Hacked Florida Water Plant Found To Have Been Using Unsupported Windows 7 Machines And Shared Passwords

from the sigh dept

By now, you have likely heard about the recent hack into a Florida water treatment plant which resulted in the attacker remotely raising the levels of sodium hydroxide to 100 times the normal level for the city's water supply. While those changes were remediated manually by onsite staff, it should be noted that this represents an outside attacker attempting to literally poison an entire city's water supply. Once the dangerous part of all of this was over, attention rightfully turned to figuring out how in the world this happened.

The answer, as is far too often the case, is poor security practices at the treatment plant.

According to an advisory from the state of Massachusetts, employees with the Oldsmar facility used a computer running Windows 7 to remotely access plant controls known as a SCADA—short for “supervisory control and data acquisition”—system. What’s more, the computer had no firewall installed and used a password that was shared among employees for remotely logging in to city systems with the TeamViewer application.

If you're not in the IT space, this is base level stuff. Have your computer systems on operating systems that are under active support and are being patched. That is doubly so for any systems that are critical, or which have access to critical systems. And to not have any client security, such as a local software firewall, on such a machine is IT malpractice. On top of the above, it appears that TeamViewer hadn't been actively used by the staff there for nearly six months. So there, again, was poor administration of the environment, with an antiquated remote access application not being removed from the production environment.

Instead, the save in all of this came from the meatware that was fortunately sitting at the machine and actively watching.

The breach occurred around 1:30pm, when an employee watched the mouse on his city computer moving on its own as an unknown party remotely accessed an interface that controlled the water treatment process. The person on the other end changed the amount of lye added to the water from about 100 parts per million to 11,100ppm. Lye is used in small amounts to adjust drinking water alkalinity and remove metals and other contaminants. In larger doses, the chemical is a health hazard.

Christopher Krebs, the former head of the Cybersecurity and Infrastructure Security Agency, reportedly told a House of Representatives Homeland Security committee on Wednesday that the breach was “very likely” the work of “a disgruntled employee.”

It's a water treatment plant for an entire city. In an era where there is an extreme lack of trust in government, dumb stuff like this acts as a supercharger.

Filed Under: florida, scada, security, shared passwords, water plant, windows 7

IRS Still Working To Complete Computer Upgrade From Windows XP To Windows 7

from the by-2020-it-will-be-2010 dept

Like many other entities (both singular and conglomerate), the IRS was reluctant to sever ties with Windows XP. Microsoft forced the issue, however, and gave everyone plenty of time to migrate to an operating system released sometime in the last ten years. Even with this head start, the IRS has yet to meet this target.

An Inspector General's report notes that the IRS is almost finishing upgrading its workstations to an operating system that's only eight years old (Windows 7). Almost.

As of May 2015, the IRS has completed most of the Windows XP workstation upgrades across the country. Approximately 1,300 workstations have yet to be located or confirmed as running the old operating system.

At this point, I'm going to do something I rarely do: cut a government agency some slack. The IRS did have plenty of workstations to upgrade -- nearly 110,000 -- so if 1,300 went "missing," it's somewhat understandable. On top of this, budget issues forced the agency to upgrade old workstations instead of replacing them with newer systems, which would have greatly sped up the process.

The IRS claims it does know where these missing 1,300 workstations are, but that the Inspector General won't listen to it. The included "Management Response" says the following:

The audit incorrectly concludes that IRS has not accounted for all XP workstations. We acknowledge there were challenges with our inventory data due to the many antiquated systems in our IT ecosystem. In spite of this, we took extraordinary steps to identify, document and upgrade every XP workstation in the IRS. On several occasions throughout the audit, the IRS provided information to the TIGTA team that clearly documented the number of workstations to be upgraded, where those workstations were located, and our strategy to complete the upgrades. Although footnoted in the report, TIGTA opted not to change their assertion that the IRS had not accounted for all XP workstations. As of this date, only 71 Windows XP workstations remain to be migrated.'

The IG's footnote tells a different story.

After the conclusion of our fieldwork, the IRS provided documentation that these workstations were located and upgraded to Windows 7, as of July 22, 2015. We were unable to verify this information.

Beyond the workstations, there's the IRS's servers, which are also running up against Microsoft's upgrade clock. This not-overly-optimistic statement by the IG suggests the IRS will be living in the (OS) past for much of the future.

Based on our discussions with management, we determined it is unlikely that the IRS will have its servers upgraded to Windows Server 2012 any time this Fiscal Year.

This is due to the fact that the IRS is still struggling to upgrade its servers to seven-year-old software.

In fact, the IRS still has not fully upgraded its servers from Windows Server 2003 to the 2008 release. Currently, the IRS has approximately 3,000 Windows servers still running the 2003 operating system. Management informed us that they have upgraded approximately 4,100 servers to the 2008 version which is already seven years old. The IRS currently has no servers running the 2012 operating system in production at this time.

Time to start reeling in the slack I cut the agency earlier. This logistical issue seems especially absurd.

