Hacker News Reader

Comment by Arrezz | Hacker News Reader

The scale of this is baffling! And from what I've seen in the industrial side of things I doubt that everything will be patched anytime soon sadly.

View on HN

And there are many medical devices running on VxWorks. Changes to medical devices can take months to years due to quality testing and recertification. (software changes aren't as bad as a physical change, but it still takes a while)

If we gave them each an IP address, they'd use around half of the IPv4 address space.

especially when many of the devices have to be returned to manufacturer for the update... including a whole bunch of RTUs that run electrical transmission/distribution systems.

On the industrial side all these devices are in completely segregated airgapped networks. Obviously someone could strike havoc via USB, etc., but it’s not as bad as it could be.

I’d expect sonicwall firewalls and xerox printers at least to have network connectivity.

A buck shot approach of mailing malicious USB devices would likely be devastating.

Maybe. But it would have to be smart. These systems are regulated by tight SOPs which don’t allow for the plugging in random USB devices.

Depends on the org. For some companies, you could drop a few USB devices in the parking lot and they'd be toast. Others fill the USB ports on their computers with epoxy.

> Others fill the USB ports on their computers with epoxy.

How do you plug in a mouse or keyboard?

You plug those in and epoxy them so they can never be removed.

Internal networks, yes. Airgapped, probably not.

Why do you believe this? Connections between industrial control networks and corporate internet-facing business networks are ubiquitous [0]. They happen because somebody needed a link for convenience and forgot to tell management, or somebody put a wifi router on the IC network just to get their job done. This stuff happens because people act like people, policy be damned.

So yeah, this is really, really bad.

[0] This is well-established infosec fact. It's not controversial. Latest case I know of was at JPL a few weeks ago.

https://duckduckgo.com/?q=jpl+infosec

Agreed. Some orgs are better than others at practicing good security hygiene.

The better ones have awareness of their network and have systems monitoring their networks, etc. There are afterall the equivalents of Qualys in the IA world.

Reply on news.ycombinator.com