{"id":7435,"date":"2016-07-15T08:12:58","date_gmt":"2016-07-15T12:12:58","guid":{"rendered":"https:\/\/kasperskydaily.com\/uk\/?p=7435"},"modified":"2020-02-26T15:12:01","modified_gmt":"2020-02-26T15:12:01","slug":"industrial-vulnerabilities","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.uk\/blog\/industrial-vulnerabilities\/7435\/","title":{"rendered":"Hacking electricity, water, and food"},"content":{"rendered":"<p>As we keep saying, it\u2019s very important to be aware of the latest cyber-security news and threats. Being prepared is more than half the battle.<\/p>\n<p>However, even those who know everything there is to know about cyber-security, who use reliable <a href=\"https:\/\/www.kaspersky.co.uk\/blog\/remember-strong-passwords\/4955\/\" target=\"_blank\" rel=\"noopener\">passwords<\/a> and <a href=\"https:\/\/www.kaspersky.co.uk\/blog\/passwords-are-like-underwear\/6484\/\" target=\"_blank\" rel=\"noopener\">regularly change them<\/a>, who recognise <a href=\"https:\/\/www.kaspersky.co.uk\/blog\/phishing-ten-tips\/6452\/\" target=\"_blank\" rel=\"noopener\">phishing messages<\/a> at a glance and protect their devices with a <a href=\"https:\/\/www.kaspersky.co.uk\/advert\/internet-security?redef=1&amp;amp;THRU&amp;amp;reseller=gb_ukdaily_acq_ona_smm__onl_b2c_kasperskydaily_lnk_______\" target=\"_blank\" rel=\"noopener noreferrer\">top-notch security solution<\/a> \u2014 even those who do <em>everything<\/em> right \u2014 are not completely safe. Because we all live in civilization.<\/p>\n<p>The thing is, we have control over our personal devices, but industrial equipment is far beyond our reach.<\/p>\n<h3>Cybersecurity? But we bake cookies!<\/h3>\n<p>Our cybersecurity experts undertook a <a href=\"https:\/\/securelist.com\/analysis\/publications\/75343\/industrial-cybersecurity-threat-landscape\/\" target=\"_blank\" rel=\"noopener noreferrer\">study<\/a> to find out where things stand with industrial control systems safety.<\/p>\n<p>Shodan, the search engine for connected devices, showed us 188,019 industrial systems in 170 countries that can be accessed on the Internet. The majority of them are located in the United States (30.5%) and Europe \u2014 mainly Germany (13.9%), Spain (5.9%), and France (5.6%).<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Industrial <a href=\"https:\/\/twitter.com\/hashtag\/cybersecurity?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#cybersecurity<\/a> threat landscape <a href=\"https:\/\/t.co\/k6q9DAtQyX\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/k6q9DAtQyX<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/klreport?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#klreport<\/a> <a href=\"https:\/\/t.co\/ML6LnxFa9B\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/ML6LnxFa9B<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/752570557200265216?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">July 11, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>A whopping 92% (172,982) of the industrial control systems (<a href=\"https:\/\/en.wikipedia.org\/wiki\/Industrial_control_system\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">ICS<\/a>) detected are vulnerable. Shockingly, 87% have medium-risk-level bugs and 7% have critical issues.<\/p>\n<p>In the past five years, experts have thoroughly examined such systems and found a lot of security holes: During this time period the number of vulnerabilities in ICS components increased tenfold.<\/p>\n<p>Of the systems our experts analyzed, 91.6% used insecure protocols, giving criminals the opportunity to intercept and modify data using <a href=\"https:\/\/www.kaspersky.co.uk\/blog\/man-in-the-middle-attack\/1613\/\" target=\"_blank\" rel=\"noopener\">man-in-the-middle attacks<\/a>.<\/p>\n<p>As well, 7.2% (about 13,700) of the systems belong to huge companies in aerospace, transportation and power, oil and gas, metallurgy, drinks and food manufacturing, construction, and other critical areas.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Maritime industry is easy meat for cyber criminals \u2013 <a href=\"http:\/\/t.co\/arylkFBOTc\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/arylkFBOTc<\/a> <a href=\"http:\/\/t.co\/v6QKzcjJXM\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/v6QKzcjJXM<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/601876502058262528?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">May 22, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>In other words, skilled cybercriminals can influence any economic sector. Their victims \u2014 hacked companies \u2014 will hurt thousands or millions of people by supplying them with tainted water or inedible food, or by turning off the heat in winter.<\/p>\n<h3>What does it mean for all of us?<\/h3>\n<h3>The possible effects and outcomes depend on which companies cybercriminals target \u2014 and what ICS those companies use.<\/h3>\n<p>We have already seen the results of some industrial hacks. In December 2015, half of the houses in Ukrainian city Ivano-Frankivsk were under blackout because of an <a href=\"https:\/\/www.wired.com\/2016\/01\/everything-we-know-about-ukraines-power-plant-hack\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">APT Black Energy<\/a> attack. The same year, an attack at <a href=\"http:\/\/www.securityweek.com\/attackers-alter-water-treatment-systems-utility-hack-report\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Kemuri Water Company<\/a> was discovered as well. Cybercriminals had penetrated its network and manipulated the systems responsible for adding chemicals to clean the water.<\/p>\n<p>In addition, Warsaw\u2019s Chopin Airport was also attacked by hackers. Moreover, a year earlier, criminals <a href=\"https:\/\/www.wired.com\/2015\/01\/german-steel-mill-hack-destruction\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">disrupted the operation<\/a> of a blast furnace on a steel mill in Germany.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Black Hat and DEF CON: Hacking a chemical plant \u2013 <a href=\"https:\/\/t.co\/KSnCTtLt5U\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/KSnCTtLt5U<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/634086251205926913?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">August 19, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Overall, the security of industrial control systems leaves much to be desired. Kaspersky Lab has repeatedly issued warnings about these risks, but naysayers usually parried: Tell us about <em>real<\/em> cases where these vulnerabilities were <em>actually<\/em> exploited. Unfortunately, we can now do that.<\/p>\n<p>Of course, one person alone can do little to solve a systemic problem: Industrial equipment cannot be changed in a day or even a year. However, as we\u2019ve already said, the most crucial cybersecurity defense is knowledge. The more people aware of this problem, the greater the chance that critical industrial infrastructure will be patched before anything really, really bad happens.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Kaspersky Lab experts checked industrial control systems for vulnerabilities and found lots of them.<\/p>\n","protected":false},"author":696,"featured_media":7436,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2026],"tags":[],"class_list":{"0":"post-7435","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats"},"hreflang":[{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/industrial-vulnerabilities\/7435\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/industrial-vulnerabilities\/7410\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/industrial-vulnerabilities\/7392\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/industrial-vulnerabilities\/8724\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/industrial-vulnerabilities\/8624\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/industrial-vulnerabilities\/12466\/"},{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/industrial-vulnerabilities\/2257\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/industrial-vulnerabilities\/12596\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/industrial-vulnerabilities\/6418\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/industrial-vulnerabilities\/5130\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/industrial-vulnerabilities\/8187\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/industrial-vulnerabilities\/12466\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/industrial-vulnerabilities\/12596\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/industrial-vulnerabilities\/12596\/"}],"acf":[],"banners":"","maintag":[],"_links":{"self":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/7435","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/users\/696"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=7435"}],"version-history":[{"count":3,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/7435\/revisions"}],"predecessor-version":[{"id":19297,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/7435\/revisions\/19297"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/media\/7436"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=7435"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=7435"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=7435"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}