Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Businesses Security Technology

Norsk Hydro, One of the World's Largest Aluminum Producers, Switches To Manual Operations After Ransomware Infection (zdnet.com) 76

Posted by msmash from the growing-tension dept.
Norsk Hydro, one of the world's largest aluminum producers, said today it has "became victim of an extensive cyber-attack" that has crippled some of its infrastructure and forced it to switch to manual operations in some smelting locations. From a report: The cyber-attack was later identified as an infection with the LockerGoga ransomware strain, the company said during a press conference. News of the cyber-attack broke earlier this morning in a message the company sent to investors and stock exchanges. "Hydro became victim of an extensive cyber-attack in the early hours of Tuesday (CET), impacting operations in several of the company's business areas," the company said. "IT-systems in most business areas are impacted and Hydro is switching to manual operations as far as possible."
This discussion has been archived. No new comments can be posted.

Norsk Hydro, One of the World's Largest Aluminum Producers, Switches To Manual Operations After Ransomware Infection More

Norsk Hydro, One of the World's Largest Aluminum Producers, Switches To Manual Operations After Ransomware Infection

Comments Filter:

  • Install vector? (Score:4, Informative)

    by The-Ixian ( 168184 ) on Tuesday March 19, 2019 @11:22AM (#58298618)

    The company said the ransomware was planted on its network in late Monday evening

    More like an employee who wasn't trained in identifying malicious e-mails got phished....

    This is why, in addition to training, all Internet connected computers need to be behind proxies that don't allow executable downloads and application whitelisting should be enabled on the endpoints. There is just no other way to operate these days.

    • Re: (Score:3, Interesting)

      by geoscodin ( 886628 )
      Sadly, I've worked places where we got training every year and people still fell for test emails and flash drives left around the parking lot. The "It'll never happen to me" belief is strong in people, even after it happens to them.

      • Re:Install vector? (Score:5, Interesting)

        by smooth wombat ( 796938 ) on Tuesday March 19, 2019 @12:00PM (#58298866) Journal

        Within the last hour I've received a few emails from our overarching IT group indicating some people have clicked a link in a fake email going around. One of the user's accounts has been disabled.

        Like you, we all receive yearly training on what type of emails not to open or click links in yet people still do it.

        Here's the best part. This email was quarantined by default (Microsoft Exchange) and the user still went ahead and released it so they could read it.

        • Re: (Score:3)

          by dargaud ( 518470 )
          At my (government) workplace, once a year, we send a fake email from a very fishy-sounding source, with a fishy-sounding executable to download to obtain fake internet postcards or stupid shit like that. People who fall for it are terminated, or if they are up the food chain (as is unfortunately often the case), they get a very strong put down by IT and their bosses, and their computers get monitored even more closely.

          • or if they are up the food chain ... they get a very strong put down by IT

            Well obviously. I'm the CEO, *I* didn't click that button. That's why I have a secretary who prints out all of my emails for me. I even have her print it double-sided just to save paper!

      • The "It'll never happen to me" belief is strong in people, even after it happens to them.

        What are you talking about?? That's what the IT people are for. I just click the button to see the risque pictures. Last time I did, the IT people had to clean up a virus that got in somehow. When it was all over I clicked it again because I didn't see the pictures the first time. For some reason they were really mad that time.

    • In addition FSRM should be setup to monitor all shares for known crypto extensions (there are api calls to get a list of all of them) and when a computer is detected creating one of those files it should be immediately banned from the network.

    • Comment removed based on user account deletion

      • Re:Install vector? (Score:4, Informative)

        by The-Ixian ( 168184 ) on Tuesday March 19, 2019 @02:57PM (#58300026)

        The problem is not so much message authenticity these days.

        The scammers have worked around DMARC by just using legit mail senders and legit web hosts/file sharing services like SharePoint.com, Google Drive, etc.

        So these days you get a message from a person you know who lost control of their e-mail account credentials. So the message passes SPF, DKIM and DMARC tests. The message contains a link to a legit file sharing site which passes blacklist link testing. The file hosted is a PDF which displays just fine in all modern web browsers because they all come packaged with a PDF reader. The PDF content emulates some kind of other legit service (docusign, etc) with a link to the actual, illegitimate, script-hosting malicious site.

        Everything is on the up-and-up as far as all the e-mail filters are concerned and the content is convincing enough or at least familiar enough for it not to raise alarm bells in most users.

  • IT is a cost center (Score:2, Informative)

    by Anonymous Coward

    ...until you realize that your profit centers rely on it.

  • Maybe develop control systems in Linux not Windows (Score:5, Insightful)

    by SuperKendall ( 25149 ) on Tuesday March 19, 2019 @11:28AM (#58298654)

    I have to wonder how many of these random malware infections of industrial machinery could be avoided by having all control systems running Linux.

    Sure they could still be targeted by a dedicated hacker but at least you wouldn't have general mass-market malware accidentally get in and shut you down.

    Maybe you could even use Wine to run existing control software and switch over today... I can't imagine the software they use is very sophisticated in terms of Windows API use.

    • Re:Maybe develop control systems in Linux not Wind (Score:5, Insightful)

      by charon69 ( 458608 ) on Tuesday March 19, 2019 @11:35AM (#58298714)

      In my experience, lots of factories are running Win95... maybe Win2000 if you're lucky.

      I know of PLC aggregation / communication software that literally only exists on Windows, simply because that's what many factories run.

      The reason for that is because the first big wave of making "smart factories" was in the late 90s.

      And factories, by and large, never replace anything unless it has been fully depreciated... and sometimes, not even then.

