What a crane in the ass: Bug leaves construction machinery vulnerable to evil command injection

US-CERT is advising some customers of Telecrane construction cranes to patch their control systems – following the disclosure of a security bug that could allow a nearby attacker to wirelessly hijack the equipment. The government security body this week issued an alert on CVE-2018-17935, a vulnerability in the Telecrane F25 …

[Crazy Operations Guy]

Never should be remotely controllable in the first place

Heavy machinery, especially something that if mishandled can kill hundreds, is not something that should be fully-controlled by software. Especially since everyday I am constantly reminded that no matter how well made the software is, it will still screw up in new and interesting ways. And the fact that something like this, which require real-time communication and numerous fail safes, which TCP/IP over a 802.11 is entirely unsuitable for. Like what actions would the crane take if the network gets flooded and commands are being delayed or dropped? Like what if the crane was last commanded to rotate but the command to stop is lost? What if there is a delay and the operator repeats a command, does the crane do it twice or should it assume the operator only sent two under the assumption the first never made it?

I wouldn't have a problem if it had a human manually operating the controls but guided by software, at least then there is human doing the actual control work and can refuse to do dangerous operations. Like I can understand having a remote control unit that would allow someone o the ground direct the crane's actions, but that should really be instructions sent to a human operator. Like you'd have an assistant to the operator on the ground with a device that sends a video feed and to the operator and allows them to send preset commands that show up on the operator's control panel (Like green arrows of varying lengths for move a little to the right, move a lot to the left, lift the load a meter, lower a few centimeters, stop, etc.

[storner]

Re: Never should be remotely controllable in the first place

"Heavy machinery, especially something that if mishandled can kill hundreds, is not something that should be fully-controlled by software."

In that case, most commercial airplanes would have to stay on the ground.

[Anonymous Coward]

Re: Never should be remotely controllable in the first place

Its probably safer to control it via software than to rely on a person in many cases, especially for a fixed crane that can "know" its surroundings down to the millimeter if necessary.

[oldtaku]

Internet of Giant S@#$tty Stuff

"as a matter of practice, construction crews should be keeping their cranes and other Wi-Fi controlled equipment air-gapped on a separate, non-internet network with its own firewall. Basically, nobody but crews should even have access to the network, let alone the equipment itself .. if everyone is doing their jobs right a real-world exploit would be extremely difficult to pull off."

Ahahahahaha... ha... *sob* ｡ﾟ･（>﹏<）･ﾟ｡

Even hospitals don't bother securing their networks and critical equipment properly. The security hygiene I've seen at construction companies could be compared to going condomless in Haiti while suffering from open sores and lacerations, and then rolling around in a sewage ditch for good measure. Nobody is doing security right because that would cost money for a full time guy who knows what he's doing. And then they'd have to tell him when there was new equipment instead of just throwing something together with all the defaults.

[phuzz]

Re: Internet of Giant S@#$tty Stuff

If 'best practice' was the way people actually did things in the real world, it would just be called 'practice'.

If someone honestly thinks that a bunch of builders understand 'air-gapped' to mean anything other than "leave a gap between those brick Kev" then they'll be horrified if they ever looked at the real world.

[Will Godfrey]

It's just a matter of time

Manufacturers are still ignoring all the warnings. Will they even so much as blink when some real serious damage is done and large numbers of people are badly injured?

[Definitely Not Me]

These aren't WiFi controllers, they use radio. More like a remote control toy, just scaled up.

The whole separate network stuff is just boilerplate text.

[DropBear]

That was probably true for the first generation of remote controllable heavy machinery. These days though I'm wondering how much off-the-shelf wireless networking equipment they include if any...

[EnviableOne]

oooh just had an idea

Crane Ransomware - payup or we drop this load of steel on your head

[Keith Oborn]

Re: oooh just had an idea

Any of this kit used for remote handling in nuclear reactors?

[Rajesh Kanungo]

Airgap a wireless device?

Airgapping a wireless device is an oxymoron unless you have a Faraday cage surrounding the device.

[Rajesh Kanungo]

What is the penalty?

I have been in security for 20 years and I have come to the following realization:

People will not fix security issues unless there is a penalty (market share drop, people die, lawsuits, recalls, etc.). No one follows SDLC unless there is visible harm or a profit. Even GDPR is not a concern here.