Hacker News Reader

Comment by lima | Hacker News Reader

The first time I tried to automate the S7-1200 web UI, it crashed hard when I sent a POST requests with an empty body.

These things do not belong anywhere near the internet, patched or not.

Pretty much built for someone that knows exactly what they are doing. Like they've read the manuals cover-to-cover and taken an exam.

An industrial control system that crashes when it receives an unexpected network request isn't built for someone that knows exactly what they are doing. It was built by someone who wanted to expend the minimum effort possible and make contingency-handling someone else's problem.

This isn't just about hacking. A device that crashes hard when it receives a POST with an empty body may do the same thing if there's a physical glitch with its connection, or if a cosmic ray flips a bit somewhere. Devices that control industrial machinery should be more reliable than that.

If this were a hobbyist project, or a toy, that would be one thing, but these are specialized devices that cost a lot of money. They're fragile liabilities that don't belong anywhere near a shared network.

> An industrial control system that crashes when it receives an unexpected network request isn't built for someone that knows exactly what they are doing.

Yeah - I can see even the simplest of network vulnerability scans wreak havoc on a device like this.

Its enough to just plug in a cable into two switch ports.

Yeah, that's the reasoning someone needs to use as to why something like this exists. It only works at all if you everything exactly correct.

Reply on news.ycombinator.com