SoylentNews is people
SoylentNews
from the ooops,-there-goes-another-one dept.
Submitted via IRC for SoyCow1984
Hackers who may have been working on behalf of a nation recently caused an operational outage at a critical-infrastructure site, researchers said Thursday. The attackers did so by using a novel piece of malware to target the system that prevents health- and life-threatening accidents.
The malware was most likely designed to cause physical damage inside the unnamed site, researchers from the Mandiant division of security firm FireEye said in a report. It worked by targeting a safety instrumented system, which the targeted facility and many other critical infrastructure sites use to prevent unsafe conditions from arising. The malware has been alternately named Triton and Trisis, because it targeted the Triconex product line made by Schneider Electric.
"Mandiant recently responded to an incident at a critical infrastructure organization where an attacker deployed malware designed to manipulate industrial safety systems," Mandiant researchers wrote. "The targeted systems provided emergency shutdown capability for industrial processes. We assess with moderate confidence that the attacker was developing the capability to cause physical damage and inadvertently shutdown operations."
The accidental outage was likely the result of the Triconex SIS, or "safety instrumented system." The SIS shut down operations when it experienced an error that occurred as the hackers were performing reconnaissance on the facility. Although the hackers were likely seeking the ability to cause physical damage inside the facility, the November shutdown was likely not deliberate.
(Score: 1, Insightful) by Crash on Friday December 15 2017, @04:36PM (2 children)
Maybe it's "game changing," but written by Dan Goodin? Given the number of times he has purposely left relevant information out of a "so-called report," just for scare-mongering and clicks, makes him about as trust-worthy of a source as Fox News on Trump.
(Score: 3, Informative) by khallow on Friday December 15 2017, @06:03PM
The author list [fireeye.com] is Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, and Christopher Glyer. Dan Goodin is not on that list. I know RTFA is a thing which we don't do here, but RTFA would indicate what Goodlin's source was.
(Score: 3, Informative) by frojack on Friday December 15 2017, @06:41PM
Its not game changing, or particularly new.
Its the same as the Siemens vulnerabilities [wikipedia.org] except done directly in the internet, without having to sneak it in via a usb stick or a windows machine.
It exposes yet another company that thought they could shortcut the security aspects of their products.
No, you are mistaken. I've always had this sig.
(Score: 1, Touché) by Anonymous Coward on Friday December 15 2017, @05:14PM
Take a drink!
(Score: 5, Insightful) by jmorris on Friday December 15 2017, @05:57PM (8 children)
The website for Triconex is content free but it is a safe bet we are talking about another Windows exploit, right? This is news why? If you run Windows on anything important you will lose, you deserve to lose and you should be fired for being a loser. If you use Windows on a system that can kill people you should be fired from a cannon into the Sun.
(Score: 3, Informative) by Kromagv0 on Friday December 15 2017, @06:50PM
Looks like it indeed was a windows issue given that the main executable is trilog.exe [fireeye.com]. To me this sounds a lot like companies not following current best practices. For ICS systems a close match would be things like NERC CIP [nerc.com], the Cybersecurity Procurement Language for Energy Delivery Systems [energy.gov] document, and not using something like the CIS benchmarks [cisecurity.org] for your systems. I have a feeling that they likely weren't' even following the awful but better than nothing PCI DSS [pcisecuritystandards.org] standard. While the language in each document tends to be tailored to a specific industry it shouldn't be that difficult to make the concepts and actions applicable to yours, especially when going from SCADA systems to ICS systems.
T-Shirts and bumper stickers [zazzle.com] to offend someone
(Score: 0) by Anonymous Coward on Friday December 15 2017, @06:53PM
Just DuckDuckGo "Triconex windows" and you'll see that your assumptions are correct: it runs on Microsoft's finest.
(Score: 2) by PinkyGigglebrain on Friday December 15 2017, @08:29PM (1 child)
The Sun should not be used as a dumping ground for that level of filth.
"Beware those who would deny you Knowledge, For in their hearts they dream themselves your Master."
(Score: 2) by c0lo on Friday December 15 2017, @11:33PM
May we use Oracle instead?
A little extra filth won't make much of a difference.
https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford
(Score: 2) by Grishnakh on Friday December 15 2017, @08:59PM (3 children)
You're absolutely right about Windows, but I don't quite agree with the last part.
It's true: using Windows for critical infrastructure is incompetent and stupid. Worse, was this "critical infrastructure" system connected to the internet? That too is incompetent and stupid.
But firing people into the Sun is uncalled for. It's extremely expensive to launch people into space, and the idiots who did this would probably die very quickly that way. I think a more fitting punishment is slowly lowering them into an acid bath. This will also be much less expensive.
(Score: 2) by jmorris on Friday December 15 2017, @09:07PM
I'm reasonable, whatever gets the point made. I'm like the left head of the three headed giant, "All right, all right, all right. We'll kill him first and then have tea and biscuits."
(Score: 2) by bob_super on Friday December 15 2017, @11:31PM
Just "invite" them to visit an abandoned mine for a few weeks with only one box of matches.
They should feel very secure inside all that obscurity.
(Score: 2) by Tara Li on Wednesday December 20 2017, @09:22PM
Launch them into space is fine - just aim for the Moon. Moon bases will need more organics for fertilizer.
(Score: 2) by nobu_the_bard on Friday December 15 2017, @05:59PM (1 child)
There's a lot of guessing involved, with only the data provided, that a nation state was involved. I think it's both expecting too little of other groups. Of course maybe that guess is based partially on information they left out.
The article at FireEye is a bit better about covering the actual incident: https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html [fireeye.com]
(Score: 1) by khallow on Friday December 15 2017, @06:19PM
To summarize, no obvious profit motive, deploying TRITON quickly after first penetration, indicating it was built for the target type, and that in turn indicating that they had access to some expensive, exclusive gear.
(Score: 0) by Anonymous Coward on Friday December 15 2017, @07:28PM
if you use slaveware on critical systems you should be held criminally liable when it is used by other masters on your slaves.
(Score: 3, Interesting) by legont on Friday December 15 2017, @07:46PM
What I find interesting is that the actual outage was triggered by the security system itself which is usually the case nowadays.
Isn't it why Linus was screaming at Google's morons the other day? https://www.theregister.co.uk/2017/11/20/security_people_are_morons_says_linus_torvalds/ [theregister.co.uk]
"Wealth is the relentless enemy of understanding" - John Kenneth Galbraith.
(Score: 2) by Gaaark on Friday December 15 2017, @10:21PM (1 child)
"target the system that prevents health- and life-threatening accidents."
911???
--- Please remind me if I haven't been civil to you: I'm channeling MDC. ---Gaaark 2.0 ---
(Score: 2) by MostCynical on Saturday December 16 2017, @12:05AM
No, that is how you *cause* health- and life-threatening incidents
https://www.nytimes.com/2017/07/06/opinion/swatting-fbi.html [nytimes.com]
"I guess once you start doubting, there's no end to it." -Batou, Ghost in the Shell: Stand Alone Complex