Vulnerabilities / Threats
5/24/2011
02:29 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Researcher Challenges Siemens' Public Reaction To New SCADA Flaws

Initial solution suggested by Siemens to remedy the critical vulnerabilities failed.

A researcher who late last week pulled his planned public presentation on some newly discovered and deadly SCADA bugs contends that Siemens is unfairly attempting to publicly downplay the flaws and the nature of their exploitability.

Dillon Beresford, a researcher with NSS Labs, canceled his talk at TakedownCon 2011 in Dallas at the eleventh hour due to concerns about the contents' possible risk to human life. He had planned to reveal vulnerabilities and proof-of-concept (PoC) exploit code for flaws in Siemens SCADA industrial-control systems products.

Details of the research and on the bugs themselves are being closely held by Beresford, his colleagues, ICS-CERT, and Siemens, but the description of the so-called "Chain Reactions--Hacking SCADA" presentation certainly raised alarm and interest: "Combining traditional exploits with industrial control systems allows attackers to weaponize malicious code, as demonstrated with Stuxnet. The attacks against Iran's nuclear facilities were started by a sequence of events that delayed the proliferation of nuclear weapons.

"We will demonstrate how motivated attackers could penetrate even the most heavily fortified facilities in the world, without the backing of a nation state," the description continues. "We will also present how to write industrial grade malware without having direct access to the target hardware. After all, if physical access was required, what would be the point of hacking into an industrial control system?"

In posts to the SCADASec security mailing list today, Beresford noted that while he is free to give his presentation at any time, he'll wait until it's safe to do so given the potential ramifications. He said in a post today that "until the products are fixed and the patches have been carefully validated the presentation will remain out of the public domain. As for a definitive timetable on patches, who knows..."

Beresford and NSS Labs had been collaborating as of last week with Siemens and ICS-CERT to come up with fixes for the flaws. But, according to NSS Labs, the fixes Siemens came up with didn't do the job.

Meanwhile, Beresford has taken issue with a statement Siemens issued that says the bugs were found "under special laboratory conditions with unlimited access to protocols and controllers." The researcher contends that the bugs are not difficult to exploit: "I put the code into a series of Metasploit auxiliary modules, the same ones supplied to ICS-CERT and Siemens. For the explicit purpose of helping ICS-CERT and Siemens CERT in validating the vulnerabilities and the IMPACT of these vulns. These modules were going to be demonstrated during my presentation, not released until patches went out, but demonstrated for the 300 people who flew into Dallas, TX to see my presentation," Beresford said in a post today.

He says the "security feature" suggested by Siemens to remedy the vulnerabilities failed because he was able to bypass it within 45 minutes. Beresford says he notified the vendor and ICS-CERT of that finding. "I knew the feature was flawed from the moment they proposed the solution and explained it to me, because I broke much more than the PLCs," he said. The researcher used real controllers in his research, he said.



Read the rest of this article on Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: nice post
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1750
Published: 2015-07-01
Open redirect vulnerability in nokia-mapsplaces.php in the Nokia Maps & Places plugin 1.6.6 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the href parameter to page/place.html. NOTE: this was originally reported as cross-sit...

CVE-2014-1836
Published: 2015-07-01
Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers to delete arbitrary files via a full pathname in the image_path parameter in a cancel action.

CVE-2015-0848
Published: 2015-07-01
Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.

CVE-2015-1330
Published: 2015-07-01
unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are enabled in the DPkg::Options::* apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vecto...

CVE-2015-1950
Published: 2015-07-01
IBM PowerVC Standard Edition 1.2.2.1 through 1.2.2.2 does not require authentication for access to the Python interpreter with nova credentials, which allows KVM guest OS users to discover certain PowerVC credentials and bypass intended access restrictions via unspecified Python code.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report