@hacks4pancakes

its because when companies do find someone capable of securing those systems, and they refuse to "get on board" with the new sloppity some exec saw at Automation Fair, they lose that someone.

@hacks4pancakes I was cleanup crew post nation state hack on a govt agency. they have facilities in _very_ inhospitable locations. some of their gear required re-supply and that assessment could only be done visually. So they put a store bought webcam on the canister that housed the consumables.

Unfortunately the only network path out was the agency internal network. Even more unfortunately, that webcam had malware from the factory.

The newer gear came with consumable tracking alerts. which was better. Those alerts were clear text and unsigned, which was less good. We took the wins where we could.

@hacks4pancakes Point me at a hiring ad 😃

@hacks4pancakes There's alternatives to airgap that're better than open connectivity though. VPN gateway for example, the hardware isn't that expensive (or shouldn't be given the price of small industrial PCs with 2 network ports). I think the real problem is we're letting business people have the final say over technical decisions in situations that can have catastrophic consequences if the decision is wrong.

@hacks4pancakes
Power infrastructure here. Everything is designed such that you can switch to manual anytime, but that is rather costly whenever it happens.

@hacks4pancakes The people who ultimately decide to put critical infrastructure on a public network are probably not the ones who end up getting fired when things go wrong.

@hacks4pancakes

The other issue will be reporting and documention requirements for commercial freezers and fridges

Their temperatures would need to recorded regularly so as to demonstrate that the food (or whenever) is being kept at the correct temperature.

Doing that at scale, reliably for any number of fridges and freezers would be manually expensive and error prone. Possibly with a temptation to hide errors with falsified manual recordings.

Remote, centralised recording and monitoring makes good sense. It has to be done securely though which is where cost and convenience wins out over security 🫤🤷‍♂️

Who would possibly want to tamper with a fridge containing blood products? A failure of immigination coupled with cost cutting is a dangerous combination 🫤

@hacks4pancakes
So wherecdo i sign up?
I am a 70y/o programmer with some ancient IBM RPG experience as well as BASIC and some COBOL.
Mostly Perl, PL/SQL and C/C++.

@hacks4pancakes exactly…

@hacks4pancakes as I understand it, the fridges (aks-800 controllers) were directly internet-facing, accessible via public ipv4.

Internet of shit.

@hacks4pancakes the amount of orgs that have factory in the same flat network is disheartening. They are also the ones who refuse to decom that windows 95 machine running a 3 million dollar piece of machinery.
You can have insecure environments, but let's not put them on the internet 🫠

@hacks4pancakes

This 👇🏼💯 %

" I it's because everyone demands cheap, fast remote support and AI enabled real time telemetry and control. We’ve worked ourselves into this corner through demanding connectivity and I see next to nothing truly airgapped anymore. In fact, it’s impossible to convert some critical systems back at this point. "

@hacks4pancakes having worked in and built some factories and labs in my corporate times, a bunch of these internet connected devices are installed by "facilities engineering" without IT ever being involved. I hoped this had improved in the last 10 years... But it seems it has gotten worse.

@hacks4pancakes Fun Lovin' Criminals put it best in 1996:

RUNNIN' AROUND ROBBIN' BANKS ALL WHACKED OFFA SCOOBY SNAX