Attackers Drain CPU Power From Water Utility Plant In Cryptojacking Attack (eweek.com) 76
darthcamaro writes: Apparently YouTube isn't the only site that is draining CPU power with unauthorized cryptocurrency miners. A water utility provider in Europe is literally being drained of its CPU power via an cryptojacking attack that was undetected for three weeks. eWeek reports: "At this point, Radiflow's (the security firm that discovered the cryptocurrency mining malware) investigation indicates that the cryptocurrency mining malware was likely downloaded from a malicious advertising site. As such, the theory that Radiflow CTO Yehonatan Kfir has is that an operator at the water utility was able to open a web browser and clicked on an advertising link that led the mining code being installed on the system. The actual system that first got infected is what is known as a Human Machine Interface (HMI) to the SCADA network and it was running the Microsoft Windows XP operating system. Radiflow's CEO, Ilan Barda, noted that many SCADA environments still have Windows XP systems deployed as operators tend to be very slow to update their operating systems." Radiflow doesn't know how much Monero (XMR) cryptocurrency was mined by the malware, but a recent report from Cisco's Talos research group revealed that some of the top un-authorized cryptocurrency campaigns generate over a million dollars per year. The average system would generate nearly $200,000 per year.
If only... (Score:4, Funny)
If only there was some sort of readily available monitoring software to catch this sort of crap sooner than after 3 weeks.
Need for separate browsing and operations (Score:5, Insightful)
Come on. Don't run your operational systems on the internet, even if they need to be internet connected. Provide your employees with a separate system connected outside the LAN so that such issues are isolated. Another solution in non-sensitive areas is simply giving them Wi-Fi and access to their phones. All of these solutions present fewer problems than having employees on the operational system infecting the operational network.
Re: (Score:2)
Sorry you can't read. I said "even if they need to be internet connected" so that humans above fundamental reading levels could understand that the operational systems could be on the internet, but that users would not click on ads while using them, that they would have isolated systems for browsing.
Re: (Score:3)
This should be basic training everywhere. I can certainly understand someone sneaking around the rules and browsing the net using their normal work computer, but it's a severe lapse of responsibility to use a critical production computer to do this browsing.
Re: (Score:2)
If a system got infected with malware that did mining, which is a relatively minor problem, it means they are susceptible to serious damaging malware. Anti malware or tracking that detects intrusions after the fact don't help much if the damage is already done.
It does feels odd that these sorts of simple and basic preventative measure (disconnecting from internet, restricted access to web sites) aren't being taken. Organizations using SCADA systems should presumably know all about security issues and know
Re: (Score:2)
All of these solutions present fewer problems than having employees on the operational system infecting the operational network.
All of these solutions costs money that employers don't want to pay.
Shortsightedness is the gift bestowed upon middle management.
Dumb Firewall (Score:3)
Seems simple to me. SCADA systems shouldn't be controllable over the internet, or by anything connected to the internet. For remote control used leased lines. Hardly anyone uses ISDN or leased 56k lines anymore, so there's an easy solution.
For monitoring, you can have an internet connected data logger wired into the SCADA system with a serial port. Even if someone manages to hack into the data logger, you can't take over the SCADA system if it's not designed to accept commands over serial.
I worked for a bro
Re: (Score:2)
Simpler, and probably as effective given modern attack vectors, don't let Javascript run in your browsers. If you must accept data over the web, use http commands, like post.
hard to lockdown XP IE web apps (Score:2)
hard to lockdown XP IE web apps. Hell they may need admin rights to run the day to day software.
Re: (Score:2)
As long as the cost of replacing all that software with something new (and probably a lot of hardware too in cases where the existing hardware can't support the new software) is higher than the estimated cost (to the business, not to society at large) that would arise should the worst happen, they wont replace it.
Heck, it may well be that there is no new software that can be used and they would need to not just replace the PCs but the gear they talk to (I doubt the companies that make that kind of gear woul
Re: (Score:2)
One of my brothers manages the local water facility, he bitched and complained about a system with win xp which was already eol until they finally replaced it with of course windows 7 a little over a year ago. They now have a little less than two years before win 7 extended support ends.
Re: (Score:2)
Re: (Score:2)
The issue with Windows XP, or 7, or 10, is to disconnect these critical infrastructure maachines from the internet. If they are on the internet, then train users to not use a web browser on this critical machines. Upgrading the OS does not magically fix a poor security set up.
Re: (Score:3)
The modus operandi of privately owned utility companies: Socialize losses, privatize profit.
Re:WINDOWS XP on the INTERNET...???? (Score:5, Funny)
Not XP (Score:4, Interesting)
As to why they aren't upgrading everything all the time, I work in water too, and like other such "invisible" industries, it is big and more complex than you may think. Since these sites must function, NO MATTER WHAT, screwing around with one that is working fine is discouraged since each new "project" requires much planning, thought, approval and budgeting.
