Tuesday, March 18, 2014

Recent development of ICS exploits continues upward trend of security research

In performing my daily rounds on news feeds and websites, I noticed a lot of recent developments in open-source exploit modules targeting industrial control systems. One very important part of a well-rounded ICS Security Management System (IACS-SMS per ISA 62443 terminology) is situational awareness of the actual risks facing industrial systems in terms of both vulnerabilities disclosed and the ease in converting these proof-of-concept (PoC) disclosures into workable exploit modules.


The vision of SCADAhacker.com is to assemble in a single location details relating to disclosures and exploits - as was demonstrated initially by my reference page (http://scadahacker.com/vulndb/ics-vuln-ref-list.html). This page became an overwhelming task to keep current - but rest assured it is still on the plate to update and maintain!

I wanted to provide a quick update of some recent developments in terms of disclosures, advisories and availability of useable exploit modules for some recent ICS systems. The vulnerability details are obtained via the Open-Source Vulnerability Database (OSVDB) project, exploit source code via Exploit-DB, and advisories published by ICS-CERT.

ABB MicroSCADA
     Vuln Details
     Exploit Module - (published Dec. 3, 2013 (disclosure Apr. 5, 2013)
     MSF Reference -
           windows/scada/abb_wserver_exec.rb
     ICS-CERT (none published)
     Vendor Advisory

General Electric Proficy CIMPLICITY
     Vuln Details (none available)
     Exploit Module - published Feb. 28, 2014 (disclosure Jan. 23, 2014)
     MSF Reference -   
          windows/scada/ge_proficy_cimplicity_gefebt.rb
     ICS-CERT 
     Vendor Advisory (adv1 , adv2)

WellinTech KingSCADA
     Vuln Details
     Exploit Module - published Feb. 11, 2014 (disclosure Jan. 14, 2014)
     MSF Reference -
          windows/browser/wellintech_kingscada_kxclientdownload.rb
     ICS-CERT     Vendor Advisory (none published)

Yokogawa Centum CS
     Vuln Details (v1 , v2)
     Exploit Modules (e1 , e2) - published Mar. 12, 2013 (disclosure Mar. 10, 2014)
     MSF References -
          windows/scada/yokogawa_bkhodeq_bof.rb
          windows/scada/yokogawa_bkbcopyd_bof.rb
          dos/scada/yokogawa_logsvr.rb
     ICS-CERT / JP-CERT
     Vendor Advisory

Of particular interest to me is the Yokogawa Centum CS activity. This represents a significant shift in ICS research from SCADA to traditionally more robust DCS platforms. Rapid 7 published a very interesting blog on this activity, with some very detailed information regarding the exploit.  It is important to understand that the Centum CS3000 product is at end-of-life. Since it is based on Windows XP (migration to Centum VP required to support Windows 7), users of this ICS platform will face numerous challenges as Microsoft withdraws support in April 2014.  Centum CS3000 R3 was first released in 1998 with Release 3.09 available February 2010.  Yokogawa claims to have sold over 7,600 systems worldwide that likely have installations in most process and manufacturing sectors.

These vulnerabilities target what is called the "Test Function" on the Centum system. This is an offline simulation environment that allows you to test and validate your configuration prior to downloading to an actual production controller or "Field Control Station". There are numerous risk factors associated with running the Test Function on a production system, and for this reason, installations typically have this feature enabled on off-line engineering development systems.

I published a vulnerability within the Emerson DeltaV M- and S-Series controllers in  March 2013, which was unique as it was one of the first vulnerabilities targeting a DCS controller. There had been numerous vulnerabilities disclosed for SCADA devices like PLCs, but known focused on the DCS product sector which, in my opinion, are the primary ICS systems deployed at the core of all critical process industries.

Feel free to comment or drop me a note if you have any additional information you would like to share.

80 comments:

  1. Your blog has impressive information about  Scada Software. Thanks for Share.

    ReplyDelete
    Replies
    1. I got my already programmed and blanked ATM card to withdraw the maximum of $1,000 daily for a maximum of 20 days. I am so happy about this because i got mine last week and I have used it to get $20,000. Mike Fisher Hackers is giving out the card just to help the poor and needy though it is illegal but it is something nice and he is not like other scam pretending to have the blank ATM cards. And no one gets caught when using the card. get yours from Mike Fisher Hackers today! *email cyberhackingcompany@gmail.com


      Delete
    2. Great Article Cyber Security Projects projects for cse Networking Security Projects JavaScript Training in Chennai JavaScript Training in Chennai The Angular Training covers a wide range of topics including Components, Angular Directives, Angular Services, Pipes, security fundamentals, Routing, and Angular programmability. The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training

