Fortunately for most of us, Stuxnet was targeted at specific systems for a specific purpose in a specific place, but it infected systems all over the world, and if it had been less finely tuned it could have caused more damage. The PLC systems that run everything around the world appear to be so vulnerable that someone just looking to cause mischief can cause real damage and injury, let alone a rogue nation looking for trouble. I am actually surprised that these vulnerabilities haven't been exploited already; they have obviously been extant for many years ...
Fearing Destruction, Researcher Cancels Disclosure of New Siemens SCADA Holes |
A security researcher has discovered multiple security vulnerabilities in Siemens industrial control systems that he says would allow hackers with remote access to the systems to cause physical destruction. |
Dillon Beresford canceled a planned demonstration of the vulnerabilities on Wednesday at the Takedown security conference in Texas after Siemens and the Department of Homeland Security expressed concern over the phone and at the conference about disclosing information before Siemens could patch the vulnerabilities. |
The vulnerabilities affect the programmable logic controllers in several Siemens SCADA systems. Siemens PLC products are used in companies throughout the U.S. and the world controlling everything from critical infrastructure systems such as nuclear power and enrichment plants to commercial manufacturing facilities. It was a vulnerability in a PLC belonging to Siemens’ Step7 control system that was the target of the sophisticated Stuxnet worm. Stuxnet was discovered on systems in Iran last year and is believed to have been designed by a nation state aimed at destroying uranium enrichment centrifuges at the Natanz nuclear facility in Iran. |
Beresford wouldn’t say how many vulnerabilities he found in the Siemens products but said he gave the company four exploit modules to test. He believes that at least one of the vulnerabilities he found affects multiple SCADA system vendors, which share “commonality” in their products. Beresford wouldn’t reveal more details but says he hopes to do so once Siemens releases a statement, which he says the company is preparing for Thursday. |
Beresford contacted ICS-CERT to disclose the vulnerabilities. ICS-CERT (Industrial Control Systems Cyber Emergency Response Team) is a computer security group that the Department of Homeland Security operates in partnership with Idaho National Laboratory. The group researches vulnerabilities in industrial control systems and helps alert vendors and customers about security holes in products. |
ICS-CERT contacted Siemens, based in Germany, and the company began to work on patches for the vulnerabilities. Both Siemens and ICS-CERT had been fine with Beresford’s initial decision to talk about the vulnerabilities at the conference but changed their mind once they saw his presentation. |
Siemens was still working on patches but had found a remediation for one of the vulnerabilities. But Beresford found he was easily able to get around it. |
Once Siemens saw in his presentation that their mitigation didn’t work, the company realized it had to go back to the lab and reassess how to address the vulnerability, Beresford said. |
“This is different from simply stealing money out of someone’s bank account,” said NSS Labs CEO Rick Moy. “Things could explode. I don’t want to overplay this and sound like it’s a bunch of FUD but physical damage can occur and people can be seriously injured or worse. So we felt … it was best to be prudent and wait a little bit longer until we get more information.” Read more at www.wired.com |