Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Bitcoin Privacy Security The Almighty Buck

Attackers Drain CPU Power From Water Utility Plant In Cryptojacking Attack (eweek.com) 76

Posted by BeauHD from the first-of-its-kind dept.
darthcamaro writes: Apparently YouTube isn't the only site that is draining CPU power with unauthorized cryptocurrency miners. A water utility provider in Europe is literally being drained of its CPU power via an cryptojacking attack that was undetected for three weeks. eWeek reports: "At this point, Radiflow's (the security firm that discovered the cryptocurrency mining malware) investigation indicates that the cryptocurrency mining malware was likely downloaded from a malicious advertising site. As such, the theory that Radiflow CTO Yehonatan Kfir has is that an operator at the water utility was able to open a web browser and clicked on an advertising link that led the mining code being installed on the system. The actual system that first got infected is what is known as a Human Machine Interface (HMI) to the SCADA network and it was running the Microsoft Windows XP operating system. Radiflow's CEO, Ilan Barda, noted that many SCADA environments still have Windows XP systems deployed as operators tend to be very slow to update their operating systems." Radiflow doesn't know how much Monero (XMR) cryptocurrency was mined by the malware, but a recent report from Cisco's Talos research group revealed that some of the top un-authorized cryptocurrency campaigns generate over a million dollars per year. The average system would generate nearly $200,000 per year.
This discussion has been archived. No new comments can be posted.

Attackers Drain CPU Power From Water Utility Plant In Cryptojacking Attack More

Attackers Drain CPU Power From Water Utility Plant In Cryptojacking Attack

Comments Filter:

  • If only... (Score:4, Funny)

    by fisted ( 2295862 ) on Thursday February 08, 2018 @08:01AM (#56088609)

    If only there was some sort of readily available monitoring software to catch this sort of crap sooner than after 3 weeks.

  • Need for separate browsing and operations (Score:5, Insightful)

    by ArtemaOne ( 1300025 ) on Thursday February 08, 2018 @08:06AM (#56088623)

    Come on. Don't run your operational systems on the internet, even if they need to be internet connected. Provide your employees with a separate system connected outside the LAN so that such issues are isolated. Another solution in non-sensitive areas is simply giving them Wi-Fi and access to their phones. All of these solutions present fewer problems than having employees on the operational system infecting the operational network.

    • All of these solutions present fewer problems than having employees on the operational system infecting the operational network.

      All of these solutions costs money that employers don't want to pay.

      Shortsightedness is the gift bestowed upon middle management.

    • Seems simple to me. SCADA systems shouldn't be controllable over the internet, or by anything connected to the internet. For remote control used leased lines. Hardly anyone uses ISDN or leased 56k lines anymore, so there's an easy solution.

      For monitoring, you can have an internet connected data logger wired into the SCADA system with a serial port. Even if someone manages to hack into the data logger, you can't take over the SCADA system if it's not designed to accept commands over serial.

      I worked for a bro

    • Re: (Score:2)

      by HiThere ( 15173 )

      Simpler, and probably as effective given modern attack vectors, don't let Javascript run in your browsers. If you must accept data over the web, use http commands, like post.

  • Not XP (Score:4, Interesting)

    by kackle ( 910159 ) on Thursday February 08, 2018 @08:40AM (#56088725)
    According to the summary, web ads (why aren't those blocked?!) are suspect. Windows XP is mentioned, though, as it's to blame somehow. To me, XP (or any older OS) is the devil you know versus the devil you don't - you can plan for the devil you know. Don't assume XP is automatically worse because we haven't discovered everything about 10, etc. For the technically smug, look at the surprise of Meltdown and Spectre.

    As to why they aren't upgrading everything all the time, I work in water too, and like other such "invisible" industries, it is big and more complex than you may think. Since these sites must function, NO MATTER WHAT, screwing around with one that is working fine is discouraged since each new "project" requires much planning, thought, approval and budgeting.

    In my younger days, in an instant, I brought down a medium-sized city's water supply just by plugging in a serial cable, the large pumps shutting down next to me. The controlling PLC's serial port powered pin #9 (not commonly done) as did the new radio transceiver that I just plugged in. "Did I do that?!!"

