Feeds

Exploit broker releases EXPLICIT VIDS of holes in industrial control kit

Will only sell to 'trusted customers from reputable countries'

Using blade systems to cut costs and sharpen efficiencies

Malta-based security start-up ReVuln claims to have uncovered a raft of vulnerabilities in industrial control kit from many leading manufacturers.

ReVuln released a video depicting zero-day exploits against SCADA* equipment from Siemens, General Electric, Schneider Electric, ABB/Rockwell and others. The unpatched flaws are all server-side and remotely exploitable by hackers, according to ReVuln.

No technical details were provided, so the claims of unpatched security flaws can't be independently verified. Rather than reporting the flaws to vendors, ReVuln is offering to sell details of its discoveries to potential customers, a spokesman for the firm told El Reg.

"We sell our 0-day vulnerabilities to our 0-day feed customers. Vendors who want to improve their security can request one of our consulting services."

The most obvious customers for details on SCADA exploits, particularly in the wake of Stuxnet, are government agencies. ReVuln said it only accepts "trusted customers from reputable countries only".

Like others in the emerging field of exploit-brokering, ReVuln avoids simply reporting security bugs to vendors as part of a vulnerability disclosure process. It also had little interest in bug-bounty programs of the type pioneered by the likes of Google and Mozilla, that are now gaining wider acceptance among IT vendors and others, such as PayPal.

"We don't work for free," a ReVuln spokesman explained. "We had several personal experiences in the past where vendors didn't even say thanks for reporting a issue, or they try to underpay your research with bug-bounty programs that are not worth reporting issues to them."

ReVuln's website states the the start-up specialises in "software and hardware assessment including vulnerability research for offensive and defensive security", which would appear to put the firm in the same category as exploit intelligence services firms such as Vupen Security.

Vupen, which bills itself as a "leading provider of defensive & offensive cyber security intelligence for government", recently claimed it was sitting on a tasty Windows 8 exploit which it declined to share with Microsoft.

ReVuln said that instead of comparing it with Vupen, it makes more sense to compare with to firms that buy vulnerabilities and report them to the vendors.

"There are several companies outsourcing vulnerability research and reporting issues to the vendors after selling weaponized exploits to their customers. Their business model works because most of the people selling vulnerabilities to such companies are not aware of the real market value of the information they are selling, so they accept to sell their work for a very little amount of money," the spokesman told us.

"On our side, we don't buy vulnerabilities and all our research is made by our internal team, moreover we do not disclose vulnerability information to vendors."

Last week Russian developer Positive Technologies said 40 per cent of SCADA systems “available from the internet” were hackable. The claim came just weeks after the balloon went up about flaws in CoDeSys, a popular development environment for industrial control systems, used by score of manufacturers.

Kaspersky Lab, the Russian security firm that has been applauded for its research into Stuxnet and other SCADA nasties, recently announced it was developing an operating system designed to make industrial control systems less vulnerable to the sort of attacks ReVuln boasts it has discovered.

The volume of SCADA vulnerabilities being uncovered makes ReVuln claims, which would have been considered fanciful two years ago, more than credible - even though they remain unproven.

Game on

Last week ReVuln said it had discovered a remote code vulnerability in the CryEngine 3 game engine and a server-side bug involving Call of Duty: Modern Warfare 3 that might lend itself towards running denial of service attacks against game servers.

ReVuln's paper (PDF) on the Call of Duty bug explains the issue in some depth while a video of the game engine vulnerability is far less forthcoming, other than classifying the exploit as arising from a heap spray vulnerability.

"The security hole in CryENGINE 3 is an example of 0-day vulnerability affecting the server-side part of games using game engines," a ReVuln spokesman explained. "Basically by exploiting such hole it's possible to compromise remote servers, and get complete control over them. We also discovered a 0-day vulnerability in Call Of Duty: Modern Warfare 3, which can be exploited to take down all the online servers at once.

"Please note that we didn't provide any public exploit or proof-of-concept code," he added.

The start-up said its security research covers many different fields, positioning its interest in looking at the security as far from a hobby or side-project.

"Games have a huge market, and there is interest from game companies in game security to improve their level of security," ReVuln explained. ®

* SCADA systems are used to monitor and control industrial processes, infrastructure, and facility-based processes - such as those of the Iranian nuclear plant attacked in 2010.

Boost IT visibility and business value

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.