Feeds

Exploit broker releases EXPLICIT VIDS of holes in industrial control kit

Will only sell to 'trusted customers from reputable countries'

The Power of One eBook: Top reasons to choose HP BladeSystem

Malta-based security start-up ReVuln claims to have uncovered a raft of vulnerabilities in industrial control kit from many leading manufacturers.

ReVuln released a video depicting zero-day exploits against SCADA* equipment from Siemens, General Electric, Schneider Electric, ABB/Rockwell and others. The unpatched flaws are all server-side and remotely exploitable by hackers, according to ReVuln.

No technical details were provided, so the claims of unpatched security flaws can't be independently verified. Rather than reporting the flaws to vendors, ReVuln is offering to sell details of its discoveries to potential customers, a spokesman for the firm told El Reg.

"We sell our 0-day vulnerabilities to our 0-day feed customers. Vendors who want to improve their security can request one of our consulting services."

The most obvious customers for details on SCADA exploits, particularly in the wake of Stuxnet, are government agencies. ReVuln said it only accepts "trusted customers from reputable countries only".

Like others in the emerging field of exploit-brokering, ReVuln avoids simply reporting security bugs to vendors as part of a vulnerability disclosure process. It also had little interest in bug-bounty programs of the type pioneered by the likes of Google and Mozilla, that are now gaining wider acceptance among IT vendors and others, such as PayPal.

"We don't work for free," a ReVuln spokesman explained. "We had several personal experiences in the past where vendors didn't even say thanks for reporting a issue, or they try to underpay your research with bug-bounty programs that are not worth reporting issues to them."

ReVuln's website states the the start-up specialises in "software and hardware assessment including vulnerability research for offensive and defensive security", which would appear to put the firm in the same category as exploit intelligence services firms such as Vupen Security.

Vupen, which bills itself as a "leading provider of defensive & offensive cyber security intelligence for government", recently claimed it was sitting on a tasty Windows 8 exploit which it declined to share with Microsoft.

ReVuln said that instead of comparing it with Vupen, it makes more sense to compare with to firms that buy vulnerabilities and report them to the vendors.

"There are several companies outsourcing vulnerability research and reporting issues to the vendors after selling weaponized exploits to their customers. Their business model works because most of the people selling vulnerabilities to such companies are not aware of the real market value of the information they are selling, so they accept to sell their work for a very little amount of money," the spokesman told us.

"On our side, we don't buy vulnerabilities and all our research is made by our internal team, moreover we do not disclose vulnerability information to vendors."

Last week Russian developer Positive Technologies said 40 per cent of SCADA systems “available from the internet” were hackable. The claim came just weeks after the balloon went up about flaws in CoDeSys, a popular development environment for industrial control systems, used by score of manufacturers.

Kaspersky Lab, the Russian security firm that has been applauded for its research into Stuxnet and other SCADA nasties, recently announced it was developing an operating system designed to make industrial control systems less vulnerable to the sort of attacks ReVuln boasts it has discovered.

The volume of SCADA vulnerabilities being uncovered makes ReVuln claims, which would have been considered fanciful two years ago, more than credible - even though they remain unproven.

Game on

Last week ReVuln said it had discovered a remote code vulnerability in the CryEngine 3 game engine and a server-side bug involving Call of Duty: Modern Warfare 3 that might lend itself towards running denial of service attacks against game servers.

ReVuln's paper (PDF) on the Call of Duty bug explains the issue in some depth while a video of the game engine vulnerability is far less forthcoming, other than classifying the exploit as arising from a heap spray vulnerability.

"The security hole in CryENGINE 3 is an example of 0-day vulnerability affecting the server-side part of games using game engines," a ReVuln spokesman explained. "Basically by exploiting such hole it's possible to compromise remote servers, and get complete control over them. We also discovered a 0-day vulnerability in Call Of Duty: Modern Warfare 3, which can be exploited to take down all the online servers at once.

"Please note that we didn't provide any public exploit or proof-of-concept code," he added.

The start-up said its security research covers many different fields, positioning its interest in looking at the security as far from a hobby or side-project.

"Games have a huge market, and there is interest from game companies in game security to improve their level of security," ReVuln explained. ®

* SCADA systems are used to monitor and control industrial processes, infrastructure, and facility-based processes - such as those of the Iranian nuclear plant attacked in 2010.

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.