SCADA flaws talk cancelled due to security fears
Posted on 19 May 2011.
Since the advent of the Stuxnet worm, SCADA industrial control systems have been receiving a lot of attention. You would expect that since these systems are those that control many critical infrastructure systems and are used in big manufacturing facilities, security would be the first thing on the minds of their developers.

But, it turns out that it's not so. In March, Italian researcher Luigi Auriemma revealed 34 vulnerabilities on various server-side SCADA software, along with a proof-of-concept for each of them.

According to him, most of them can be leveraged to execute a remote code execution on SCADA software-run machines with an Internet connection. Others allow attackers access to stored data, and in one case, to even interfere with the hardware that uses the software in question.

34 is a huge number, when you consider what these systems control. And now, news that another researcher has discovered a number of security flaw in Siemens SCADA systems, wanted to present his discovery at a security conference and in the end through better of it and cancelled his talk has hit the Internet.

According to Wired, NSS Labs researcher Dillon Beresford was scheduled to demonstrate the vulnerabilities he found after researching various Siemens SCADA systems for only two and a half months, but changed his mind after talking to the DHS and Siemens.

Instead, he shared some of the flaws with Siemens and the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). Siemens apparently managed to work out a remediation for one of the vulnerabilities, but it turns out that it is easily circumvented.

That must have been a final wake up call for the German company, and hopefully taught them that securing a system is not easy, and is a process that will require much more attention and effort that they are used to give it.

Rick Moy, NSS Labs CEO, supported Beresford's decision. "This is different from simply stealing money out of someoneís bank account. Things could explode. I donít want to overplay this and sound like itís a bunch of FUD but physical damage can occur and people can be seriously injured or worse. So we felt Ö it was best to be prudent and wait a little bit longer until we get more information,Ē he explained.






Spotlight

Targeted attack protection via network topology alteration

Posted on 17 October 2014.  |  This article from Trend Micro tackles how network topology can aid in defending the enterprise network from risks posed by targeted attacks.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Mon, Oct 20th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //