Stuxnet-style SCADA attack kept quiet after US gov tests

'Industrial grade malware without nation state backing'


Security researchers decided to cancel a planned demonstration of security holes in industrial control systems from Siemens following requests from the German manufacturer and a security response team.

Dillon Beresford, a security analyst at NSS Labs, and independent security researcher Brian Meixell were due to make a presentation – entitled Chain Reactions–Hacking SCADA – at the TakeDown Conference in Dallas on Wednesday.

They shared their research beforehand with Siemens, ICS-CERT (Industrial Control Systems Cyber Emergency Response Team – a division of the Department of Homeland Security), and the Idaho National Lab. Siemens asked the two researchers to hold fire on the talk, which covered possible mechanisms to attack industrial control systems along with a practical demonstration.

Beresford and Meixell agreed to delay their presentation. "We were asked very nicely if we could refrain from providing that information at this time," Beresford told CNET. "I decided on my own that it would be in the best interest of security to not release the information."

Later, speaking to Wired, Beresford added that the "DHS in no way tried to censor the presentation". Beresford said that he had found multiple vulnerabilities in the SCADA systems he tested, without saying what these bugs might be. At least one of the security flaws may affect multiple vendors.

NSS Labs stressed that no legal pressure had been placed on Beresford to cancel the talk, which he postponed because the proposed mitigation techniques suggested by Siemens were insufficient to deal with threats the talk would have highlighted.

A synopsis of the cancelled talk explains:

SCADA exploits have recently taken center stage in the international community. These types of vulnerabilities pose significant threats to critical infrastructure. Combining traditional exploits with industrial control systems allows attackers to weaponize malicious code, as demonstrated with Stuxnet. The attacks against Iran’s nuclear facilities were started by a sequence of events that delayed the proliferation of nuclear weapons.

We will demonstrate how motivated attackers could penetrate even the most heavily fortified facilities in the world, without the backing of a nation state. We will also present how to write industrial grade malware without having direct access to the target hardware. After all, if physical access was required, what would be the point of hacking into an industrial control system?

Security shortcomings in the Programmable Logic Controllers within SCADA systems from Siemens were the target of the infamous Stuxnet worm, which Iranian authorities have admitted infiltrated its nuclear facilities and sabotaged systems. SCADA systems control everything from valves on oil and gas pipeline to energy grids, heat sensors in power plants and bottle washers in beverage manufacturing factories.

In a blog post explaining the decision to postpone the SCADA security talk, NSS Labs explained that "significant additional vulnerabilities in industrial control systems have been identified, responsibly disclosed and validated by affected parties".

It added: "Due to the serious physical, financial impact these issues could have on a worldwide basis, further details will be made available at the appropriate time. Legitimate owners/operators of leading SCADA PLCs may contact us for further information." ®

Similar topics


Other stories you might like

  • CISA and friends raise alarm on critical flaws in industrial equipment, infrastructure
    Nearly 60 holes found affecting 'more than 30,000' machines worldwide

    Updated Fifty-six vulnerabilities – some deemed critical – have been found in industrial operational technology (OT) systems from ten global manufacturers including Honeywell, Ericsson, Motorola, and Siemens, putting more than 30,000 devices worldwide at risk, according to private security researchers. 

    Some of these vulnerabilities received CVSS severity scores as high as 9.8 out of 10. That is particularly bad, considering these devices are used in critical infrastructure across the oil and gas, chemical, nuclear, power generation and distribution, manufacturing, water treatment and distribution, mining and building and automation industries. 

    The most serious security flaws include remote code execution (RCE) and firmware vulnerabilities. If exploited, these holes could potentially allow miscreants to shut down electrical and water systems, disrupt the food supply, change the ratio of ingredients to result in toxic mixtures, and … OK, you get the idea.

    Continue reading
  • Inside the RSAC expo: Buzzword bingo and the bear in the room
    We mingle with the vendors so you don't have to

    RSA Conference Your humble vulture never liked conference expos – even before finding myself on the show floor during a global pandemic. Expo halls are a necessary evil that are predominatly visited to find gifts to bring home to the kids. 

    Do organizations really choose security vendors based on a booth? The whole expo hall idea seems like an outdated business model – for the vendors, anyway. Although the same argument could be made for conferences in general.

    For the most part, all of the executives and security researchers set up shop offsite – either in swanky hotels and shared office space (for the big-wigs) or at charming outdoor chess tables in Yerba Buena Gardens. Many of them said they avoided the expo altogether.

    Continue reading
  • 1Password's Insights tool to help admins monitor users' security practices
    Find the clown who chose 'password' as a password and make things right

    1Password, the Toronto-based maker of the identically named password manager, is adding a security analysis and advice tool called Insights from 1Password to its business-oriented product.

    Available to 1Password Business customers, Insights takes the form of a menu addition to the right-hand column of the application window. Clicking on the "Insights" option presents a dashboard for checking on data breaches, password health, and team usage of 1Password throughout an organization.

    "We designed Insights from 1Password to give IT and security admins broader visibility into potential security risks so businesses improve their understanding of the threats posed by employee behavior, and have clear steps to mitigate those issues," said Jeff Shiner, CEO of 1Password, in a statement.

    Continue reading

Biting the hand that feeds IT © 1998–2022