|
 A couple months ago I wrote a blog post on the Internet of Things (IoT), which has become the new buzz word in the tech world. The IoT concept is essentially one of connectivity: that all kinds of devices could benefit in some way by being connected to the internet. This idea is really intriguing, since the internet provides overwhelming possibilities on many fronts, including data collection and analysis, and remote operation. But as myself and other CR4ers were quick to point out, in many cases the benefits of being connected are not worth the risks.
A recent article on MIT's Technology Review discussed one area where internet security is of particular concern: industrial facilities. Jason Larson, a security researcher for industrial clients, has spent much of his time over the last few years demonstrating the vulnerabilities of plant computer systems, and identifying ways that hackers could potentially break in and make a mess of things.
 Among the list of possible attacks includes a "water hammer", in which a hacker dramatically increases the flowrate in a pipe and then abruptly closes a downstream valve. The resulting force from the stopped water could easily cause a burst in the pipes that damages equipment and people in the vicinity. Other possibilities include mixing incompatible materials and causing unsafe exothermic reactions outside of designated storage vessels. Basically, any worst case operating scenario you can imagine is possible if the hacker has access to the system controls. All it takes is a basic sense of physics and chemistry to imagine what could go wrong.
Unfortunately, research has shown that potentially thousands of industrial control systems with internet connections have virtually no or poor internet security. Likely some of these plants have never had an issue with security and so don't see the risks, while others may not even have awareness of what hackers could do. While I'm sure some of these systems require an internet connection in order for proper monitoring and operation, I think it's fair to say that others would not miss much if they pulled out their Ethernet cords.
The question I posed in my last blog post on the IoT was, "are we ready", given the number of massive security failures we have seen in the last few years. I am still of the opinion that we need to take a serious look at beefing up internet protections before moving forward with the IoT dream. This is especially true in industry, where the toys are much bigger and thus the stakes for failure are much much higher.
| 
Re: How to Hack a Chemical Plant
"Almost" Good Answers: