Technology

why is any critical control equipment internet accessible.

I understand some machines might need internet to send reports and make document filings and shit. But it should not be the critical control equipment that makes the system function. And there should be a massive physical gap between the internet machines and the critical machines.

Jesus christ, even by the abysmally low bar I have for humanity, it still finds ways to dig itself a path under it.

The hacks target internet-facing programmable logic controllers (PLCs)

Why the fuck
is your PLC
facing the fucking internet!

Jesus Zombie Christ an a pogo stick. Has no one been paying attention for the last two decades? Seriously, we learned this sort of lesson in Two Thousand and fucking Three. Your critical assets do not get public IP addresses.

So are we just kind of admitting that there exists no way to expose any networked device to the internet securely? Because if it's not possible for PLCs I don't see why it would be possible for any device. If water utilities have to take these offline, then how does that advice not apply for every internet-capable device in every commercial and industrial facility worldwide?

I am repeating what I said elsewhere on a different comm:

I call FULL bullshit on this being Iran.

I personally worked on the cybersecurity incident that happened to St Paul municipal and water systems last year as the Incident Response Technical lead.

The threat actors were not Iranian then. They were Russian.

I personally rebuilt most of their networks, VMware hosts, storage, and servers. The majority of the VMware environments did not have config backups and were running 5 and 6 branches of VMware, only two had 7+.

Their network was insecure. They had IPSEC VPNs between the various location, but there was no further security in that respect. Their firewalls were not being kept up. AAAAND... I warned them that we thought they were still compromised.

In fact, the forensics team called them out as being clean on a group call one week into the incident, but while we were on the call with leadership, they got RE-infected.

I had my team compile a massive set of recommendations for them and I wrote the report. Water Systems specifically. They did not listen to us, apparently. The forensics team also did this.

They had FBI, national guard (fucking incompetent), and law enforcement (useless) in all meetings.

If they got into Water, they’ll get back into city and municipal again. I guarantee it.

This is not Iran. It's the fucking incompetence of city government and Russian threat actors.

A lot of this is often down to shitty IT practices by the vendor who has little IT knowledge let alone decent security insight.

I helped support a new PCL installation (technician control PCs and software upgrade) in this exact scenario many years ago. The vendor came in expecting to treat our system as their own. Direct remote access to several over-specced, physical servers from the outside world, available on our core network, shared account names (and passwords!) across all devices, every account a local admin and their own domain admin account so they can make changes as required... Needless to say our security guy almost broke a rib from laughing so hard!

What they got was very different. I ended up doing fairly basic troubleshooting to get the shitty software working without it needing admin rights to run - XP era software running on Win7 clients so it was meeting basic folder and reg key write permissions - everything else was locked down as tight as we could. They didn't even get admin on the servers.

A few years later I heard they'd reported that our site was their most reliable. Probably due to the fact that they (or the techs) couldn't fuck with anything without our permission. Apparently their original configuration is normal in the industry... Shudder

Yup, Sleepy-Don really do have the whole Iran situation under control.