      Delete
  2. Hi.. your blog is very intersting. Nice to read. Thanks for sharing this

    ReplyDelete
  3. Our expertise and craftsmanship is well fame and we have an extensive variety of involvement in taking care of the necessities of customers all things considered, either from office or to home. By always procuring the notoriety from our clients we are today viewed as the best office interior designers in coimbatore

    ReplyDelete
  4. Our expertise and craftsmanship is well fame and we have an extensive variety of involvement in taking care of the necessities of customers all things considered, either from office or to home. By always procuring the notoriety from our clients we are today viewed as the best modular kitchen coimbatore price

    ReplyDelete
  5. Hello all
    am looking few years that some guys comes into the market
    they called themselves hacker, carder or spammer they rip the
    peoples with different ways and it’s a badly impact to real hacker
    now situation is that peoples doesn’t believe that real hackers and carder scammer exists.
    Anyone want to make deal with me any type am available but first
    I‘ll show the proof that am real then make a deal like

    Available Services

    ..Wire Bank Transfer all over the world

    ..Western Union Transfer all over the world

    ..Credit Cards (USA, UK, AUS, CAN, NZ)

    ..School Grade upgrade / remove Records

    ..Spamming Tool

    ..keyloggers / rats

    ..Social Media recovery

    .. Teaching Hacking / spamming / carding (1/2 hours course)

    discount for re-seller

    Contact: 24/7

    fixitrogers@gmail.com

    ReplyDelete
  6. Thanks for this amazing post its help me a lot to solve my issues click here to download Kinemaster Mod APK

    ReplyDelete
  7. Thank you for writing can I say something for those people who are looking for one of the best website to find details about latest gadget launch, there price, fac3book, dslr full form, USSd code of airtel, idea and protected text like websites so why you are finding, its here read out Sir G.. Pinoy TV

    ReplyDelete
  8. Thanks for your informative article. This article is very informative for us. Thank You for this amazing knowledge.
    Download Call of Duty Mobile Hack Script

    ReplyDelete
  9. Thanks Admin For That Great article. I have read that article so many time for that i have thought its beautifull article ever i have read. you may also like Pinoy Tambayan with out any charge in High Quality.

    ReplyDelete
  10. I want to share a testimony on how Le_Meridian funding service helped me with loan of 2,000,000.00 USD to finance my marijuana farm project , I'm very grateful and i promised to share this legit funding company to anyone looking for way to expand his or her business project.the company is UK/USA funding company. Anyone seeking for finance support should contact them on lfdsloans@outlook.com Or lfdsloans@lemeridianfds.com Mr Benjamin is also on whatsapp 1-989-394-3740 to make things easy for any applicant. 

    ReplyDelete
  11. Thanks for sharing this good informative article admin.

    Do checkout vasthi's Portable Hydrogen Purity Analyzer: Model VHP- 200 is a light weight, easy to handle, battery-powered analyzer, used to verify measurements.

    ReplyDelete
  12. Very good info provided in the article, thanks for sharing
    Also do checkout hydrogen puriy analyzer by Vasthi which is a light weight, easy to handle, battery-powered analyzer.

    ReplyDelete
  13. Pinoy Teleserye, Pinoy Tambayan,Pinoy Tv Replay, Pinoy Lambingan, Pinoy1tv, Pinoy Tv Shows Replay, Pinoy ako.

    ReplyDelete
  14. As you know this is an extensively playing lottery in West Bengal, India. It is the first lottery game, which draws 3 times a day in Nagaland. The first result called, lottery Sambad result morning, second is Sambad lottery result 4 pm and the last result called lottery Sambad night

    ReplyDelete
  15. Hey, Wow all the posts are very informative for the people who visit this site. Good work! We also have a Website. Please feel free to visit our site. Thank you for sharing. Well written article Thank You for Sharing with Us

    ReplyDelete
  16. Lottery Sambad(লটারি সংবাদ) 23.2.2020.Now the waiters are finished, now you can become a millionaire by lottery. You can see the result of Nagaland Lottery Result 2020.Nagaland State Lottery Sambad
    Nagaland Lottery result
    Nagaland Lottery Sambad
    Lottery Sambad Night
    Sikkim State Lottery
    Lottery Sambad Morning

    ReplyDelete
  17. Great post i must say and thanks for the information. Education is definitely a sticky subject. However, is still among the leading topics of our time. I appreciate your post and look forward to more.satta king

    ReplyDelete
  18. At once the blog might possibly unquestionably pick up famed very from post the general public, as for the meticulous content articles or maybe just necessary review articlesSatta king

    ReplyDelete
  19. A round of applause for your article.Much thanks again. Really Cool.Lawyers Guns and Money Blog

    ReplyDelete
  20. Our website is popular all around the globe especially in UAE, Saudi Arabia, Middle East, Dubai, Abu Dhabi, Oman, Qatar, and many other countries.Keep visiting our website. We will update all the Pinoy Tv, GMA Network show and ABS-CBN network shows daily. This website is a golden platform for the overseas Filipinos living all-around the world.

