Metasploit releases Framework 3.5.1

Any ethical hacker realizes the importance of the Metasploit Framework.  The features and functions available facilitate simple to advanced system exploitation invaluable to comprehensive assessments and pen tests.  On December 15, Rapid 7 released an updated Framework 3.5.1.  You can view the Release Notes by clicking here.  This update includes 47 new modules since the last point release, bringing the total to 635 exploit modules.

What is worthy of mention in a SCADA blog is the inclusion of some new control system related exploits.  Specifically addressed in 3.5.1:

• MOXA MediaDPPlayback ActiveX Control Buffer Overview
• MOXA Device Manager Tool 2.1 Buffer Overview
• BACnet OPC Client Buffer Overflow
• CitectSCADA/CitectFacilities ODBC Buffer Overview
• DATAC RealWin SCADA Server SCPC_TXTEVENT Buffer Overflow

This adds to some of the SCADA modules that are already included in previous updates, specifically the following modules which be used to exploit various aspects of the Stuxnet worm:

• MS10-046: Shortcut LNK vulnerability used to install Stuxnet
• MS10-061: Print Spooler vulnerability used to propagate and replicate Stuxnet
• MS08-067: SMB vulnerability used to propagate and replicate Stuxnet

If you want access to the 2 other Stuxnet exploits (MS10-073 and 092), consider using Immunity's CANVAS product.  These exploit modules were released October 5 (well in advance of the security patches!).

Of course, always remember to update your local Metasploit database by running "svnupdate" or "msfupdate" depending on your version.

Final Stuxnet EoP Vulnerability Patched on Tuesday as MS10-092

It has been almost five months since Stuxnet was discovered in July of this year. However, the intricacies of this highly sophisticated worm have challenged the best minds in security research. This week on "Patch Tuesday", Microsoft released a record 17 patches to address 40 vulnerabilities. You can view the Microsoft Security Bulletin Summary for December 2010 by clicking here.

For those of you interested, the exploit code for the Task Scheduler EoP 0-day was made available on November 20. You can review this code by clicking here.

Interesting enough, this is the third time this year that Microsoft has set a record for closing vulnerabilities on Patch Tuesday. On a year-over-year basis, Microsoft closed out 2010 issuing 106 bulletins, compared with 74 in 2009, 78 in 2008. However, what is more interesting is that in these 106 bulletins, Microsoft has patched 261 vulnerabilities compared to 170 in 2009. This data, as published in Information Week confirms the growing trend in both number and complexity of the exploits released (and discovered!).

Database of Industrial Cyber Security Incidents

I just obtained some hot news from AutomationWorld.com ...

"For a limited time,” says a recent announcement from the non-profit organization, the SIO is offering a 25 percent discount on all new RISI memberships and membership renewals. What’s more, if you sign up now, your company will also receive a newly released RISI report providing a study of more than 50 control system incidents caused by malware such as viruses, Trojans and worms.

What’s RISI? It is the Repository of Industrial Security Incidents, a member-supported database of industrial control-system cyber-security incidents that is billed as the largest known database of its kind. Its purpose is to collect, investigate, analyze and share important industrial security incidents among member companies so that they can learn from the experiences of others. RISI includes accidental cyber-related incidents, as well as deliberate events that have resulted in loss of control, loss of production or a process safety incident.

Read the entire new article by clicking here.

Comparing Software Vulnerabilities

A key component in any control system security program is a complete analysis of all client-side applications covering not only the base operating system, but also the often necessary add-ons.  Security vulnerability management firm Secunia just announced the availability of security "factsheets".  Click here to read the press release, or click here to go directly to the factsheet site.

As always, it is important to address all client-side applications that exist on any control system node (server, HMI, historian, application/batch, etc.) and make sure that they are properly patched.  This requires a conscience look at how to manage updates outside the traditional "Windows Update" or WSUS arena.

Langer's "Controller Integrity Checker" for Siemens S7

This is an interesting article and product from Roger Langer that talks of a mitigation tool for post-Stuxnet malware and potential vulnerability exploits.  Read the full article by clicking here.  This continues to stress the need to a thorough review of all security risks within a facility, and the development of a comprehensive security program that offers a solid defense-in-depth strategy to offer three primary goals:

• Mitigate the attack entirely, if possible, including timely detection of the attack
• Contain the attack, and minimize the negative consequences associated with the attack
• Provide sufficient forensic data to investigate the attack and adjust the DiD program to prevent future attacks

November issue of Hakin9: Botnets, Malware, Spyware |

Click here to view the November issue.

Hakin9 has released their November Free Issue of Hakin9 Magazine. This month the magazine has articles focused in Botnets, Malwares and Spywares.
Here is a briefing of what you can find in it:

• A brief analysis of the cyber security threat by Julian Evans
• Cyber State-Bullying by Matthew Jonkman
• The Spyware Within You by Rajat Khare
• The Ear of Sauron by John Aycock
• dasbot: controlling IRC via bash by Israel Torres
• Knowing VoIP Part II – Getting deeper to the settings by Winston Santos
• TDSS botnet – full disclosure. Part II by Andrey Rassokhin and Dmitry Oleksyuk
• Search Engine Security and Privacy – Part 2 by Rebecca Wynn

A Search Engine to Find Vulnerable Control Systems

If you have not had a chance to take a look at Shodan, I would suggest that you do so in short order.  Most hackers have been using Google Hacks for some time to find specific sites based on banner information.  As reported in a ICS-CERT Alert released on October 28 (ICS-Alert-10-301-01), independent security researchers employ the SHODAN search engine to discover Internet facing SCADA systems using potentially insecure mechanisms for authentication and authorization.  In most cases, the affected control system interfaces were designed to provide remote access for monitoring system status and/or certain asset management features. 

This again demonstrates why asset-owners need to re-evaluate and implement improved defense-in-depth strategies when providing remote access to trusted control system networks to not only prevent authorized access, but provide notification when a breach occurs and minimize the negative consequences of such a break.  I presented one such solution at the recent ICSJWG conference in Seattle (click here to view the presentation).

These vulnerable systems have been found to be readily accessible from the Internet and with tools, such as SHODAN, the resources required to identify them has been greatly reduced.  In addition to the increased risk of account brute forcing from having these systems available on the Internet, some of the identify systems continue to use default user names and passwords and/or common vendor accounts for remote access into these systems. These default/common accounts can in many cases be easily found in online documentation and/or online default password repositories, such as those presented at this site.