Hacked Texan Water Infrastructure Had a 3 Character Password

[kevinherron]

This doesn't surprise me AT ALL. You guys wouldn't believe some of the stuff I've seen out there. Work in the industrial automation field is largely done by individuals/companies called System Integrators. Integrators are cowboys and most of the industry is an unregulated wild-west. There is a pervasive "git-er-done" attitude; nothing else matters, security included.

(I'm a developer at one of the smaller SCADA software companies.)

[code_duck]

Indeed, while our politicians bloviate about 'terrorism' and how safe they're keeping us, this is the reality. Notable that this occurred in Texas, where the legislature would be as likely consult Jesus about the incident as a security expert. I honestly have to wonder whether our society will be going down in flames soon due to the odd combination of reliance upon and willful, resentful ignorance of knowledge that is being promoted in public culture.

[elithrar]

Amen to that. I do some work on the network side of control systems—and default passwords (or no passwords) are rampant, and often recommended under manufacturer guidelines. The last part there is the more worrisome.

[beedogs]

It doesn't surprise me at all either. SCADA systems invariably seem to be ancient museum pieces pressed into service out of necessity and kept in service out of inertia.

The kind of shit I've seen in SCADA comms rooms blows my mind -- bare, homebrew breadboards screwed into 19" racks; SparcStations caked with dirt and grime; passwd files containing active accounts for people who are now dead.

The only thing I find surprising about any of this is that it doesn't happen every single day.

[nakkiel]

Well, just so you know, it's not limited to your industry. The "You guys wouldn't believe some of the stuff I've seen out there" is almost instulting given what I have seen. I guess it's just anybody out there who's been in contact the real world who can say that.

But yeah, the real world kind of stinks.

[briandon]

What's stopping the SCADA software companies from taking on the integration work themselves?

[droithomme]

There is no way to stop people from doing this sort of thing because people are infinitely creative in ways to be dumb. The solution is not to have critical infrastructure controlled over the public internet.

[chrisbolt]

That's just another way of saying "don't employ dumb people."

[DanBC]

Lack of clean water can cause large amounts of chaos very quickly[1]. Water infrastructure should be something that Governments want to protect.

Given that, and given weird laws about "providing help to terrorists"[2] I'm amazed that someone putting a 3 character password on something so important, and then letting it face the Internet, is not going to see jail time.

[1] See, for example, flooding in Gloucestershire, England, a few years ago. That was troublesome, but only got really bad when a local water treatment plant was flooded.

[2] At least, in the UK.

[throwaway64]

sounds like my bank, bank of Montreal, they only allow 4 number passwords for their e-banking shit (seriously)

[zheng]

But I'm sure they have some sort of lockout after 3 or so tries, right?

(Unfortunately, this reads just as valid sarcastically as seriously).

[smtf]

Ah. You may want to double check that:

http://www.bmo.com/home/about/banking/privacy-security/prote...

Maybe your the victim of a Phishing attack or something, for example maybe a fake site told you you had to use 4 digits.

Honestly I've heard of a lot worse then this:

http://www.bmo.com/home/about/banking/privacy-security/how-w...

[Kaizyn]

I would think you would either NOT use online banking or find another bank.

[onedognight]

The weakness of a four character password can be mitigated somewhat by locking your account or an IP after a few failed attempts.

[zephjc]

Was the password "H2O"?

[cellis]

123 or abc is my guess

[Steko]

I will put up 50 HN bucks that it was 999 set up by a Herman Cain fan.

[tripzilch]

Well, well... In between developing censoring and deep packet inspection infrastructure for Iran and Egypt (in a joint venture with Nokia) and getting their PLC control software rooted by Stuxnet, Siemens makes badly secured SCADA systems for water supplies.

[fredoliveira]

this reminds me of the movie hackers.

"Yeah but don't forget God. System operators love to use God. It's that whole male ego thing." ;-)

[lucisferre]

Given that I probably would have put "Hacked" in quotes then.

[ryan-allen]

Does anyone else think that it's only a matter of time before IT security is going to be a regulated industry?

[pilom]

In the US, there was a relatively recent regulation of IT security in the form of Department of Defense Directive 8570. This directive requires IT security folks who work on DoD contracts to have a certification from one of the major certification authorities (think CISSP). Personally I'm not a fan of required certification for a number of reasons, but at least the DoD is trying to improve the quality of contractors working in IT security.

[lucisferre]

It would only work if it was regulated by people who understood IT security.

[JordyB]

I have always wondered how weak the passwords were on things like this. It is a shame someone even put such a password on there.

[peterwwillis]

I'm going to say it: if people who work "in the real world" would release this stuff to an organization like the now-dead WikiLeaks or Anonymous, the bad press might put enough fear into a higher-level manager to actually audit their crappy systems for this stuff.

Also I think somebody ought to pass some tougher laws about leaving national infrastructure open to simple attacks. We can start with "3 years in prison for default passwords."

[peterbotond]

many many years ago, when modems were king, there was a breach similar to the 3 character password, UCB... well, the rest is history. I dont remember the details precisely, probably still can be found on some news or mailing list archives.

[mattdeboard]

This may well be the vaguest allusion to a historical event I've ever seen.

[zheng]

For those of us too young to pick up the reference, care to be slightly less opaque?