Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/23/2011
03:46 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Researcher Challenges Siemens' Public Reaction To New SCADA Flaws

Initial solution suggested by Siemens to remedy the critical vulnerabilities failed

A researcher who late last week pulled his planned public presentation on some newly discovered and deadly SCADA bugs contends that Siemens is unfairly attempting to publicly downplay the flaws and the nature of their exploitability.

Dillon Beresford, a researcher with NSS Labs, canceled his talk at TakedownCon 2011 in Dallas at the eleventh hour due to concerns about the contents' possible risk to human life. He had planned to reveal vulnerabilities and proof-of-concept (PoC) exploit code for flaws in Siemens SCADA industrial-control systems products.

Details of the research and on the bugs themselves are being closely held by Beresford, his colleagues, ICS-CERT, and Siemens, but the description of the so-called "Chain Reactions—Hacking SCADA" presentation certainly raised alarm and interest: "Combining traditional exploits with industrial control systems allows attackers to weaponize malicious code, as demonstrated with Stuxnet. The attacks against Iran's nuclear facilities were started by a sequence of events that delayed the proliferation of nuclear weapons.

"We will demonstrate how motivated attackers could penetrate even the most heavily fortified facilities in the world, without the backing of a nation state," the description continues. "We will also present how to write industrial grade malware without having direct access to the target hardware. After all, if physical access was required, what would be the point of hacking into an industrial control system?"

In posts to the SCADASec security mailing list today, Beresford noted that while he is free to give his presentation at any time, he'll wait until it's safe to do so given the potential ramifications. He said in a post today that "until the products are fixed and the patches have been carefully validated the presentation will remain out of the public domain. As for a definitive timetable on patches, who knows..."

Beresford and NSS Labs had been collaborating as of last week with Siemens and ICS-CERT to come up with fixes for the flaws. But, according to NSS Labs, the fixes Siemens came up with didn't do the job.

Meanwhile, Beresford has taken issue with a statement Siemens issued that says the bugs were found "under special laboratory conditions with unlimited access to protocols and controllers." The researcher contends that the bugs are not difficult to exploit: "I put the code into a series of Metasploit auxiliary modules, the same ones supplied to ICS-CERT and Siemens. For the explicit purpose of helping ICS-CERT and Siemens CERT in validating the vulnerabilities and the IMPACT of these vulns. These modules were going to be demonstrated during my presentation, not released until patches went out, but demonstrated for the 300 people who flew into Dallas, TX to see my presentation," Beresford said in a post today.

He says the "security feature" suggested by Siemens to remedy the vulnerabilities failed because he was able to bypass it within 45 minutes. Beresford says he notified the vendor and ICS-CERT of that finding. "I knew the feature was flawed from the moment they proposed the solution and explained it to me, because I broke much more than the PLCs," he said. The researcher used real controllers in his research, he said.

Siemens had not responded to press inquiries as of this posting.

ICS-CERT and Siemens were provided with details of the vulnerabilities and PoC exploits, and that both ICS-CERT and Siemens confirmed the NSS Labs discovery, according to NSS Labs.

NSS Labs says there are mitigation techniques that ICS operators can deploy prior to any patches. "Due to the serious physical and financial impact these issues could have on a worldwide basis, details are only being made on a restricted basis. Owners/operators of leading SCADA PLCs may contact us for further information and remediation advice," the company said in a statement.

But Beresford is not happy with the way Siemens is handling things PR-wise in the wake of the decision to hold off on disclosing the bugs. "The clock is ticking and time is of the essence. I expect more from a company worth $80 billion and so do your customers," Beresford said in his post.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21392
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addre...
CVE-2021-21393
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identif...
CVE-2021-29429
PUBLISHED: 2021-04-12
In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote files accessed through TextResourceFactory are downloaded in...
CVE-2021-21394
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identif...
CVE-2021-22497
PUBLISHED: 2021-04-12
Advanced Authentication versions prior to 6.3 SP4 have a potential broken authentication due to improper session management issue.