General Electric plays down industrial control plant vulnerabilities

LAN party!

Yeah, the hacker needs to be on the LAN. And they are!

"In order to steal our stuff, the thief must enter the front door..." No, really? The glass door that's off its hinges, that one?

Well, it's either going to be hackers or squirrels, and the squirrels have the lead.

Oh jeez...

Ever since 1999 everyone has known the greatest weakness of power stations is their absurd inability to stop flying motorcycles entering and blowing up the external security booths.

Further to that we also learnt that nmap is installed on the most important machine in the building and that tool alone is enough to cut the power to an entire city block.

I think they're regardless of the situation if they dont resolve the above issues.

So it's open to any engineer ..

.. with an infected laptop (which is not exactly a new discovery, by the way).

Yeah, I feel safer already. Time to check if my torch still works, I think.

"The film readers may want to look for is "Zero Days"."

More than 1. IIRC they used 4 of them.

It can be found on the BBC iPlayer website

Hmm

"A spokeswoman for GE Digital played down the vulnerabilities, which she said can't be exploited remotely. Only a local hacker in a plant or facility would have been in a position to run an attack, she said, adding that there had been no signs of exploitation."

I realise she can only say what the company tells her, and being a spokeswoman, she isn't going to say "Sorry, our security is crap. We'll fix it ASAP", but while it's likely that their software does not expose the bug to the outside world, saying it cannot be exploited assumes that the machine running it is sufficiently airgapped (or otherwise protected). All it would need is for some custom written malware to get on to the machine (such as Stuxnet) or for someone to enable access via a remote command/desktop system (Microsoft Remote Desktop, SSH or VNC for instance), as any company looking to outsource support may well do.

Industrial Systems

Although it's a good few years since I worked on systems operating machinery via PLCs etc. I doubt much has improved in terms of security.

There would sometimes be air-gapped assumption / initial config.

However in these cases there would usually be insistent whining from someone important that they needed to get some info off the control system from their machine, and drearily inevitable security reduction be it allowing USB device to be plugged into a machine so data could be copied to the USB device, linking control machines to high up bods local network, allowing remote access to control network machine(s) etc.

More typically the approach would be the scary, it's all inside our building with restricted access so it's safe, no worries.

a/c for obvious reasons

Hmmm...

Used to be a GE employee.

There used to be enforced air gaps in their systems, then someone high up decided that IoT looked good and that they should interconnect everything that could be interconnected.

2015 was a year of management telling all SW engineers that they had to sort out security and connect everything (even legacy stuff), but no extra fleshy resource was allowed and the normal development had to go on unaffected! More of it was successfully modified than you would expect and I suspect that it was all sorted by mid-2016. However, you then have to get it into all the nooks and crannies of the customers systems, and many of them have no idea what they have embedded in their systems.