    I was fortunate in that shutting pumps off ungracefully can cause severe "water hammer" on the main pipes underground - broken pipes sometimes result. ...From plugging in a serial cable. Desktop jockies don't understand such things.
    • This. As a fellow developer on the "this MUST work" industry, I also have trouble trying to explain to the newbies why they should not do certain things that they are accustomed to do when you are dealing with systems controlling millions of dollars worth of equipment.

    • XP is worse for one single key reason: That there ARE known security risks that will NEVER get patched. Can this be mitigated? Yes. But it also HAS to be mitigated.

      I work in a "must work no matter what" environment as well. We also suffer from XP machines we don't dare to touch because ... reasons. We did manage to get them secured by shielding those parts of them that are endangered by machines we put between them and potential attackers.

      It is possible. It's pretty ugly and of course not the best solution

    • Sorry you're an idiot if you run XP unpatched in an internet enabled device for a mission critical infrastructure.

      Why people make excuses for running 17 year old software saying well uh 10 is not great either look! ... alot of advances in security from Microsoft has come in since 2001. Since 2004 when Bill Gates wrote the security memo MS now requires a security buddy to approve each product release.

      The result is both 7/10 are vastly more secure by default and more importantly ARE REGULARLY UPDATED. The spe

  • Can't we just illegalize monero?

    • Great idea!

      While we're at it, maybe we can outlaw malware as well?

      • Well the major exchanges could blacklist the coin and refuse to accept it. That will pretty effectively kill it I would imagine, if people can't easily trade it for fiat.

        • Sure you can. And instantly somewhere in Generistan an exchange will open that takes a huge cut but accepts it.

  • Comment removed (Score:3)

    by account_deleted ( 4530225 ) on Thursday February 08, 2018 @09:02AM (#56088827)
    Comment removed based on user account deletion

    • For piracy and to prevent used SCADA sales. They must be on the internet all day to re-activate themselves.

      They also on purpose refuse to support anything after XP on purpose to force repurchases of perfectly good working systems with 7 support. So CFOs buckle and keep XP on instead as a firm of giving them the finger.

      THen the I.T. guy gets blamed when they get hacked because the CFO doesn't want to pay the extortion to throw out a good SCADA controller because the vendor wants more money and you can't be u

  • It is not being literally drained of its CPU power. CPU power is not a liquid which can run out of a drain. Asshole.

    • CPU power is not a liquid which can run out of a drain.

      But hopefully with some advances in microfluidics it can be! ;)

    • Re: (Score:2)

      by tsqr ( 808554 )

      It is not being literally drained of its CPU power. CPU power is not a liquid which can run out of a drain. Asshole.

      metaphor (noun): a figure of speech in which a term or phrase is applied to something to which it is not literally applicable in order to suggest a resemblance, as in “A mighty fortress is our God.”.

      Or maybe your problem is not drained, but the use of literally.
      literally (adverb): in effect; in substance; very nearly; virtually, as in "I literally died when she walked out on stage in that costume."

    • Re: (Score:2)

      by HiThere ( 15173 )

      It can actually be an appropriate metaphor, though it's not clear that it is being used in that way in this case.

      One can say that a system can only provide so many computations, so if some application is consuming them to the detriment of other applications also trying to be computed, then it is appropriate to say the first application drained the system of it's power.

      Or one can be talking about electrical power usage and figure that each computation consumes a certain amount of electrical power, so the app

  • Seriously, stop connecting SCADA systems to computers running Windows. It really doesn't matter what you connect it to as long as it's not running an operating system that is well known for being vulnerable to attack!

    • Re: (Score:2)

      by ghoul ( 157158 )

      Windows is no more insecure than other systems. It just makes the news more as it is the preferred OS of morons. If the morons of the world were using Linux, the hackers would be targetting Linux and we would hear of new Linux hacks every day. Most hacks are due to something stupid a Windows user did which a Linux user would not.

  • If you don't have an air gap between your critical infrastructure equipment and the internet, then you're an idiot. Why was it possible to open a browser on these machines in the first place?

Slashdot Top Deals

Some people manage by the book, even though they don't know who wrote the book or even what book.

Close