PLC… what?
Have your ever heard of programmable logic controller (PLC)? It is an industrial digital computer, developed to manage manufacturing processes. A cunning student from Georgia Institute of Technology initiated a rather odd research: David Formby decided to make a point that not only home or business sector could be potential threats of ransomware, but also industrial control systems. He explained that PLCs, even though essential to some procedures, are seldom protected with great security layers. Instead, they are pretty exposed to ransomware attacks, which was the main argument Formby attempted to prove with his experimental case.
Highlights of the research
In theory, PLCs are supposed to be isolated from the Internet connection, but some of them pass those restrictions and could be exposed to attacks from external parties. This is a poor decision when it comes to handling these devices since it was not intended for them to be connected to the Internet. Formby also explained that there is nothing standing between hackers, initiating brute-force password attacks and these vulnerable PLCs.
In order to visualize his ideas and bring them to life, Formby contrived to create a simulated water treatment plant, supposedly developed to manage the movement of water and chlorine into a storage tank. Naturally, chlorine is a dangerous chemical element which should not be in the drinking water supplies. However, to reveal the dangerous side of PLCs, Formby constructed a ransomware virus which was supposed to become in charge of the device he had created. Suspicions of the student were determined to be true as he, as a hacker, managed to take control over its creation and mix supposed drinking water with chlorine, making a deadly combination. The same strategy could be easily selected by vile hackers as they attack industrial companies and threaten to ruin functionality of their most essential devices. Of course, Formby constructed an amateur version of a water plant as the real companies proceed with much more complicated software.
What should be learned from this experiment?
For starters, security researchers and dominators of the industrial world should recognize the necessity to protect PLCs with more sophisticated security tools and make sure that essential systems would not be connected to the Internet. Even though some companies might be proceeding with top-notch security features, there is a number of those that could be failing in this area. If hackers decide to take advantage of unprotected PLCs, they could potentially start the next era of the ransomware infections. Imagine loosing electricity because of a ransomware attack: this would be an even more terrifying world to live in. From our point of view, we are glad that Formby draw attention to this issue, but we have doubts about whether publicizing this discovery won’t lead to disasters. Let’s hope that this is just our overly-cautious mind talking.
Source: networkworld.com.
