It’s been a really bad month (and year) for OT cybersecurity. From a wave of new, high-impact vulnerabilities, to attacks on supermarket refrigerators, to attacks on blood banks, we’ve …

Over the last ten years, we’ve lived through the rapid adoption of remote connectivity in industrial environments around the world.

[…]

Now that we understand the chaos of connectivity in modern industrial environments, we can talk about what’s getting hacked right now, and why. Why water? Why refrigerators?

A few unfortunate, incredibly predictable factors have led us here, and my colleagues and I have been screaming about them for years: [ …]

[…]

Fixing the vulnerability isn’t easy, even if the organisation is aware of it. Industrial systems have long lifecycles, sometimes 10 to 30 years. They’re engineered and tested by the OEM to work in a very specific technology stack and topology. Any alteration can, at best, disrupt the process and, at worst, lead to injury or death. Either outcome can be far more damaging than a casual hacker. Because of these lifecycles, and the inability to replace systems, I still deal with Windows 2000, CE, and XP every week. They can’t be removed from production or modified without express authorisation from the OEM and engineers, plus a significant outage and testing window.

  • pianoplant@lemmy.worldEnglish
    1·
    1 hour ago

    Can’t speak for the situation in other countries, but in the US you can get a cheap lte modem and put it on a custom apn that’s completely airgapped for less than $1/mo/sim with fairly minimal setup costs. So I agree, this is just silly that these are on public networks.

    • MalReynolds@piefed.socialEnglish
      1·
      1 hour ago

      Yup, all this insecure crap needs to be in a DMZ and firewalled up the wazoo, but that’s, I was going to say a band-aid, but a pressure bandage is more appropriate, considering how hard it can bleed. Of course, you could just airgap things and actually pay someone to manage the software as needed (like savages), but you know, that’d hit the bottom line. You get what you pay for.

  • 🌞 Alexander Daychilde 🌞@lemmy.worldEnglish
    5·
    5 hours ago

    There is absolutely no excuse for generated passwords like the day’s date. That is NOT A PASSWORD. And if that is considered a sufficient password, then they should not have even bothered with a password.

  • HaraldvonBlauzahn@feddit.orgOPEnglish
    12·
    7 hours ago

    The mess is metaphorically a result of a kind of hasty, brainless merger of the mindsets of Internet and server companies with those of companies that construct field buses and factory floors. These two ways of connecting things are not very compatible. And the factory floor corps don’t even understand why security is necessary.

    To sum it up, the problem is systemic. It is not just that Danish connected thermostat manufacturer.