Hacker News Reader

Comment by Grimeton | Hacker News Reader

>85% ran software with known security flaws. That includes 527 older controllers Danfoss no longer supports. Only 195 had every known fix.

As long as the fridges are used the controller has to be supported.

This isn't a raspberry pi $50 a pop...

View on HN

Those fridges are from the 90s. You cant reasonably support it that long. It's not even just software. The PLC is fixed hardware, you can't simply patch that.

You can replace the PLC. It's not like a modern PLC couldn't be made to control a 1990s fridge. The question is "Who will pay for the upgrade". DanFoss sure as hell won't. The stores won't, because they've already paid for the fridge.

Honestly I feel like this should fall under a support contract. The pricing structure could be similar to that of Microsoft. Support is fairly cheap, X number of years included in the purchase price, once the product reaches EOL the price goes up dramatically each year.

There's a massive problem in how we think about these products collectively. They are inherently insecure, they will be attacked and preventing it is expensive. You could build a safer alternative, but you'd be priced out of the market instantly by less safe, but more convenient alternatives.

I work in the industry. Usually customers are sold new PLCs for exorbitant prices as an "upgrade". Service contracts are only for know-how maintenance. Support cases get billed in addition to that.

This is how it's done everywhere I worked. You can patch some bugs for cheap in the software, but you can't fix hardware limitations. I know companies that use PLCs that still don't support encryption despite the upcoming EU regulations.

The companies either don't care or are too greedy to spend money on this.

In that case you maybe shouldn't put them online protected by nothing but 30 year old security.

Why can't you support it that long?

You couldn't read more than 2 sentences?

So there is no actual reason then.

"The PLC is fixed hardware, you can't simply patch that."

Oh yes you can patch it - that's how I got the 20 year old laminator working where I work. If the hardware is still good you can absolutely change firmware if you have the PLC control software (like RockWell ControlFlash) or know how to manipulate the ladder logic directly.

You can change firmware aka how it behaves but you can't change it's capabilities.

Sure you can. Code is code. I took a machine without brush cleaning for transfer sheets and hand-tapped, mounted motors and controllers and brush assemblies, ran the connections into the PLC, install and connect the power relays, reflashed the PLC firmware with custom code, BAM it works.

As long as you have room in memory, you can add functionality.

Things will only meaningfully change when insurance companies stop paying out when reasonable steps weren't taken by companies to protect themselves.

As someone who has worked with small and medium sized businesses, reasonable is extremely variable. I'm dealing with a small business right now that can't upgrade their perfectly good computers because of TPM issues. On one hand, I kind of get the reasoning behind it, but how can you hold a business of 10 people accountable for not knowing how to buy a computer that will be reasonably future proof? Every business needs IT on hand? I think that's asking too much. On the otherhand, you should know the tools you need to run your business. There's no fine line.

I think if you can afford computers for your business but you can't afford to keep them secure, then you can't afford computers for your business.

What about plumbing and electrical? Do you need to employ those as well?

No, but you do need to keep them secure. The argument goes towards computers as appliances, which I wholly support.

TPM issues is a M$ invented shit. They shouldn't be running anything past Windows 10 anyway, and Windows 10 I believe, at least the normal versions are EOL already? But yeah businesses will do stupid things like installing Windows 11, and if they don't have dedicated staff to handle shit, they won't even know better what they should be doing. Plus their software may have idiotic requirements on top, that don't really make switching easy.

Insurance does actually tend to put cybersecurity requirements on to businesses they insure, the problem is that it's pretty hard to write cybersecurity requirements that actually result in secure IT systems as opposed to just a bunch of compliance work.

In theory, an insurance company could inspect and pen-test.

In practice, that would run into (probably, IANAL) legal issues, cost & staffing issues, and the narrow worldviews and business models of the insurance industry.

Oh, great idea. We should do that for software: force manufacturers to support their software with bugfixes as long as it is in use. And just bugfixes, the marketing department can stay out of it.

This will never fly. Some devices can be used for tens of years and they may face vulnerabilities that the hardware cannot support any kind of software fix for them. Imagine the world moves to TLS2 or whatever something new will be called and the hardware you have is too slow for it.

On the other hand, saying an industrial device should receive security updates for 10-15 years instead 5 or whatever happens this days it will be a major step forward. This will incentivise vendors to use better hardware with room to grow, not just the cheapest components possible.

Or, make componente modular so that you can upgrade just the control unit instead of the whole fridge or whatever.

The EU's CRA does mandate this kind of thing. It states 5 years minimum, but it needs to be longer if it's expected that the product remains in use for longer, and you need to commit to it in advance and tell customers (at the point of sale: so printed on the box or on the product listing).

Reply on news.ycombinator.com