Is cracking really important systems possible?

Question

We always hear about "hacking" (or cracking) banks, websites or the like. Nothing really "important" like centrals, or even satellites (like TV channels). Those we only see in movies - but are they possible? Could one crack a TV satellite, or something like that? Or is it really impossible/too secure?

If it is possible though, what skills would be needed to do it? I'm sure it doesn't take just nmap and SQL injections to enter that kind of network, does it?

I heard those kind of infrastructures relied on SCADA systems and needed special programming to be exploited: what programming languages would be needed then?

Thanks.

Answer 1

What about RSA? They SHOULD be one of the most secure Digital Fortresses on the planet, but hackers got in with an email. Same with the US Dept. of Energy.

Sometimes attacking something directly is just too costly or time consuming. As Sun Tzu says, "Victory is more important than winning battles."

If you want to show superiority in skill over your target, then you have to be more skilled. Critical systems as you mention raise the bar on being able to defeat them, so a simple SQL Injection may or may not be successful (but that's why we do penetration testing: so see where the bar is set).

If you want to be victorious, then you need to transcend your target to see a wider battlefield. Then, a simple email can open all doors.

Answer 2

I recall an old joke that went something like this: the only secure system is one that is inaccessible to anyone.

With that said, any system is subject to some level of compromise. If a target system is connected to a larger network, that increases the threat surface. There are some systems that require physical access (i.e. no network connectivity). Even those systems are subject to mission impossible-style physical access attempts.

No single programming language will help you learn or exploit complex systems, SCADA or otherwise. If you're really interested in learning, learn all you can about everything - from programming languages to operating systems to networking protocols to cpu/memory architecture. It's a high barrier to entry.

Answer 3

This is very vague. Is it possible? Most definitely, yes if proper precautions aren't met or if privileged users can be socially engineered or forced into giving up authentication details.

Is it easy? It shouldn't be. Nmap/SQL injections would only work if the controlling device is internet connected to a public web interface, which they shouldn't be. At a minimum you should have to go through say a VPN before getting to something that controls critical resources. (Not to say VPNs don't have zero day vulnerabilities; or users don't reuse passwords/leave keys lying around).

Granted if its a satelite that receives commands via radio, you could possibly build your own antenna, send bogus commands, etc. But likely commands are encrypted, kept secure, and use timestamps/nonces/sequence numbers in the encrypted message (no replay attacks).