Feeds

Power station, airport SCADA defences 'dead as a dodo'

Security bod promises to help fix holes rather than flog exploits

Internet Security Threat Report 2014

Researchers have discovered yet more security vulnerabilities in crucial equipment used by power plants, airports, factories and other critical systems.

Exodus Intelligence said it has found more than 20 flaws in SCADA (supervisory control and data acquisition) software from vendors including Rockwell Automation, Schneider Electric, Indusoft, RealFlex and Eaton Corporation. The bugs expose machinery to the risk of either remote code execution or denial of service attacks.

Aaron Portnoy, veep of research at Exodus, said he found the security bugs in a matter of hours over Thanksgiving weekend. Writing on his company's website, he likened SCADA software to a flightless bird - say, a dodo - in terms of its vulnerability to attack.

Last week, researchers at Maltese startup ReVuln recorded a video in which they boasted of discovering zero-day vulnerabilities in SCADA applications from vendors such as Siemens, GE and Schneider Electric. ReVuln intends to sell information on these vulnerabilities, potentially to government agencies, rather than report them to equipment manufacturers to fix.

Portnoy is critical of ReVuln's approach to disclosure, and has promised to report his own findings to the affected vendors. There appears to be some overlap in the holes Exodus and ReVuln have discovered, but since the latter did not reveal any details, it's difficult to be sure on this point. Portnoy told El Reg that his probing of SCADA code was not the fruit of commercial rivalry between Exodus and ReVuln.

"I don't think we compete with ReVuln as the customers we deal with would not do business with a company that doesn't disclose their findings," Portnoy explained. "Also, our focus is quite different; we provide our customers with actionable information to help defend themselves or defend their clients against vulnerabilities in widely used enterprise software whereas ReVuln seems focussed on extorting SCADA vendors.

"Regarding overlap, I think it is quite likely that I found some of the bugs ReVuln has, mainly because the vendors they list only have a very limited number of SCADA products that you can find the software for. Also, there are some very small details that can be gleaned from the video ReVuln posted," Portnoy added.

Luigi Auriemma of ReVuln hit back at the criticism that it was "extorting" vendors.

"We don't sell vulnerability information to vendors, simple," Auriemma said. "We have our vulnerability assessment solutions for software and hardware vendors like any other company on the market has.

"And regarding the vulnerability research we apply the same business model of the big players in the market so Portnoy is not attacking us, a little startup, but the whole market." ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.