upvote

points

by sidewndr4617 hours ago |
comments
upvoteby peterabbitcook16 hours ago|
next
[-]
That’s a tough question. If your PLC is on an airgapped LAN, admin/admin is not great security hygiene but you’ve reduced most of the risk by airgapping.

On my project the service I wrote was doing bidirectional communication with the PLC over OPCUA. The server running this pod was connected to the internet, so it was critical to have proper TLS for the OPCUA client/server. Rotating LetsEncrypt certs on the system every 45 days is a lot of toil, but using a self-signed cert that expires in 2040 from some dev laptop doesn’t pass muster in most organizations either.

That’s just the OPCUA path.. In these projects You also typically see WinCC HMIs that can talk to the PLC from anywhere on the network without TLS. And also SIMATIC Web Server pages - minimally secured by default, and the amount of info you can grok about the system in Chrome Dev Tools is troubling.

reply
upvoteby gopher_space10 hours ago|
parent|
next
[-]
> admin/admin is not great security hygiene but you’ve reduced most of the risk by airgapping.

admin/admin is on a post-it stuck to the monitor because everyone we hire is perfectly capable of rooting a machine they have physical access to.

reply
upvoteby crote8 hours ago|
parent|
[-]
[dead]
reply
upvoteby detourdog7 hours ago|
parent|
prev|
next
[-]
Just my opinion but I believe a self-signed is more secure than Let’s encrypt. When a self-signed cert changes and no one in the org knows why that is alarming. Getting certificate error messages every month and half every numbs the org to the alarm.
reply
upvoteby sidewndr4612 hours ago|
parent|
prev|
next
[-]
I'm not sure if you're speaking from personal experience, but most I've interacted with don't have to worry about the self-signed vs. LetsEncrypt debate. They just don't do it. Also there would be no way to do LetsEncrypt as the system is air gapped.
reply
upvoteby bragr9 hours ago|
parent|
[-]
You can do DNS challenges for air gapped networks as long as the TXT records resolve publicly.
reply
upvoteby sidewndr468 hours ago|
parent|
[-]
So then you have a signed CSR right? How would you get the certificate onto the box?
reply
upvoteby dylan60412 hours ago|
parent|
prev|
[-]
> Rotating LetsEncrypt certs on the system every 45 days is a lot of toil

What is unique about your system using LetsEncrypt that you can't automate certbot to handle this task as it was designed and intended to be done?

reply
upvoteby gmueckl9 hours ago|
parent|
next
[-]
On an airgapped system that is is turned on once and needs to keep running for many, many years? Industrial equipment is a world of its own and internet best practices just don't transfer directly.

Some PLCs run extremely expensive machines. Some machines can't afford to have their control systems stutter or fail because that can lead to physical damage and production outages of enormous proportions. A PLC that stops communicating because a certificate just expired is absolutely not acceptable in some plants.

reply
upvoteby tgsovlerkhgsel5 hours ago|
parent|
prev|
[-]
Running certbot on your web server is easy.

Running certbot on a random PLC isn't happening.

reply
upvoteby tgsovlerkhgsel5 hours ago|
prev|
next
[-]
My guess would be something like the CA using some feature that was newer than what the equipment would support (e.g. ECC signatures but the equipment only supporting RSA), not an intentional "no real CAs" decision.
reply
upvoteby stephbook17 hours ago|
prev|
[-]
also you can't pin the user/pw to the machine with a note, because someone might need remote access. better stick with admin/admin
reply