Most hacks steal or expose delicate information, but a subset or rarer and potentially more serious hacks go further and do actual physical damage. The most famous of these sophisticated cyberattacks are presumed to be state-sponsored affairs, but they don't necessarily have to be. As one security researcher has discovered, there is a terrible vulnerability that's just waiting to be exploited.
Reid Wightman, a security researcher with Digital Bond Labs, found the exploit which pertains to industrial motor drives produced by a number of manufacturers, vital components in all kinds of air circulation systems and water pumps. As Wired explains, these drives require basically no authentication to modify their settings which means that any hacker who can reach out through cyberspace and find one can change its settings with relative ease. Worse, these drives also broadcast their maximum safe speed, giving hackers a perfect chance to ask them their speed limit, and then command them to exceed it.
Causing a motor to run at or above critical speed can do considerable damage. The vibrations could destroy bearings and the motor shaft. "It's an easy thing to attack, but it would be hard to figure out what went wrong with the motor, if it was a manufacturing defect or bad luck that caused the motor to fail," Wightman added.
If that reminds you of something, it should. This is similar to how the famous state-sponsored malware Stuxnet worked. Granted, these sorts of motors aren't usually connected to the internet at large, which makes them slight difficult to access, but if a hacker can break into a plant's private network, there's not much challenge from there.
It's a scary prospect, especially considering that a recent incident in Ukraine marks the first cyberattack that's resulted in a power outage. It's unclear if that attack also involved physical damage, but it's easy to see how the two could go hand in hand.
Wightman didn't notify the affected manufacturers about the vulnerability before going public, citing the difficulty of fixing the issue, and the degree to which it is baked into the very essence of the motor drives' software. "What are they going to do about it? They designed it to work this way. ... They know what they're doing,"he toldWired. As for what hackers will do about it, that's easier to guess.