LMTV LIVE | SpyGOOSE from Thomason Technologies (with Dave Thomason)
LMTV LIVE | Rich Vogt and Bob Cook from Resource Communications

SCADA/ ICS – Are We Scared Yet? (by Tim -The Oldcommguy®)

Industrial Control Systems / SCADA – Are we scared yet?

What would happen if a hacker took over control of a nuclear power plant and used it for blackmail or destruction?

What devices control refineries and power plants, even our drinking water purification facilities?

SCada, ICS scaryWell these and many other life necessities are run and controlled by SCADA (Supervisory Control and Data Acquisition systems) or ICS (Industrial Control Systems). SCADA and like systems have been around monitoring and controlling our industrial, power and refinery world since the 1960’s.

I actually worked for a SCADA research and monitoring company in that era designing and testing production monitoring tools for the oil industry, from acquisition to refinement requirements but all were Industrial grade level

What is Industrial Grade Level – mainly it is the operating temperature from -40CF to +85C and Military level is -55C to +125C and other factors that would be needed for down hole operations (Drilling), mine operations and even space operations which can include high pressure, shock, mechanical stress, certain types of vibrations, non-vaporizing humidity to near 100%...many different factor for the many different arenas.

A reference site - http://www.3d-plus.com/quality-grades-reliability-2.php

SCADA is analog focused for monitoring, pressure, temperature, viscosity, power levels (current and voltage – DC or AC), liquid flow, wind/air speed, salinity…etc - https://en.wikipedia.org/wiki/SCADA

SCADA systems usually work as an independent system telling operators if the system they were monitoring was working within correct parameters. Later the systems reported back to computers that decided if everything was OK and if not made decisions to either change parameters or shut down systems that were in danger, like an oil or chemical refinery, a power grid station, food production and even automobile production facilities.

For the majority of these years SCADA and ICS systems were completely independent systems and each had a different human interface, different reporting programs/methods, different communications methods, different languages and alert/failure alarm systems and methods. Finally Ethernet and the internet have become part of these systems and of course, all the vulnerabilities of the cyber world now has hit these very important and essential control systems. From sensors to display these systems are relatively easy to hack and we have seen several attacks but just like internet application many are compromised but have not been found.

The SCADA attacks started, or were recognized as far back as the 1980’s, the first recognized was the Farewell Dossier.

There have been many suspect attacks but here are a few of the known, Slammer early 2000, SoBig early 2000, Sasser 2004, Conficter, Night Dragon and Stuxnet 2009, Havex RAT and Blacken or Black Energy 2014 and many more.

One of the most powerful attack packages is the GLEG Agora SCADA+ Exploit pack. GLEG is a Russian security firm and this infamous package consisted of 22 Exploits and 11 zero-day vulnerabilities along with many details on SCADA/ICS issues that allow access attacks like hardcoded passwords and many other known weak areas.

There are thousands and thousands of SCADA system worldwide and they control our water, sewage, natural gas, gasoline, electrical power, our food production, flood control, dams, pharmaceuticals, refineries for almost every chemical product, automobile production, weapons, bombs, airplane production and control, delivery systems, security control, fire and explosion control and the list is Long and VERY scary and yet it is the least protected and misunderstood technology!

The newest threat vehicle is the smart wearable toys and tools as they are very vulnerable and will be used as access and intelligence tools

The Critical Infrastructure is even covered by the Homeland Security https://www.dhs.gov/topic/critical-infrastructure-security and one can get updates on attacks through this site as well as terrorist activity on all areas of our Critical Infrastructure.

We should be alert and keep well informed to help protect our own safety.

Attacks are happening daily worldwide as well as here in the United States.

We recently have seen attacks on the Israel power system, SSH attacks, Apache commands, Locky Ransomware, Power producers, both coal and nuclear had 89 major attacks in 2015. Overall in 2015 the number of SCADA and control attacks doubled and 2016 is starting off with a bang!

A recent research project using Shodan, a high level web browsing tool, used by Internet researchers and hackers alike, called SHINE which stood for SHodan Intelligence Extraction, this project was to locate SCADA/ICS devices that were in some way connected to the Internet. This research project was run by some of the top internet researchers, Bob Radvanovsky and Jake Brodsky from Infracritical (http://www.infracritical.com/)

The researchers announced that they have not stopped finding SCADA links to the internet but so far have located over 1 million unique IP addresses that appear to belong to SCADA /ICS control systems devices and other related software technologies. The scary announcement was made on the Tofino Security Blog -  https://www.tofinosecurity.com/blog/project-shine-1000000-internet-connected-scada-and-ics-systems-and-counting

The amount of access and thus vulnerability shown above makes visibility a priority “MUST Have”!  This is a serious Wake Up call to the industry and the owners of these million+ SCADA/ICS access points are all a vulnerability/ High security risk and must be addressed! The access to this many SCADA points should be considered an international emergency!

Many SCADA systems have preset and not changeable passwords or in some cases no password!

We all need visibility from the SCADA control world to the traditional Ethernet arena and to the newer PC104+ command and control network control arena of today.

We need parallel monitoring systems (Ethernet) to the older SCADA systems and unprecedented security advances and monitoring MUST be accomplished before we have a major take over issue!

In 2016 and on we will see insurance costs rising and more spending to protect all the industries that will be passed on to us the consumer.

The needs to protect our control technology are just beginning to be seen and these control devices and networks are critical to the future of our society and to the world’s safety!

SCADA may have started as a simple technology but protecting it will be no simple task and the need for total visibility is NOW and will continue to be a Management and Security necessity!

We had best monitor and protect it or the results could be catastrophic!

Are you scared, YET!

The author is The Oldcommguy!

Two major players in this Technology -

Garland Technology has Ethernet Taps, Packet Brokers and PC-104 TAPs - full network Visibility.

Thomason Technology has the most advanced Network and  SCADA security and attack recognition solutions.

The author is The Oldcommguy!