Feeds

Exploit broker releases EXPLICIT VIDS of holes in industrial control kit

Will only sell to 'trusted customers from reputable countries'

SANS - Survey on application security programs

Malta-based security start-up ReVuln claims to have uncovered a raft of vulnerabilities in industrial control kit from many leading manufacturers.

ReVuln released a video depicting zero-day exploits against SCADA* equipment from Siemens, General Electric, Schneider Electric, ABB/Rockwell and others. The unpatched flaws are all server-side and remotely exploitable by hackers, according to ReVuln.

No technical details were provided, so the claims of unpatched security flaws can't be independently verified. Rather than reporting the flaws to vendors, ReVuln is offering to sell details of its discoveries to potential customers, a spokesman for the firm told El Reg.

"We sell our 0-day vulnerabilities to our 0-day feed customers. Vendors who want to improve their security can request one of our consulting services."

The most obvious customers for details on SCADA exploits, particularly in the wake of Stuxnet, are government agencies. ReVuln said it only accepts "trusted customers from reputable countries only".

Like others in the emerging field of exploit-brokering, ReVuln avoids simply reporting security bugs to vendors as part of a vulnerability disclosure process. It also had little interest in bug-bounty programs of the type pioneered by the likes of Google and Mozilla, that are now gaining wider acceptance among IT vendors and others, such as PayPal.

"We don't work for free," a ReVuln spokesman explained. "We had several personal experiences in the past where vendors didn't even say thanks for reporting a issue, or they try to underpay your research with bug-bounty programs that are not worth reporting issues to them."

ReVuln's website states the the start-up specialises in "software and hardware assessment including vulnerability research for offensive and defensive security", which would appear to put the firm in the same category as exploit intelligence services firms such as Vupen Security.

Vupen, which bills itself as a "leading provider of defensive & offensive cyber security intelligence for government", recently claimed it was sitting on a tasty Windows 8 exploit which it declined to share with Microsoft.

ReVuln said that instead of comparing it with Vupen, it makes more sense to compare with to firms that buy vulnerabilities and report them to the vendors.

"There are several companies outsourcing vulnerability research and reporting issues to the vendors after selling weaponized exploits to their customers. Their business model works because most of the people selling vulnerabilities to such companies are not aware of the real market value of the information they are selling, so they accept to sell their work for a very little amount of money," the spokesman told us.

"On our side, we don't buy vulnerabilities and all our research is made by our internal team, moreover we do not disclose vulnerability information to vendors."

Last week Russian developer Positive Technologies said 40 per cent of SCADA systems “available from the internet” were hackable. The claim came just weeks after the balloon went up about flaws in CoDeSys, a popular development environment for industrial control systems, used by score of manufacturers.

Kaspersky Lab, the Russian security firm that has been applauded for its research into Stuxnet and other SCADA nasties, recently announced it was developing an operating system designed to make industrial control systems less vulnerable to the sort of attacks ReVuln boasts it has discovered.

The volume of SCADA vulnerabilities being uncovered makes ReVuln claims, which would have been considered fanciful two years ago, more than credible - even though they remain unproven.

Game on

Last week ReVuln said it had discovered a remote code vulnerability in the CryEngine 3 game engine and a server-side bug involving Call of Duty: Modern Warfare 3 that might lend itself towards running denial of service attacks against game servers.

ReVuln's paper (PDF) on the Call of Duty bug explains the issue in some depth while a video of the game engine vulnerability is far less forthcoming, other than classifying the exploit as arising from a heap spray vulnerability.

"The security hole in CryENGINE 3 is an example of 0-day vulnerability affecting the server-side part of games using game engines," a ReVuln spokesman explained. "Basically by exploiting such hole it's possible to compromise remote servers, and get complete control over them. We also discovered a 0-day vulnerability in Call Of Duty: Modern Warfare 3, which can be exploited to take down all the online servers at once.

"Please note that we didn't provide any public exploit or proof-of-concept code," he added.

The start-up said its security research covers many different fields, positioning its interest in looking at the security as far from a hobby or side-project.

"Games have a huge market, and there is interest from game companies in game security to improve their level of security," ReVuln explained. ®

* SCADA systems are used to monitor and control industrial processes, infrastructure, and facility-based processes - such as those of the Iranian nuclear plant attacked in 2010.

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.