In my younger days, in an instant, I brought down a medium-sized city's water supply just by plugging in a serial cable, the large pumps shutting down next to me. The controlling PLC's serial port powered pin #9 (not commonly done) as did the new radio transceiver that I just plugged in. "Did I do that?!!"
I was fortunate in that shutting pumps off ungracefully can cause severe "water hammer" on the main pipes underground - broken pipes sometimes result.
Re: (Score:2)
Re: (Score:2)
Some things need to be updated? No doubt. The problem is that this "new guys" does not stop to think first about what they can upgrade without causing problems later, they are too arrogant to first analyze why the process they intend to upgrade is do
Re: (Score:2)
I also agree with the above poster that much thought should be given before such systems are needless
Re: (Score:2)
Well for any system of importance, you should be doing *all of the above*...
You shouldn't be connecting it to the internet, irrespective of how up to date it is.
You shouldn't be running software which isn't receiving security fixes.
You shouldn't be using general purpose software for a single purpose device.
You shouldn't be running software which receives anything other than security fixes (ie you should only fix the bugs, not introduce any other changes).
Re: (Score:2)
XP is worse for one single key reason: That there ARE known security risks that will NEVER get patched. Can this be mitigated? Yes. But it also HAS to be mitigated.
I work in a "must work no matter what" environment as well. We also suffer from XP machines we don't dare to touch because ... reasons. We did manage to get them secured by shielding those parts of them that are endangered by machines we put between them and potential attackers.
It is possible. It's pretty ugly and of course not the best solution
Re: (Score:2)
Sorry you're an idiot if you run XP unpatched in an internet enabled device for a mission critical infrastructure.
Why people make excuses for running 17 year old software saying well uh 10 is not great either look! ... alot of advances in security from Microsoft has come in since 2001. Since 2004 when Bill Gates wrote the security memo MS now requires a security buddy to approve each product release.
The result is both 7/10 are vastly more secure by default and more importantly ARE REGULARLY UPDATED. The spe
Can't we just illegalize monero? (Score:2)
Can't we just illegalize monero?
Re: (Score:3)
Great idea!
While we're at it, maybe we can outlaw malware as well?
Re: (Score:2)
Well the major exchanges could blacklist the coin and refuse to accept it. That will pretty effectively kill it I would imagine, if people can't easily trade it for fiat.
Re: (Score:2)
Sure you can. And instantly somewhere in Generistan an exchange will open that takes a huge cut but accepts it.
Comment removed (Score:3)
Re: (Score:3)
For piracy and to prevent used SCADA sales. They must be on the internet all day to re-activate themselves.
They also on purpose refuse to support anything after XP on purpose to force repurchases of perfectly good working systems with 7 support. So CFOs buckle and keep XP on instead as a firm of giving them the finger.
THen the I.T. guy gets blamed when they get hacked because the CFO doesn't want to pay the extortion to throw out a good SCADA controller because the vendor wants more money and you can't be u
No, not it is not (Score:1, Troll)
It is not being literally drained of its CPU power. CPU power is not a liquid which can run out of a drain. Asshole.
Re: (Score:2)
CPU power is not a liquid which can run out of a drain.
But hopefully with some advances in microfluidics it can be! ;)
Re: (Score:2)
Several APIs involving Queues and pipelining have a "drain" function call which clears it.
Re: (Score:2)
It is not being literally drained of its CPU power. CPU power is not a liquid which can run out of a drain. Asshole.
metaphor (noun): a figure of speech in which a term or phrase is applied to something to which it is not literally applicable in order to suggest a resemblance, as in “A mighty fortress is our God.”.
Or maybe your problem is not drained, but the use of literally.
literally (adverb): in effect; in substance; very nearly; virtually, as in "I literally died when she walked out on stage in that costume."
Re: (Score:2)
It can actually be an appropriate metaphor, though it's not clear that it is being used in that way in this case.
One can say that a system can only provide so many computations, so if some application is consuming them to the detriment of other applications also trying to be computed, then it is appropriate to say the first application drained the system of it's power.
Or one can be talking about electrical power usage and figure that each computation consumes a certain amount of electrical power, so the app
Stop connecting SCADA stuff to Windows! (Score:2, Insightful)
Seriously, stop connecting SCADA systems to computers running Windows. It really doesn't matter what you connect it to as long as it's not running an operating system that is well known for being vulnerable to attack!
Re: (Score:2)
Windows is no more insecure than other systems. It just makes the news more as it is the preferred OS of morons. If the morons of the world were using Linux, the hackers would be targetting Linux and we would hear of new Linux hacks every day. Most hacks are due to something stupid a Windows user did which a Linux user would not.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Which is fine if the machines aren't yours and you don't have to pay for the power they use.
A single machine may generate a trivial amount, but there are many thousands of insecure machines out there. Add them all up and you've got a lucrative earner.
You don't even have to spend your own time collecting the machines, you can use automated scripts to scan for and infect machines.
Stupid is as stupid does (Score:2)