    ReplyDelete
  21. Thanks for posting. Very useful content shared by you. Lottery Sambad Result

    ReplyDelete
  22. Thanks Admin For That awesome article. I have read that article so many time for that i have thought its great article ever. Lottery Sambad Result

    ReplyDelete
  23. Thanks for this amazing post its help me a lot to solve my issues click here to download lottery sambad 4pm

    lottery results

    ReplyDelete
  24. Pinoy Tv Replay is another type of Pinoy Tambayan shows because there are different terms
    for each of them so Pinoy Tambayan is also a famous Keyword and Pinoy Tv Channel are also watched and loved by the people of Phillippines.
    OFWs generally can not find the place outside of their country to watch all these Pinoy Tv Shows so we are giving them a chance to bookmark our website so they can watch all of them at this place.

    ReplyDelete
  25. The report found that automotive research and development (R&D) is critical to national security. The rapid application of commercial breakthroughs in automobile technology is necessary for the United States to retain competitive military advantage and meet new defense requirements. automobile Fuel Filter Trim Removal Tools drill Drills Bits tipstools

    ReplyDelete
  26. Cool stuff you have and you keep overhaul every one of us. Oregon Business Registry

    ReplyDelete
  27. This comment has been removed by the author.

    ReplyDelete
  28. The Lottery Sambad today result is uploaded in two different HD file formats the PDF and DBF formats. Both are downloadable and also you can view it online on our website. https://lsresult.in/ Lottery Sambad Today Result 4pm are also uploaded you can check it by clicking on the above button. Quick Guide to Download Lottery Sambad Result.

    ReplyDelete
  29. wow your arctile was very informative and it has solved my many quiries.
    Please more information on different topic please visit these links given bellow...
    Satta Bazar

    ReplyDelete
  30. Thanks for your marvelous posting! I really enjoyed reading it, you happen to be a great author. I will remember to bookmark your blog and may come back in the foreseeable future.

    Read More:-

    Satta King

    Satta king

    ReplyDelete
  31. This is also a very good post which I really enjoyed reading. It is not everyday that I have the possibility to see something like this.인증업체

    ReplyDelete
  32. If you don’t mind proceed with this extraordinary work and I anticipate a greater amount of your magnificent blog entries.먹튀먹튀

    ReplyDelete
  33. Mmm.. good to be here in your article or post, whatever, I think I should also work hard for my own website like I see some good and updated working in your site. 토토사이트

    ReplyDelete
  34. Hi this Side Satta King
    Awesome post! Personally I like your site. . I am so impressed to read your content. I am looking forward for the next valuable and informative concept in your blog. Overall outstanding post. Carry on :) Well done!
    If Want Play online Satta King Game Click SattaKing :-

    ReplyDelete
  35. I like the valuable information you provide in your articles. I’ll bookmark your weblog and check again here regularly. I am quite certain I will learn plenty of new stuff right here! Best of luck for the next!

    Read More:-

    Satta king

    ReplyDelete
  36. I would like to thank you for the efforts you have made in writing this article. I am hoping the same best work from you in the future as well. In fact your creative writing abilities has inspired me to start my own Blog Engine blog now. Really the blogging is spreading its wings rapidly. Your write up is a fine example of it. 먹튀폴리스

    ReplyDelete
  37. I have added and shared your site to my social media accounts to send people back to your site because I am sure they will find it extremely helpful too. 먹튀검증커뮤니티

    ReplyDelete
  38. It is rather very good, nevertheless glance at the data with this handle. 메이저놀이터

    ReplyDelete
  39. This is an awesome motivating article.I am practically satisfied with your great work.You put truly extremely supportive data. Keep it up. Continue blogging. Hoping to perusing your next post 안전놀이터

    ReplyDelete
  40. I was surfing net and fortunately came across this site and found very interesting stuff here. Its really fun to read. I enjoyed a lot. Thanks for sharing this wonderful information. 토토사이트

    ReplyDelete
  41. Three are normally modest Ralph Lauren accessible available to be purchased every last time you wish to purchase 토토사이트

    ReplyDelete
  42. A very awesome blog post. We are really grateful for your blog post. You will find a lot of approaches after visiting your post 토토사이트

    ReplyDelete
  43. Nice knowledge gaining article. This post is really the best on this valuable topic. 메이저 파워볼사이트

    ReplyDelete
  44. Thank you for sharing the valuable content.

