Protecting your ICONICS GENESIS SCADA HMI System from Security Vulnerabilities (plus White Paper)

As mentioned in a blog article we wrote earlier this week, an Italian “Security Researcher” named Luigi Auriemma published thirty-four SCADA product vulnerabilities against four SCADA products (the complete list of vulnerabilities and companies is provided in the earlier article).

Eric Byres and I have tested the vulnerabilities and today we are releasing a White Paper that analyses the ones regarding ICONICS GENESIS32 and GENESIS64 products.  The paper summarizes both the current known facts about the vulnerabilities and the actions that operators of SCADA and ICS systems can take to protect critical systems.

The Italian Job – Multiple SCADA/ICS Vulnerabilities Go Public

(Originally posted by Eric Byres on March 21, 2011 @ Practical SCADA Security)

Selling the concept of security for SCADA and ICS might still be struggling, but publishing vulnerabilities for SCADA and ICS equipment seems to be a growth industry.

Summing up Stuxnet in 4 Easy Sections (plus Handy Presentation)

(Originally posted by Eric Byres on March 21, 2011 @ Practical SCADA Security)

There has been a lot of media coverage and discussion of the Stuxnet malware, and its impact on industrial control system (ICS) and SCADA security. We are one of the groups guilty of creating a Stuxnet publishing industry.

A few weeks ago we issued a White Paper “How Stuxnet Spreads – A Study of Infection Paths in Best Practice Systems” written by Andrew Ginter, Joel Langill and I. The paper is a 26 page deep dive into how Stuxnet could migrate from the Internet to an isolated ICS, including a discussion of what can be learned from Stuxnet’s pathways.

Now, frankly, I am sick of Stuxnet. If you are one of our regular readers, you might be as well. However, being sick of a threat doesn’t make it go away. So far, very little has changed in our industry; we still need to address the issues that Stuxnet exposed.

Furthermore, I am constantly surprised how little upper management in the industry knows about the worm. I am not expecting that the CEO of “Real Big Corporation” knows the technical details, but it would be good if he or she at least understood the basics. Otherwise, it is hard to get ICS security the attention it deserves.

So today, we are publishing a presentation that abridges the findings of the "How Stuxnet Spreads" White Paper, and is a summarization of a lot of information on Stuxnet. If you need a crash course on Stuxnet, or a presentation for management, this may come in handy.  Below is a synopsis of the presentation, and a link to the download for it.

Agora+ SCADA Exploit Pack for CANVAS

GLEG ltd. is pleased to announce Agora SCADA+ exploit pack that is entirely focused on industrial software and hardware vulnerabilities.

Are the NERC CIPs a roadmap for attacking the electric grid?

By Joe Weiss

The NERC CIPs have a number of characteristics that make them a roadmap for attacking the electric grid. - They were developed by the NERC consensus process. The process is long, arduous, and inherently a “low bar”. As such, the process results in trying to make it easier on the “attackee” than trying to make it more difficult on the attacker.

How Stuxnet Spreads - A Study of Infection Paths in Best Practice Systems

A new White Paper, "How Stuxnet Spreads – A Study of Infection Paths in Best Practice Systems" has just been released by Eric Byres (Byres Security), Andrew Ginter (Abterra Techologies), and myself. The paper details how Stuxnet could infect a control system site protected by a high security architecture. It shows that current best practices are insufficient to block advanced threats and it discusses what operators of control and SCADA systems need to do to protect critical systems from future threats like Stuxnet.

McAfee: Data-theft attack hits oil industry

McAfee: data-theft attack hits oil industry

by Stephen Shankland (CNET News)

For years, companies in the oil and energy industry have been the victims of attempts to steal e-mail and other sensitive information from hackers believed to be in China, McAfee said yesterday.
The attacks, to which McAfee gave the sinister name "Night Dragon," penetrated company networks through Web servers, compromised desktop computers, bypassed safeguards by misusing administrative credentials, and used remote administration tools to obtain the information, the security firm said. McAfee and other security companies now have identified the method and can provide a defense,