Hacking industrial vehicles from the internet

Re:Hacking industrial vehicles from the internet by wepple on Sunday March 06, 2016 @06:39PM (#11236184)

I'd hazard a guess that unless the vendor can provide over-the-air updates and every system which plugs into these telematics units can also be easily upgradeable to incorporate the new added auth functionality, it might be better just to make everyone aware of the issue?

Ultimately this blog post doesn't describe any rocket science at all: anyone wanting to cause trouble on the internet is well aware of Shodanning for exposed ICS systems that fail to even implement authentication.

[ Parent | on HN ]

Re:Hacking industrial vehicles from the internet by jacquesm on Sunday March 06, 2016 @06:43PM (#11236200)

I'd be pretty wary of pushing information like this out in the open without first making sure the vendor had time to alert their customers that his is about to hit the streets. Who knows what kind of vehicles we're talking about and under what conditions they operate. Of course it isn't rocket science, but that doesn't mean you need to advance your stature in the security community by blindsiding some manufacturer on Sunday evening.

Anyway, call me old-fashioned, I don't think this is the way it should be done.

FWIW I'm aware of a SCADA system that is widely deployed that is just about as secure as this system here and I'd be the last person on the planet to publish the details of it because I know for a fact that it is used to control HVAC equipment and other building infrastructure in hospitals and prisons. These things are not toys and being aware of them does not actually allow you to play god. (In that particular case as far as I know the systems are so old that fixing them with an update is not even an option).

[ Parent | on HN ]

Re:Hacking industrial vehicles from the internet by atemerev on Monday March 07, 2016 @04:12AM (#11237881)

> I'm aware of a SCADA system that is widely deployed that is just about as secure as this system

Yes, you and a cool bunch of Chinese and Russian government-hired hackers, too.

[ Parent | on HN ]

Re:Hacking industrial vehicles from the internet by b1449835 on Monday March 07, 2016 @02:54AM (#11237660)

I think you might be late to the party. It's widely known that these systems don't have any kind of security at all. The potential criminals already had this information for a long time.

[ Parent | on HN ]

Re:Hacking industrial vehicles from the internet by Bouncingsoul1 on Monday March 07, 2016 @04:29AM (#11237918)

The SCADA System or the underlying protocol?IEC6180(Layer2 Goose)or DNP3 dont define any auth or securtiy while OPC_UA does.

[ Parent | on HN ]

Re:Hacking industrial vehicles from the internet by chatmasta on Sunday March 06, 2016 @06:56PM (#11236256)

Would it be "ethical hacking" to DDOS any website hosting or linking to this article?

[ Parent | on HN ]

Re:Hacking industrial vehicles from the internet by jacquesm on Sunday March 06, 2016 @07:04PM (#11236282)

No, of course it wouldn't be.

[ Parent | on HN ]

Re:Hacking industrial vehicles from the internet by IncRnd on Monday March 07, 2016 @12:04AM (#11237206)

Are you unsure of the answer?

[ Parent | on HN ]

Re:Hacking industrial vehicles from the internet by chatmasta on Monday March 07, 2016 @11:32AM (#11239766)

It's a thought question.

If releasing irresponsibly a vulnerability puts people in real danger, is it worth it to suppress the release of that vulnerability?

[ Parent | on HN ]

Re:Hacking industrial vehicles from the internet by draven on Monday March 07, 2016 @05:18AM (#11238066)

> unless the vendor can provide over-the-air updates

http://www.neweagle.net/ProductDocumentation/Telematics/Tele... mentions "Remote Flashing" so I guess they fix that.

[ Parent | on HN ]

Re:Hacking industrial vehicles from the internet by pbhjpbhj on Monday March 07, 2016 @09:59AM (#11239219)

Well the OP includes details of commands that can be sent including "update" so perhaps someone has already updated all of them to add a backdoor.

[ Parent | on HN ]