FFS

[vetran]

Serial killer hack threat to gas pipes, traffic lights, power plants ? The Register

Analysis Medical systems to traffic light boxes are apparently wide open to hackers thanks to a lack of authentication checks in equipment exposed to the internet.

That's according to research from security toolmaker Rapid7, which says it found plenty of systems that can be freely remotely controlled via public-facing serial port servers.

[VectraMan]

I did a small project to replace some industrial control software that used RS232, with TCP/IP over ethernet. And it wasn't a router sized box as that Reg article suggests, but an RJ45 socket sized box soldered directly to the board.

That just connected a TCP or UDP connection direct to RS232 - i.e. bytes in, bytes out, with no kind of authentication whatsoever. Of course I did bring up the question of security, but nobody thought it would be an issue. So somebody a bit careless connecting one of those machines to an unprotected LAN, and yes it could be controlled from the other side of the world. Which would be cool, if not really what the customer would want.

[vetran]

saw it 20 years ago with event logging, that was output only but still valuable security information.

[doodab]

We used to have terminal server boxes that connected 8 serial lines to ip so we could access stuff via telnet, but we bought the serial lines into the building and the boxes were under a desk.

[xoggoth]

Cool. Any way to tap into a central heating system and make it set fire to a neighbour's house? Or maybe he could be attacked by his dishwasher?

PS Or how about a hidden box wired to the engine control system on his truck? Could I make it drive off a cliff? We've got a cliff by the road here, only about 30 foot drop, but probably enough.