Ok while talking about movies is not totally security stuff, there was a bunch of SCADA hacking going on in the movie that was entertaining. I thought the movie was good, except for one part where the kid pulls out what looks like the PIN cracker from the terminator movie and it cracks the PIN for a door protecting these NSA servers. I don’t want to say that the rest of the movie was “believable” but the hand waving and magic at that point kinda disappointed me because they did such a good job with the rest of the flick, ok well.
There were some rumors going around that there would be some metasploit action in the movie but there wasn’t. Kinda disappointing in that respect, that would have been almost as exciting as the SSH attack in the matrix.
more on the SCADA stuff, there has been a lot of talk for years about SCADA vulnerabilities, hell you can even get a class on it by InfoSec Institute. Obviously the issues rises when you have a system that runs on, really any OS, that requires internet access yet you cant patch the box. DoD has systems like this that run some special application that if you patch the box it breaks the application or you’ll have crap that only runs on windows 98 or Windows 2000 SP0 and no one wants to pay to have someone redevelop the application and instead would rather get the whole network, VLAN (hopefully), or segment owned. For the life of me I cant imagine what guy accepted an application that runs on a computer that could never be updated but I am sure they had their reasons (ignorance, bribes, etc) but I think that time and money would be better spent developing a web solution that can do the same thing. That way you have to worry about keeping secure the ONE server, application, database, etc instead of the multitude of computers spread across the world.
Anyway, I’ll go on the limb and say that ‘security by obscurity” has been proven ineffective and we should definitely move away from that especially when (national) infrastructure is involved.
LINKS
SCADA Security and Terrorism: We're Not Crying Wolf:
http://www.blackhat.com/presentations/bh-federal-06/BH-Fed-06-Maynor-Graham-up.pdf
SCADA system makers pushed toward security:
http://www.securityfocus.com/news/11402
Utility hack led to security overhaul:
http://www.computerworld.com/securitytopics/security/story/0,10801,108735,00.html
Hacking SCADA/SAS Systems:
http://www.ptil.no/NR/rdonlyres/F09CB606-7DEC-4062-B5FE-83D1D8D1E63A/12230/MicrosoftPowerPoint4HackingSCADAPTIL.pdf
eEye Marc Maiffret Congress Testimony
http://research.eeye.com/html/papers/download/Maiffret-Congress-Infrastructure.pdf
https://www.pcsforum.org/events/2007/atlanta/legacy.pdf
Information Technology (IT) Security for Supervisory Control and Data Acquisition (SCADA) Systems:
http://cipp.gmu.edu/archive/127_DallasGunnerson_SCADA.pdf
A Plan for SCADA Security:
http://www.itoc.usma.edu/Workshop/2005/Papers/Follow%20ups/WP%20IEEE%20(Jun%202005)%20-%20Next%20Gen%20SCADA%20Security.pdf
No comments:
Post a Comment