Exploits For Popular SCADA Programs Made Public

SCADA is not something we’ve mentioned before, we have covered related areas with articles such as – Industrial Control Systems Safe? I Think Not.

Plus the whole Stuxnet thing which was able to attack nuclear plants. In a way I find it ironic because so much more emphasis these days is put on the security of things like Twitter and Facebook, but the industrial control systems in factories and nuclear refining facilities are left unsecured.

It just goes to show how devastating a focused attack against these kind of large scale control systems could be.

The security of software used to control hardware at nuclear plants, gas refineries and other industrial settings is coming under renewed scrutiny as researchers released attack code exploiting dozens of serious vulnerabilities in widely used programs.

The flaws, which reside in programs sold by Siemens, Iconics, 7-Technologies, Datac, and Control Microsystems, in many cases make it possible for attackers to remotely execute code when the so-called supervisory control and data acquisition software is installed on machines connected to the internet. Attack code was released by researchers from two separate security camps over the past week.

“SCADA is a critical field but nobody really cares about it,” Luigi Auriemma, one of the researchers, wrote in an email sent to The Register. “That’s also the reason why I have preferred to release these vulnerabilities under the full-disclosure philosophy.”

The vulnerability dump includes proof-of-concept code for at least 34 vulnerabilities in widely used SCADA programs sold by four different vendors. Auriemma said the majority of the bugs allow code execution, while others allow attackers to access sensitive data stored in configuration files and one makes it possible to disrupt equipment that uses the software. He included a complete rundown of the vulnerabilities and their corresponding PoC code in a post published on Monday to the Bugtraq mail list.

There are a whole long list of vulnerabilities including PoC code posted publicly on Bugtraq this past Monday:

Vulnerabilities in some SCADA server softwares

The vulnerabilities include software by popular vendors such as Siemens. If you don’t know what SCADA is it stands for supervisory control and data acquisition.

The e-mail explains it well:

In case someone doesn’t know SCADA (like me before the tests): it’s just one or more softwares (usually a core, a graphical part and a database) that allow people to monitor and control the various hardware sensors and mechanisms located in industrial environments like nuclear plants, refineries, gas pipelines, airports and other less and more critical fields that go from the energy to the public infrastructures and obviously also the small “normal” industries.

Pretty heavy stuff, more on Wiki here – SCADA.

It came six days after a Moscow-based security firm called Gleg announced the availability of Agora SCADA+, which attempts to collect virtually all known SCADA vulnerabilities into a single exploit pack. The 22 modules include exploits for 11 zero-day vulnerabilities, said the company’s Yuriy Gurkin in an email. It’s not clear how much the package costs.

Gurkin said Gleg’s website has come under sustained web attacks shortly after releasing the SCADA exploit pack.

“We have tried to switch to ddoshostingsolutions.com provider but in just 3 days were out of 500 GB traffic limit,” he said. “Currently trying to solve this.”

The vulnerability of SCADA systems had long been theorized, but it wasn’t until last year that the world got an object lesson on just how susceptible they could be to attack. In July, researchers reported the discovery of a computer worm that attacked SCADA software sold by Siemens. Research later showed that the underlying Stuxnet exploit amounted to a “search-and-destroy weapon” built to take out Iran’s Bushehr nuclear reactor.

SCADA software often runs on extremely old systems that are difficult to replace without causing disruptions to critical equipment. As a result, installing patches and upgrades is frequently avoided despite the obvious security benefits.

Most of the bugs are quite serious too, not just DoS attacks or simple information disclosure. The majority actually lead to code execution and are able to be exploited remotely to any of these SCADA systems that are connection to an Internet enabled LAN.

What’s worse is SCADA systems rate way lower than IT systems in terms of budget for audits and security, there are very few people with in-depth knowledge in SCADA security and in general people don’t really seem interested in it.

With the scary flip side being, the SCADA systems control MUCH more important equipment than any of the IT systems do. It’ll be interesting to see if any of these companies issue statement and fixes for the software and perhaps carry out some proper audits.

Of course issuing guidelines on setting up SCADA systems in a secure manner would be useful too.

Source: The Register