Hacker News Reader

Comment by westi | Hacker News Reader

This is the unfortunate outcome of a bunch of factors.

OEMs moving to XXX over TCP protocols which have zero security by default and documenting this in the datasheets.

VAR installers switching to the newer products because CAT5 cable is cheaper and easier to pull than what they used to use.

The previous solution was just as insecure but harder to hack because you needed more specialised equipment.

I'm not sure how we are going to fix this without getting the OEM industry and the industry bodies behind xxx over TCP to understand that they need to bake a security model in.

View on HN

Also, for the particular case of MODBUS over TCP, MODBUS itself doesn't have any security aspect (by design) it is a very simple byte read/write protocol really.

http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b...

Just read over their FAQ. They claim that Modbus over TCP is an internet protocol. No where do they even mention security. I wonder how many devices are sitting on IPv4 addresses that are completely controllable over the net without a shred of security. Lovely.

Previously: https://blog.shodan.io/dont-be-clever/

> For example, you might know that Shodan crawls the Internet for industrial control systems (ICS). One of the most popular protocols in ICS is called Modbus that runs on port 502. At the moment, there are about 17,000 devices listening to Modbus on the default port. It turns out there are also 700 devices listening on port 503, again a one-off sort of situation.

Probably over 20k by now

Thanks. Exactly as bad as I expected.

how we are going to fix this

Lawsuits for damages, as usual.

I couldn't agree more. It shouldn't surprise anyone that cheap outfits are cutting corners on something optional.

Structural engineering solved these kinds of problems with building codes. While I'm not sure that's the answer here, I think most people would welcome guidance beyond "just put whatever devices you want on a shared network and hope for the best".

> Structural engineering solved these kinds of problems with building codes.

I'm guessing a lot of buildings and bridges had to collapse for codes to take hold. I hate to think about how many power grid shutdowns and crashing cars we will have to go through. Clearly the routine theft of personal data has not made enough of an impact to improve security.

Reply on news.ycombinator.com