Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Hacker to go public with Siemens SCADA control flaws

NSS Labs to disclose Siemens flaws at Black Hat

Article comments

A security researcher who says he's found serious problems with Siemens computers used in power plants and heavy industry is now expecting to go public with his research at the Black Hat security conference.

In May, NSS Labs Researcher Dillon Beresford pulled out of another hacking conference at the last minute when Siemens was unable to fix problems he'd found in the firmware of its S7 programmable logic controller.

After consulting with Siemens and the US Department of Homeland security, NSS decided that it was simply too dangerous to go public with its information before a patch could be fully developed. The systems Beresford had hacked are used to run power and chemical plants, some of which could be damaged if they were hit by a computer attack.

Now NSS Labs CEO Rick Moy says Beresford is re-scheduled to deliver his talk at Black Hat in August.

Beresford has discovered six vulnerabilities in the S7 that "allow an attacker to have complete control of the device," Moy said. Devices like the S7 do things such as control how fast a turbine spins or open gates on dams. The attack was developed on an S7-1200 system, but NSS believes other models of the S7 are also vulnerable.

For Beresford's attack to work, a hacker would have to first be on the same network as the Siemens system. Industrial systems like the S7 are often designed to run on "air-gapped" networks that are physically separated from the rest of the plant's computer systems. That would protect them from Beresford's attack, but security researchers have shown that it's often possible to reach these networks from the Internet. The Stuxnet worm, for example jumped across networks by infecting USB drives.

Breaking into some industrial networks would be even easier than that, according to Moy. "The dirty little secret about [such industrial] systems in general is that very few are properly air-gapped," he said.

NSS Labs expects Siemens to issue a patch in the next few weeks, well ahead of the August presentation. "They didn't give any firm timelines," he said. "They said unofficially that they were pretty confident that they'll be able to get their stuff out before then."

Siemens could not immediately be reached for comment.

However, in previous statements, the company has implied that the NSS attack might be hard to pull off in the real world. "While NSS Labs has demonstrated a high level of professional integrity by providing Siemens access to its data, these vulnerabilities were discovered while working under special laboratory conditions with unlimited access to protocols and controllers," Siemens said.

Beresford wasn't impressed with that comment. He called for Siemens to publish a security advisory on the bugs along with a timetable of when they will be fixed. "Now that they're trying to minimise the impact and do PR damage control, I feel that they're not servicing the public's interest," he said. "I'm not pleased with their response... They didn't provide enough information to the public."



Share:

More from Techworld

More relevant IT news

Comments



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *