter" that has a serial port on it, so you don't have to bring your laptop to the relay.
The attack alluded to should be able to bypass the sneakernet use of the data transporter. Conceivably, if the service tech's laptop is compromised all relays would allow for remote settings change despite the visible settings on the laptop.
But, unless you could crack the relay firmware downloading the settings to another device or viewing from the built-in screen (which is extremely tedious), you would easily identify the problem.
I'm torn on how serious to take this. It isn't like settings are changed often, so practical implications are limited.