SCADA flaws talk cancelled due to security fears

Since the advent of the Stuxnet worm, SCADA industrial control systems have been receiving a lot of attention. You would expect that since these systems are those that control many critical infrastructure systems and are used in big manufacturing facilities, security would be the first thing on the minds of their developers.

But, it turns out that it’s not so. In March, Italian researcher Luigi Auriemma revealed 34 vulnerabilities on various server-side SCADA software, along with a proof-of-concept for each of them.

According to him, most of them can be leveraged to execute a remote code execution on SCADA software-run machines with an Internet connection. Others allow attackers access to stored data, and in one case, to even interfere with the hardware that uses the software in question.

34 is a huge number, when you consider what these systems control. And now, news that another researcher has discovered a number of security flaw in Siemens SCADA systems, wanted to present his discovery at a security conference and in the end through better of it and cancelled his talk has hit the Internet.

According to Wired, NSS Labs researcher Dillon Beresford was scheduled to demonstrate the vulnerabilities he found after researching various Siemens SCADA systems for only two and a half months, but changed his mind after talking to the DHS and Siemens.

Instead, he shared some of the flaws with Siemens and the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). Siemens apparently managed to work out a remediation for one of the vulnerabilities, but it turns out that it is easily circumvented.

That must have been a final wake up call for the German company, and hopefully taught them that securing a system is not easy, and is a process that will require much more attention and effort that they are used to give it.

Rick Moy, NSS Labs CEO, supported Beresford’s decision. “This is different from simply stealing money out of someone’s bank account. Things could explode. I don’t want to overplay this and sound like it’s a bunch of FUD but physical damage can occur and people can be seriously injured or worse. So we felt -¦ it was best to be prudent and wait a little bit longer until we get more information,” he explained.