    • Using a mass-market OS (Windows) for industrial machinery is just as stupid as using a toothpick to open a food can : not the right tool.

      • On that note. I was in shock the one day at the supermarket when I walked by self checkout terminal that was not working. It had a windows XP screen up with the error message. This was in a major supermarket so I do not know if they were just acting as a dumb terminal with a secure server locally. But itscared the shit out of me when I seen that
      • When many of these systems were put in place there wasn't much in the way of alternatives. People forget, but Linux hasn't king for all that long. There was a time when the world was completely run by Unix dinosaurs, Windows and very niche and expensive OS's. Many things that never should have, ended up with Windows because it was affordable on the scale needed and finding developers familiar with the platform was cheap and easy.

    • Re:Maybe develop control systems in Linux not Wind (Score:5, Insightful)

      by weeboo0104 ( 644849 ) on Tuesday March 19, 2019 @12:05PM (#58298886) Journal

      Linux won't avoid this situation. The issue isn't OS, it's complacency.

      I knew someone who ran a Linux video server on a hardened Red Hat system to monitor security cameras. He never gave it a second thought until his NOC called him at 3am on a Sunday to tell him they had pulled the network cable to his server because it was launching portscans against the rest of their network.

      He did the post-mortem on the server and found the attacker got in through an old SSL vulnerability. He said it was a wake up call. Just because you are running Linux with non-essential services disabled, it's meaningless if you aren't applying security updates.

      • Don't be ridiculous. Linux has the magic many eyes security system that means there are no security flaws. Anyone saying otherwise must be a Microsoft shill.

    • it may not be sophisticated, but my guess is that their PCs have special hardware components and drivers to run their production equipment that are not available in WINE or linux or even Win7.

      These boxes should have been on sneakernet, it's really the only solution for something this important yet this vulnerable.

    • Re: (Score:2)

      by tlhIngan ( 30335 )

      I have to wonder how many of these random malware infections of industrial machinery could be avoided by having all control systems running Linux.

      Sure they could still be targeted by a dedicated hacker but at least you wouldn't have general mass-market malware accidentally get in and shut you down.

      Maybe you could even use Wine to run existing control software and switch over today... I can't imagine the software they use is very sophisticated in terms of Windows API use.

      Linux wouldn't improve matters - OK i

    • Re: (Score:3)

      by dargaud ( 518470 )

      I have to wonder how many of these random malware infections of industrial machinery could be avoided by having all control systems running Linux

      My take on that is "all of them". I develop, install and maintain industrial control systems and I've refused to install anything on Windows since the early 2000. Most control/command or data acquisition software can be modified and recompiled for Linux (contact me if you want some quote!). Install a limited and ugly distro so users won't want to play games on it, tighten up the security, don't give the root password, don't put it on the 'Net without a double passworded firewall and you are good to go. Neve

  • SCADA (Score:3)

    by Virtucon ( 127420 ) on Tuesday March 19, 2019 @11:32AM (#58298674)

    Lack of Air gaps?
    USB thumb drive attack?
    Dumb management control system design?

    n a subsequent update posted on the company's Facebook page, Norsk Hydro said the cyber-attack did not impact "people safety" and that smelting plants across its vast international network were "running normally on isolated IT systems," although in a manual mode, without the aid of its computer controlled systems.

    This ought to be really interesting.

  • The Russians did't like their production of heavy water for the German nuclear bomb program... oops, wrong century... :)
  • Yeah, I know full well this point of view will be seen as flamebait, but I think the point merits a valid discussion.
  • What is the point of connecting these to the internet. Wouldn't this best be done on its own separate network that doesn't have that?

  • I've been saying this since the 1990s (Score:3)

    by Solandri ( 704621 ) on Tuesday March 19, 2019 @12:57PM (#58299224)
    Hard drives (SSDs nowadays) need a physical write lock switch. Once you set up a system so that it works like you want, you flip the switch and nothing can change it without physically flipping the switch back. OSes would need to be written so that things like log files and temporary files get written to a different drive which is write-enabled. But it would be impossible for malware to modify the core OS and programs, unless they tricked someone into flipping the physical switch. Which you can prevent by putting it behind a lock and making sure only IT has the key.

    Instead we get Windows 10 with its forced automatic updates, which breaks the cardinal rule of business equipment - "If it ain't broke, don't fix it."
    • It's a good idea, but I think it would be very hard to run a modern OS (Linux included) on a read-only filesystem. It would be worth a google, but I haven't read anything about it for a looong time. I DO run RO Linux on embedded controllers, on flash memory, but the central control/command PC is a standard, albeit hardened, Linux PC. Source: I work in nuclear research.

      And even a RO OS can be hacked: they find the user/passwd, they do login, install their botnet, run it until you notice (I have uptimes of YEARS), and when you reboot OK it's gone, but you've still been hacked. Airgap is the only real way to go. Multiple successive (and different) external firewalls is an acceptable alternative.

    • I think you just described SELinux...

    • Boot from a CD/DVD?

  • Welcome to the promised age of IoT! No, there is no free lunch. Please pay your monthly ransom on time.

  • Comment removed based on user account deletion

  • Why is there not a real air gap between the Intertoobs and Norsk Hydro? Same can be said about infrastructure like power gen and grid controls, and numerous other big things that could suffer massive damage from some anus or state actor.
    Sure, I get that, for example, in power generation, it makes the job of coordinating the systems over a wider area substantially easier. They have to control how much power they add to the regional grid, keep the output freq ~60Hz, etc. Of course, they did t

Slashdot Top Deals

People who go to conferences are the ones who shouldn't.

Close