Since the discovery of Stuxnet in 2010, there has been a bit of a bull’s eye on the software used to run industrial control systems. Just recently, Italian security researcher Luigi Auriemma poked a new set of holes in Supervisory Control and Data Acquisition (SCADA) products from a number of vendors, including Progea, Rockwell Automation, Cogent and Measuresoft.
Nearly all of the security vulnerabilities can be exploited to remotely execute code. Back in March, Auriemma announced the discovery of nearly three dozen zero-day vulnerabilities in SCADA products as well.
“In my opinion the security of these products is not so high, I guess it’s because this sector remained almost “untouched” till the arrival of Stuxnet,” the researcher told SecurityWeek.
For those that don’t remember, Stuxnet was seen targeting Siemens SCADA software running on Windows. Though the exact motives behind the creation and spread of Stuxnet remain the source of speculation, it was it believed to be the first piece of malware to include a programmable logic controller rootkit and shined a bright light on the security of SCADA systems.
According to Auriemma, he was able to find this latest batch of vulnerabilities with minimal effort.
“I found [the vulnerabilities] in some minutes because it was just a very quick and lazy test and not something more complete like instead I did in March,” he said via email. “Some of the vulnerabilities are very trivial to exploit; for example in one it’s enough to choose the command to execute remotely so doesn’t require even a minimal skill.”
US-CERT’s Industrial Control Systems Cyber Emergency Response Team issued a spate of advisories of its own in response to Auriemma’s findings. The researcher’s own advisories – as well as proof-of-concepts – can be found here.
Related Reading: Are Industrial Control Systems Secure?
Related Reading: How to Make the Smart Grid Smarter than Cyber Attackers
Related Reading: The Increasing Importance of Securing The Smart Grid
Related Reading: Stuck on Stuxnet – Are Grid Providers Prepared for Future Assaults?