    The electrical test and measurement range of products from Josts’ Electrical Division ensures performance and reliability in power generation, transmission and distribution equipments. Josts has rich experience of over eight decades in providing advanced technology products and systems dedicated to various applications in Electrical Industry. Josts has pioneered many concepts in electrical testing and measurement for various applications in India such as Insulation Testing,

    electrical testing and measurement
    material handling

    ReplyDelete
  45. These is apparently just like definitely great. Most of these modest items are designed through the use of variety of base consciousness. I love these significantly 먹튀폴리스

    ReplyDelete
  46. Really satisfied with all the information I have found in this article. It gives immense knowledge on physical education, it is very helpful and quite generous to spread a good message. The author has done a brilliant job on summing all the points here. You just made a new fan with your writing skills. Cheers! 먹튀검증

    ReplyDelete
  47. This Post is providing valuable and unique information, I know that you take a time and effort to make a awesome article 토토사이트

    ReplyDelete
  48. Thanks for sharing the information. I really impressed after read this because of some quality work and informative thoughts 먹튀폴리스

    ReplyDelete
  49. I would like to say that this blog really convinced me to do it! Thanks, very amazing post. 먹튀검증업체

    ReplyDelete
  50. Your blogs are easily accessible and quite enlightening so keep doing the amazing work guys. 먹튀폴리스

    ReplyDelete
  51. You have done a great job on this article. It’s very readable and highly intelligent. You have even managed to make it understandable and easy to read. You have some real writing talent. Thank you. 먹튀사이트

    ReplyDelete
  52. I want looking at and I believe this website got some really useful stuff on it! 먹튀검증

    ReplyDelete
  53. This was among the best posts and episode from your team it let me learn many new things 카지노사이트

    ReplyDelete
  54. Thanks for the blog filled with so many information. Stopping by your blog helped me to get what I was looking for. Now 스포츠토토

    ReplyDelete
  55. 스포츠토토 is a excellent blog, would you be involved in doing an interview about just how you designed it? If so e-mail me!

    ReplyDelete
  56. Unbelievable!! The problem I was thinking about was solved.온라인바둑이You are really awesome.

    ReplyDelete
  57. Hi there, I discovered your blog per Google bit searching for such kinda educational advise moreover your inform beholds very remarkable for me 이기자벳

    ReplyDelete
  58. Youre so cool! I dont suppose Ive read something like this before. So nice to seek out any person with some unique ideas on this subject. realy thank you for beginning this up. this website is one thing that’s needed on the web, somebody with a little originality 6 logement a vendre

    ReplyDelete
  59. Youre so cool! I dont suppose Ive read something like this before. So nice to seek out any person with some unique ideas on this subject. realy thank you for beginning this up. this website is one thing that’s needed on the web, somebody with a little originality courtier immobilier Candiac

    ReplyDelete
  60. Youre so cool! I dont suppose Ive read something like this before. So nice to seek out any person with some unique ideas on this subject. realy thank you for beginning this up. this website is one thing that’s needed on the web, somebody with a little originality outdoor patio seating

    ReplyDelete
  61. Youre so cool! I dont suppose Ive read something like this before. So nice to seek out any person with some unique ideas on this subject. realy thank you for beginning this up. this website is one thing that’s needed on the web, somebody with a little originality Courtier immobilier chelsea

    ReplyDelete
  62. This article gives the light in which we can observe the reality. This is very nice one and gives in-depth information. Thanks for this nice article. yoga en ligne

    ReplyDelete
  63. This article gives the light in which we can observe the reality. This is very nice one and gives in-depth information. Thanks for this nice article. Agent immobilier West Carleton

    ReplyDelete
  64. Thanks, I have been hunting for details about this subject for ages and yours is the best I ave found so far. Real estate agent West Carleton

    ReplyDelete
  65. NICE POST CHECK MY NEW POSTOK SATTAKING

    NICE POST CHECK MY NEW POSTSATTA RESULT

    NICE POST CHECK MY NEW POSTSATTAKING REAL

    ReplyDelete
  66. Very informative post! There is a lot of information here that can help any business get started with a successful social networking campaign 먹튀검증

    ReplyDelete
  67. HI~Nice stuff, do tell us when you post something like that!먹튀검증

    ReplyDelete
  68. Some information about medicine. I'll come often. Great work! 토토추천

    ReplyDelete
  69. wonderful points altogether,Perfect.Some information about medicine. 놀이터추천

    ReplyDelete