{"id":12741,"date":"2016-08-08T09:03:03","date_gmt":"2016-08-08T13:03:03","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=12741"},"modified":"2019-11-15T06:54:44","modified_gmt":"2019-11-15T11:54:44","slug":"smart-cities-black-hat","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/smart-cities-black-hat\/12741\/","title":{"rendered":"Should we be more concerned about smart city tech?"},"content":{"rendered":"<p>Imagine someone shut down all of the traffic lights in New York City at 4 pm.<\/p>\n<p>That idea has been stuck in my head since Ryan Naraine mentioned it at a round table talk on securing smart cities at Black Hat.<\/p>\n<p>Although the conversation was held primarily among some very technical researchers, the idea of the traffic lights failing in one of the world\u2019s busiest cities was one that I could not shake. Nowadays, everything is connected online \u2014 your phone, TV, watch, fitness tracker, maybe even your front door. But did you know that our <a href=\"https:\/\/www.kaspersky.com\/blog\/traffic-light-attacks\/5830\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">traffic lights<\/a>, <a href=\"https:\/\/www.kaspersky.com\/blog\/train-hack\/10946\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">train systems<\/a>, and <a href=\"https:\/\/www.kaspersky.com\/blog\/air-conditioner-hack\/11348\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">power grid<\/a> are also online?<\/p>\n<p>It is actually quite scary to think about what could happen if one of the industrial systems that are vital to our everyday lives were to be turned off.<\/p>\n<p>Power?<br>\nTrains?<br>\nTraffic lights?<\/p>\n<p>Any of those three could be quite deadly if used improperly. But as with many things, security for smart cities is not where it needs to be.<\/p>\n<p>https:\/\/www.instagram.com\/p\/BIqLhaeA32B\/<\/p>\n<p>Bureaucratic red tape and development times for the systems mean security becomes an afterthought in many cases.<\/p>\n<p>The conversation surrounding this issue on the security end is equally annoying. It goes in circles within the security community \u2014 and doesn\u2019t go anywhere outside of the security world because average Joes don\u2019t think about it at all, although they should. <\/p>\n<p>When it comes to security, we often focus on the things that we personally use day to day: computers, mobile devices, fitness trackers, and so forth. But those items, as essential as they may feel, are really luxuries, not daily necessities. It\u2019s a huge pain when they get hacked, but they are not typically something that could, say, kill you.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Hacking electricity, water, and food <a href=\"https:\/\/t.co\/puKzqEPXTa\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/puKzqEPXTa<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/ICS?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#ICS<\/a> <a href=\"https:\/\/t.co\/L4ibbptbXM\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/L4ibbptbXM<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/753945798321246208?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">July 15, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>During our <a href=\"https:\/\/www.kaspersky.com\/blog\/6-best-questions-to-our-great-and-their-answers\/12705\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">AMA<\/a> a few weeks back, one questioner asked: <em>I was wondering if you had any predictions with regards to when we will start seeing mass casualties and perhaps even death from hacking into ICS [industrial control systems]? Is it possible now? Following from the German steel mill attack, the Black Energy malware, and the Swedish air traffic control attack it feels like we\u2019re on the brink of something but not quite there yet.<\/em><\/p>\n<p>Brian Bartholomew answered: <em>Great question and a tough one to ask to the experts. In my opinion, it\u2019s a matter of time before someone, somewhere decides to cross that line and cause casualties. If you look at all the critical systems that are still unsecured and vulnerable to attacks, all it would take is one crazy person and a general understanding of how ICS works to inflict damage to the masses.<\/em><\/p>\n<p>This is why securing ICS should be the number 1 thing policy makers and other experts in the field should be focusing on right now. We need more voices like yours out there asking these tough questions to the appropriate people. Regarding who does it\u2026 well, again in my opinion, no one is doing it \u201cwell.\u201d Well<em> isn\u2019t good enough. It needs to be impenetrable, and right now, that\u2019s not the case. This isn\u2019t a mythological unicorn any longer. It\u2019s been done before and will only get worse.<\/em><\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Black Hat and DEF CON: Hacking a chemical plant \u2013 <a href=\"https:\/\/t.co\/KSnCTtLt5U\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/KSnCTtLt5U<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/634086251205926913?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">August 19, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Vitaly Kamluk answered: <em>Honestly, I don\u2019t want to think about it. Last time I thought about the possibility of malware crossing the border between virtual and physical worlds to destroy a physical object, Stuxnet happened just the next month. I was thinking only about \u201cwhy so soon?\u201d back then. I feel same strange feeling every time I hear about sudden disasters such as crashed planes, derailed trains, etc.<\/em><\/p>\n<p>A security researcher widely known as halvarflake<em> said earlier this year (reconstructed from my memory): \u201cPhysical objects can be owned and\/or possessed by you. Computer systems have an additional dimension, which is control: You may own a computer, possess a computer, but with current systems design you can never be sure who is in control.\u201d<\/em><\/p>\n<p>This is what wakes me up at night, because this illusion of control we have over computer systems opens infinite possibilities to create tragedies by people who use their power against others.<\/p>\n<p>So, what can be done about this troubling issue?<\/p>\n<p>For starters, as global citizens, we can \u2014 and must \u2014 pay attention to what our elected officials are doing to keep us safe.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Before <a href=\"https:\/\/twitter.com\/hashtag\/Stuxnet?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Stuxnet<\/a>, there was little thought about proactively securing industrial facilities <a href=\"https:\/\/t.co\/2r3pXlbf7Z\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/2r3pXlbf7Z<\/a> <a href=\"http:\/\/t.co\/vvj9ChCHAb\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/vvj9ChCHAb<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/534775738558578688?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">November 18, 2014<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Education and awareness are vital. This conversation needs to grow beyond the security realm and hit the prime time news. A hack of these very sensitive systems could be nothing less than disastrous. It really is something that we should be focusing on more than, say, a celebrity scandal or a dating site hack.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>How concerned should we be with industrial security?<\/p>\n","protected":false},"author":636,"featured_media":12742,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,2683],"tags":[770,1758,1713,1712,1757,1586],"class_list":{"0":"post-12741","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"category-threats","9":"tag-black-hat","10":"tag-hacking-the-power-grid","11":"tag-ics","12":"tag-industrial-control-systems","13":"tag-industrial-hacking","14":"tag-ryan-naraine"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/smart-cities-black-hat\/12741\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/smart-cities-black-hat\/7493\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/smart-cities-black-hat\/7517\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/smart-cities-black-hat\/7483\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/smart-cities-black-hat\/8905\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/smart-cities-black-hat\/8748\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/smart-cities-black-hat\/12707\/"},{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/smart-cities-black-hat\/2338\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/smart-cities-black-hat\/5967\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/smart-cities-black-hat\/6469\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/smart-cities-black-hat\/5273\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/smart-cities-black-hat\/8413\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/smart-cities-black-hat\/12250\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/smart-cities-black-hat\/12707\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/smart-cities-black-hat\/12741\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/smart-cities-black-hat\/12741\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/black-hat\/","name":"black hat"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/12741","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/636"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=12741"}],"version-history":[{"count":2,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/12741\/revisions"}],"predecessor-version":[{"id":30193,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/12741\/revisions\/30193"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/12742"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=12741"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=12741"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=12741"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}