“OPC UA is used everywhere in the industrial world as a connector between systems,” says Keuper. “It’s a central component of typical industrial networks, and we can bypass the authentication that is often required to read or change anything. That’s why people find it the most important and interesting. Only took a few days to find. “
The 2012 iPhone hack took place three weeks of concentrated work. In contrast, the OPC UA hack was a side project, a distraction from the day-to-day work of Keuper and Alkemade. But its impact is too great.
There’s a huge difference between the consequences of hacking an iPhone and hacking into critical infrastructure software. An iPhone can be easily updated, and a new phone is always near you.
In contrast, in critical infrastructure, some systems can last decades. Some known security flaws cannot be fixed. Operators are often unable to update their technology for security fixes because it is unnecessary to take the system offline. It’s not as easy to turn a factory on and off as a light switch — or as a laptop computer.
“In industrial control systems, the playing field is completely different,” says Keuper. “You have to think differently about security. You need different solutions. We need game changers.”
Despite their success this week, Keuper and Alkemade were under no illusions that industrial security issues were immediately resolved. But for these two, it’s a good start.
“I do research in the public interest to make the world a little bit safer,” says Alkemade, “We do things that get a lot of attention so people listen to us. It’s not about money. It’s excitement and to prove what we can do. ”
“Hopefully we’ve made the world a safer place,” Keuper said.
Meanwhile, Pwn2Own contests are in full swing, raking in $2 million last year. Next month, hackers will gather in Vancouver to celebrate the program’s 15th anniversary. One of the goals? A Tesla car.
