Original URL: http://www.theregister.co.uk/2012/11/23/scada_vulns/
Exploit broker releases EXPLICIT VIDS of holes in industrial control kit
Will only sell to 'trusted customers from reputable countries'
Malta-based security start-up ReVuln claims to have uncovered a raft of vulnerabilities in industrial control kit from many leading manufacturers.
ReVuln released a video depicting zero-day exploits against SCADA* equipment from Siemens, General Electric, Schneider Electric, ABB/Rockwell and others. The unpatched flaws are all server-side and remotely exploitable by hackers, according to ReVuln.
No technical details were provided, so the claims of unpatched security flaws can't be independently verified. Rather than reporting the flaws to vendors, ReVuln is offering to sell details of its discoveries to potential customers, a spokesman for the firm told El Reg.
"We sell our 0-day vulnerabilities to our 0-day feed customers. Vendors who want to improve their security can request one of our consulting services."
The most obvious customers for details on SCADA exploits, particularly in the wake of Stuxnet, are government agencies. ReVuln said it only accepts "trusted customers from reputable countries only".
Like others in the emerging field of exploit-brokering, ReVuln avoids simply reporting security bugs to vendors as part of a vulnerability disclosure process. It also had little interest in bug-bounty programs of the type pioneered by the likes of Google and Mozilla, that are now gaining wider acceptance among IT vendors and others, such as PayPal.
"We don't work for free," a ReVuln spokesman explained. "We had several personal experiences in the past where vendors didn't even say thanks for reporting a issue, or they try to underpay your research with bug-bounty programs that are not worth reporting issues to them."
ReVuln's website states the the start-up specialises in "software and hardware assessment including vulnerability research for offensive and defensive security", which would appear to put the firm in the same category as exploit intelligence services firms such as Vupen Security.
Vupen, which bills itself as a "leading provider of defensive & offensive cyber security intelligence for government", recently claimed it was sitting on a tasty Windows 8 exploit which it declined to share with Microsoft.
ReVuln said that instead of comparing it with Vupen, it makes more sense to compare with to firms that buy vulnerabilities and report them to the vendors.
"There are several companies outsourcing vulnerability research and reporting issues to the vendors after selling weaponized exploits to their customers. Their business model works because most of the people selling vulnerabilities to such companies are not aware of the real market value of the information they are selling, so they accept to sell their work for a very little amount of money," the spokesman told us.
"On our side, we don't buy vulnerabilities and all our research is made by our internal team, moreover we do not disclose vulnerability information to vendors."
Last week Russian developer Positive Technologies said 40 per cent of SCADA systems “available from the internet” were hackable. The claim came just weeks after the balloon went up about flaws in CoDeSys, a popular development environment for industrial control systems, used by score of manufacturers.
Kaspersky Lab, the Russian security firm that has been applauded for its research into Stuxnet and other SCADA nasties, recently announced it was developing an operating system designed to make industrial control systems less vulnerable to the sort of attacks ReVuln boasts it has discovered.
The volume of SCADA vulnerabilities being uncovered makes ReVuln claims, which would have been considered fanciful two years ago, more than credible - even though they remain unproven.
Last week ReVuln said it had discovered a remote code vulnerability in the CryEngine 3 game engine and a server-side bug involving Call of Duty: Modern Warfare 3 that might lend itself towards running denial of service attacks against game servers.
ReVuln's paper (PDF) on the Call of Duty bug explains the issue in some depth while a video of the game engine vulnerability is far less forthcoming, other than classifying the exploit as arising from a heap spray vulnerability.
"The security hole in CryENGINE 3 is an example of 0-day vulnerability affecting the server-side part of games using game engines," a ReVuln spokesman explained. "Basically by exploiting such hole it's possible to compromise remote servers, and get complete control over them. We also discovered a 0-day vulnerability in Call Of Duty: Modern Warfare 3, which can be exploited to take down all the online servers at once.
"Please note that we didn't provide any public exploit or proof-of-concept code," he added.
The start-up said its security research covers many different fields, positioning its interest in looking at the security as far from a hobby or side-project.
"Games have a huge market, and there is interest from game companies in game security to improve their level of security," ReVuln explained. ®
* SCADA systems are used to monitor and control industrial processes, infrastructure, and facility-based processes - such as those of the Iranian nuclear plant attacked in 2010.