Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/24/2011
02:29 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Researcher Challenges Siemens' Public Reaction To New SCADA Flaws

Initial solution suggested by Siemens to remedy the critical vulnerabilities failed.

A researcher who late last week pulled his planned public presentation on some newly discovered and deadly SCADA bugs contends that Siemens is unfairly attempting to publicly downplay the flaws and the nature of their exploitability.

Dillon Beresford, a researcher with NSS Labs, canceled his talk at TakedownCon 2011 in Dallas at the eleventh hour due to concerns about the contents' possible risk to human life. He had planned to reveal vulnerabilities and proof-of-concept (PoC) exploit code for flaws in Siemens SCADA industrial-control systems products.

Details of the research and on the bugs themselves are being closely held by Beresford, his colleagues, ICS-CERT, and Siemens, but the description of the so-called "Chain Reactions--Hacking SCADA" presentation certainly raised alarm and interest: "Combining traditional exploits with industrial control systems allows attackers to weaponize malicious code, as demonstrated with Stuxnet. The attacks against Iran's nuclear facilities were started by a sequence of events that delayed the proliferation of nuclear weapons.

"We will demonstrate how motivated attackers could penetrate even the most heavily fortified facilities in the world, without the backing of a nation state," the description continues. "We will also present how to write industrial grade malware without having direct access to the target hardware. After all, if physical access was required, what would be the point of hacking into an industrial control system?"

In posts to the SCADASec security mailing list today, Beresford noted that while he is free to give his presentation at any time, he'll wait until it's safe to do so given the potential ramifications. He said in a post today that "until the products are fixed and the patches have been carefully validated the presentation will remain out of the public domain. As for a definitive timetable on patches, who knows..."

Beresford and NSS Labs had been collaborating as of last week with Siemens and ICS-CERT to come up with fixes for the flaws. But, according to NSS Labs, the fixes Siemens came up with didn't do the job.

Meanwhile, Beresford has taken issue with a statement Siemens issued that says the bugs were found "under special laboratory conditions with unlimited access to protocols and controllers." The researcher contends that the bugs are not difficult to exploit: "I put the code into a series of Metasploit auxiliary modules, the same ones supplied to ICS-CERT and Siemens. For the explicit purpose of helping ICS-CERT and Siemens CERT in validating the vulnerabilities and the IMPACT of these vulns. These modules were going to be demonstrated during my presentation, not released until patches went out, but demonstrated for the 300 people who flew into Dallas, TX to see my presentation," Beresford said in a post today.

He says the "security feature" suggested by Siemens to remedy the vulnerabilities failed because he was able to bypass it within 45 minutes. Beresford says he notified the vendor and ICS-CERT of that finding. "I knew the feature was flawed from the moment they proposed the solution and explained it to me, because I broke much more than the PLCs," he said. The researcher used real controllers in his research, he said.



Read the rest of this article on Dark Reading.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
For Cybersecurity to Be Proactive, Terrains Must Be Mapped
Craig Harber, Chief Technology Officer at Fidelis Cybersecurity,  10/8/2019
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17593
PUBLISHED: 2019-10-14
JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator.
CVE-2019-17594
PUBLISHED: 2019-10-14
There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
CVE-2019-17595
PUBLISHED: 2019-10-14
There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
CVE-2019-14823
PUBLISHED: 2019-10-14
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to...
CVE-2019-17592
PUBLISHED: 2019-10-14
The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The __isInt() function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option.