Original URL: http://www.theregister.co.uk/2012/11/27/scada_vulns/
Power station, airport SCADA defences 'dead as a dodo'
Security bod promises to help fix holes rather than flog exploits
Researchers have discovered yet more security vulnerabilities in crucial equipment used by power plants, airports, factories and other critical systems.
Exodus Intelligence said it has found more than 20 flaws in SCADA (supervisory control and data acquisition) software from vendors including Rockwell Automation, Schneider Electric, Indusoft, RealFlex and Eaton Corporation. The bugs expose machinery to the risk of either remote code execution or denial of service attacks.
Aaron Portnoy, veep of research at Exodus, said he found the security bugs in a matter of hours over Thanksgiving weekend. Writing on his company's website, he likened SCADA software to a flightless bird - say, a dodo - in terms of its vulnerability to attack.
Last week, researchers at Maltese startup ReVuln recorded a video in which they boasted of discovering zero-day vulnerabilities in SCADA applications from vendors such as Siemens, GE and Schneider Electric. ReVuln intends to sell information on these vulnerabilities, potentially to government agencies, rather than report them to equipment manufacturers to fix.
Portnoy is critical of ReVuln's approach to disclosure, and has promised to report his own findings to the affected vendors. There appears to be some overlap in the holes Exodus and ReVuln have discovered, but since the latter did not reveal any details, it's difficult to be sure on this point. Portnoy told El Reg that his probing of SCADA code was not the fruit of commercial rivalry between Exodus and ReVuln.
"I don't think we compete with ReVuln as the customers we deal with would not do business with a company that doesn't disclose their findings," Portnoy explained. "Also, our focus is quite different; we provide our customers with actionable information to help defend themselves or defend their clients against vulnerabilities in widely used enterprise software whereas ReVuln seems focussed on extorting SCADA vendors.
"Regarding overlap, I think it is quite likely that I found some of the bugs ReVuln has, mainly because the vendors they list only have a very limited number of SCADA products that you can find the software for. Also, there are some very small details that can be gleaned from the video ReVuln posted," Portnoy added.
Luigi Auriemma of ReVuln hit back at the criticism that it was "extorting" vendors.
"We don't sell vulnerability information to vendors, simple," Auriemma said. "We have our vulnerability assessment solutions for software and hardware vendors like any other company on the market has.
"And regarding the vulnerability research we apply the same business model of the big players in the market so Portnoy is not attacking us, a little startup, but the whole market." ®