Vulnerabilities / Threats
5/24/2011
02:29 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Researcher Challenges Siemens' Public Reaction To New SCADA Flaws

Initial solution suggested by Siemens to remedy the critical vulnerabilities failed.

A researcher who late last week pulled his planned public presentation on some newly discovered and deadly SCADA bugs contends that Siemens is unfairly attempting to publicly downplay the flaws and the nature of their exploitability.

Dillon Beresford, a researcher with NSS Labs, canceled his talk at TakedownCon 2011 in Dallas at the eleventh hour due to concerns about the contents' possible risk to human life. He had planned to reveal vulnerabilities and proof-of-concept (PoC) exploit code for flaws in Siemens SCADA industrial-control systems products.

Details of the research and on the bugs themselves are being closely held by Beresford, his colleagues, ICS-CERT, and Siemens, but the description of the so-called "Chain Reactions--Hacking SCADA" presentation certainly raised alarm and interest: "Combining traditional exploits with industrial control systems allows attackers to weaponize malicious code, as demonstrated with Stuxnet. The attacks against Iran's nuclear facilities were started by a sequence of events that delayed the proliferation of nuclear weapons.

"We will demonstrate how motivated attackers could penetrate even the most heavily fortified facilities in the world, without the backing of a nation state," the description continues. "We will also present how to write industrial grade malware without having direct access to the target hardware. After all, if physical access was required, what would be the point of hacking into an industrial control system?"

In posts to the SCADASec security mailing list today, Beresford noted that while he is free to give his presentation at any time, he'll wait until it's safe to do so given the potential ramifications. He said in a post today that "until the products are fixed and the patches have been carefully validated the presentation will remain out of the public domain. As for a definitive timetable on patches, who knows..."

Beresford and NSS Labs had been collaborating as of last week with Siemens and ICS-CERT to come up with fixes for the flaws. But, according to NSS Labs, the fixes Siemens came up with didn't do the job.

Meanwhile, Beresford has taken issue with a statement Siemens issued that says the bugs were found "under special laboratory conditions with unlimited access to protocols and controllers." The researcher contends that the bugs are not difficult to exploit: "I put the code into a series of Metasploit auxiliary modules, the same ones supplied to ICS-CERT and Siemens. For the explicit purpose of helping ICS-CERT and Siemens CERT in validating the vulnerabilities and the IMPACT of these vulns. These modules were going to be demonstrated during my presentation, not released until patches went out, but demonstrated for the 300 people who flew into Dallas, TX to see my presentation," Beresford said in a post today.

He says the "security feature" suggested by Siemens to remedy the vulnerabilities failed because he was able to bypass it within 45 minutes. Beresford says he notified the vendor and ICS-CERT of that finding. "I knew the feature was flawed from the moment they proposed the solution and explained it to me, because I broke much more than the PLCs," he said. The researcher used real controllers in his research, he said.



Read the rest of this article on Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3966
Published: 2015-08-30
The IPsec SA establishment process on Innominate mGuard devices with firmware 8.x before 8.1.7 allows remote authenticated users to cause a denial of service (VPN service restart) by leveraging a peer relationship to send a crafted configuration with compression.

CVE-2015-4555
Published: 2015-08-30
Buffer overflow in the HTTP administrative interface in TIBCO Rendezvous before 8.4.4, Rendezvous Network Server before 1.1.1, Substation ES before 2.9.0, and Messaging Appliance before 8.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vect...

CVE-2015-5698
Published: 2015-08-30
Cross-site request forgery (CSRF) vulnerability in the web server on Siemens SIMATIC S7-1200 CPU devices with firmware before 4.1.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2015-4497
Published: 2015-08-29
Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token...

CVE-2015-4498
Published: 2015-08-29
The add-on installation feature in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to bypass an intended user-confirmation requirement by constructing a crafted data: URL and triggering navigation to an arbitrary http: or https: URL at a certain early point i...

Dark Reading Radio
Archived Dark Reading Radio
Another Black Hat is in the books and Dark Reading was there. Join the editors as they share their top stories, biggest lessons, and best conversations from the premier security conference.