The IRS also discovered nearly 6,000 applications being used by employees to do their jobs that required an assessment of each application to determine whether it would operate on Windows 7.

Unfortunately, the report doesn't provide more details on the massive amount of applications being used by the IRS. Every interlocking piece presents a new possibility for a hole or an exploitable flaw, something compounded by the use of unsupported system software.

The IRS has already seen its system exploited by scam artists, who were able to use the credentials of taxpapyers to fraudulently obtain refunds. That its "user data" (the tax records and personally-identifiable information of millions of Americans) is secured behind a patchwork of outdated software presents criminals and rival governments other opportunities for exfiltration and exploitation of taxpayer data.

Even if the IRS manages to hit its self-imposed targets for the most recent round of upgrades, support for those operating systems is also on its way out.

Despite the eventual progress made by the IRS on the Windows XP upgrade efforts, we believe the IRS provided inadequate oversight and monitoring during the early phases of this effort, starting with including it among other Microsoft product upgrades rather than making this effort its own project up to the decision made by the CTO to oversee the project himself. In addition, after taking four years to upgrade to Windows 7, the IRS is now faced with the challenge of addressing Microsoft’s announcement to end extended support for Windows 7 in January 2020.

The IRS has agreed to a majority of the Inspector General's recommendations which means… well, it probably doesn't mean much of anything. Chances are the IG will revisit this in a few years and still see the agency struggling to stay current with its operating system software. It's eight years behind on system software and seven years behind on server software, with the latter's migration less than 50% complete. The IRS doesn't have it easy, not with 110,000 workstations, 7,000 servers and -- for god knows what reason -- 6,000 applications, but unless it's willing to give this the priority it deserves, it will always be in danger of making a flawed, bulky system even more insecure.

Filed Under: computers, government, government it, irs, windows 7, windows xp

Microsoft Retrofitting Windows 7, 8.1 With Windows 10's Privacy-Invading 'Features'

from the unavoidable-Redmond-umbilical dept

Last week we noted that while Windows 10 has generally seen good reviews in terms of spit and polish, there's growing concern that the OS is too nosy for its own good, and that the opt-out functionality in the OS doesn't really work. Even when you've disabled a number of the nosier features (like Windows 10's new digital assistant, Cortana), the OS ceaselessly and annoyingly opens an array of encrypted channels back to the Redmond mother ship that aren't entirely under the user's control.

Now some of the information being transmitted is purportedly harmless, and some of the problems appear to be overblown (like Windows 10 being banned from some BitTorrent trackers for fear of it reporting user piracy activity), but an operating system you can't fully control is still undeniably stupid and annoying. And it's a curious choice for a company intent on moving beyond the fractured Windows adoption of yesteryear and encouraging the lion's share of Windows users to hop on to a new platform.

Making matters worse, Microsoft now seems intent on retro-fitting its older operating systems (specifically Windows 7 and Windows 8.1) with many of the annoying, chatty aspects of Windows 10. GHacks has noticed that four updates to the older operating systems, described as an "update for customer experience and diagnostic telemetry," connect to vortex-win.data.microsoft.com and settings-win.data.microsoft.com. These addresses are hard-coded to bypass the hosts file, and ferry all manner of personal information back to Microsoft.

Fortunately, it appears that users in this instance can configure Windows firewall and routers to block the traffic, and users can avoid much of the snooping by opting out of the Customer Experience Improvement Program (CEIP):

"The concern with the new Diagnostic Tracking service is much the same as with Windows 10's tracking: it's not clear what's being sent, and there are concerns that it can't be readily controlled. The traffic to Microsoft's servers is encrypted, sent over HTTPS, so it can't be easily examined. While the knowledge based articles describing the new service list the DNS names of the servers that the service connects to, there are reports that the service ignores the system HOSTS file. As such, a traditional and simple method for redirecting the traffic doesn't work.

However, we're not sure just how big an impediment this is in practice; in our testing of Windows 8, the builtin Windows Firewall, for example, is more than capable of blocking the traffic, and this appears to be working entirely as it should. Disabling the service is also effective for those who don't trust its behavior."

Still, it's annoying that Microsoft continues to insist on expanding this kind of OS behavior, without making opting out simple and comprehensive. And it certainly doesn't exactly deflate arguments by folks like Richard Stallman, who consistently argue that Windows is effectively malware. More than anything though, it's a continued advertisement for Linux and operating systems that the end user actually has some degree of control over.

Filed Under: privacy, windows, windows 10, windows 7, windows 8
Companies: microsoft

Microsoft Exec: Piracy No Longer A Threat To Us, Because Pirates Will Get Destroyed By Malware

from the interesting-theory dept

Ok, perhaps the title is a bit of an exaggeration, but it certainly appears to be what a Microsoft exec in the Philippines implied in a recent interview concerning Windows 7. Basically, he said that using unauthorized copies of the OS were really unsafe, so doing things like online banking or other sensitive stuff on such software could put users in serious danger. Of course, that makes you wonder what Microsoft has done to make unauthorized copies of the software so dangerous to use...

Filed Under: malware, piracy, windows 7
Companies: microsoft