12:37 PM

DHS, FBI Give SCADA System Vulnerability Warning

Hackers have infiltrated control system environments in at least three cities this year. Yet, many control systems remain Internet-connected and at risk of remote exploitation.

10 Companies Driving Mobile Security
10 Companies Driving Mobile Security
(click image for larger view and for slideshow)
Thousands of Internet-connected industrial control systems aren't being properly protected by firewalls or strong authentication, which leaves them at risk of being exploited by attackers.

That warning arrived last week, when the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) at the Department of Homeland Security (DHS) reissued a warning, first made last year, that Internet-connected industrial control systems could be discovered using search engines such as Shodan, which find devices with embedded and active Web servers.

"ICS-CERT is tracking and has responded to multiple reports of researchers using Shodan, Every Routable IP Project (ERIPP), Google, and other search engines to discover Internet facing control systems," according to the alert. "ICS-CERT has coordinated this information with the identified control system owners and operators to notify them of their potential vulnerability to cyber intrusion and attack."

[ Crime fighters have a lot of new weapons. Read How Digital Forensics Detects Insider Theft. ]

Control systems need not be Internet-connected, but when they are--typically for remote monitoring purposes--"all too often, remote access has been configured with direct Internet access (no firewall) and/or default or weak user names and passwords," said ICS-CERT.

ICS-CERT warned that security researchers aren't the only ones able to use Shodan and its ilk. "Hackers can use these tools to easily identify exposed control systems, posing an increased risk of attack," it said. "Conversely, owners and operators can also use these same tools to audit their assets for unsecured Internet facing devices." On a related note, ICS-CERT said that it's been working with control system vendors to remove default credentials from their products, especially since so many of these credentials are mentioned in publicly accessible materials.

Vulnerabilities in the supervisory control and data acquisition (SCADA) systems used to run manufacturing environments have been in the news lately, owing to the purported hack of an Illinois water treatment facility control system. The incident involved the burnout of a water pump, which state authorities traced to a Russian attacker. But after further review, federal authorities found that the system had been remotely accessed from Russia--legitimately--by a contractor who was there on vacation, and they dismissed the episode.

The Feds' initial downplaying of the attack--which turned out to not have been an attack--led a hacker known as "pr0f" to launch an actual exploit. In particular, pr0f released evidence that he'd hacked into the programmable logic controller at a water treatment facility in South Houston, Texas. He also told Threatpost that the Siemens Simatic human machine interface (HMI) software that he exploited had been protected with only a three-character password.

Despite the prevalence of poorly secured SCADA systems, how often do they get exploited? Last month, Michael Welch, the deputy assistant director of the FBI's Cyber Division, told a London conference that hackers had recently accessed control systems in multiple cities. According to Welch, "We just had a circumstance where we had three cities, one of them a major city within the U.S., where you had several hackers that had made their way into SCADA systems within the city," reported Information Age.

Update: A spokeswoman for the FBI has disputed the accuracy of the Information Age article, saying that the quotes attributed to Welch were both inaccurate and taken out of context.

Database access controls keep information out of the wrong hands. Limit who sees what to stop leaks--accidental and otherwise. Also in the new, all-digital Dark Reading supplement: Why user provisioning isn't as simple as it sounds. Download the supplement now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-12-24
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.

Published: 2014-12-24
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshak...

Published: 2014-12-24
drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not validate certain offset, length, and base values within an ioctl call, which allows attackers to gain privileges or c...

Published: 2014-12-24
Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3 through, 7.0.x through, 7.5.x through, 8.0.x before, and 8.5.x before allows remote authenticated users to inject arbitrary web script or HTML vi...

Published: 2014-12-24
The Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x through, 7.0.x through, 7.5.x through, 8.0.x before, and 8.5.x before does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.