Feeds

Power station, airport SCADA defences 'dead as a dodo'

Security bod promises to help fix holes rather than flog exploits

Securing Web Applications Made Simple and Scalable

Researchers have discovered yet more security vulnerabilities in crucial equipment used by power plants, airports, factories and other critical systems.

Exodus Intelligence said it has found more than 20 flaws in SCADA (supervisory control and data acquisition) software from vendors including Rockwell Automation, Schneider Electric, Indusoft, RealFlex and Eaton Corporation. The bugs expose machinery to the risk of either remote code execution or denial of service attacks.

Aaron Portnoy, veep of research at Exodus, said he found the security bugs in a matter of hours over Thanksgiving weekend. Writing on his company's website, he likened SCADA software to a flightless bird - say, a dodo - in terms of its vulnerability to attack.

Last week, researchers at Maltese startup ReVuln recorded a video in which they boasted of discovering zero-day vulnerabilities in SCADA applications from vendors such as Siemens, GE and Schneider Electric. ReVuln intends to sell information on these vulnerabilities, potentially to government agencies, rather than report them to equipment manufacturers to fix.

Portnoy is critical of ReVuln's approach to disclosure, and has promised to report his own findings to the affected vendors. There appears to be some overlap in the holes Exodus and ReVuln have discovered, but since the latter did not reveal any details, it's difficult to be sure on this point. Portnoy told El Reg that his probing of SCADA code was not the fruit of commercial rivalry between Exodus and ReVuln.

"I don't think we compete with ReVuln as the customers we deal with would not do business with a company that doesn't disclose their findings," Portnoy explained. "Also, our focus is quite different; we provide our customers with actionable information to help defend themselves or defend their clients against vulnerabilities in widely used enterprise software whereas ReVuln seems focussed on extorting SCADA vendors.

"Regarding overlap, I think it is quite likely that I found some of the bugs ReVuln has, mainly because the vendors they list only have a very limited number of SCADA products that you can find the software for. Also, there are some very small details that can be gleaned from the video ReVuln posted," Portnoy added.

Luigi Auriemma of ReVuln hit back at the criticism that it was "extorting" vendors.

"We don't sell vulnerability information to vendors, simple," Auriemma said. "We have our vulnerability assessment solutions for software and hardware vendors like any other company on the market has.

"And regarding the vulnerability research we apply the same business model of the big players in the market so Portnoy is not attacking us, a little startup, but the whole market." ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.