SCADA software still highly vulnerable
Security researchers have uncovered more than 50 vulnerabilities in the latest version of WinCC, which is a type of SCADA system used in factories and industrial control systems to control physical systems. Sergey Gordeychik and Gleb Gritsai from Moscow-based Positive Technologies, presented an overview of their research at the Power of Community security conference held in Seoul yesterday.
Gordeychik had originally intended to present his findings about WinCC at Defcon in July, but pulled it after a request from Siemens for more time to patch its WinCC software. Siemens was reported as requesting at least one other security researcher to cancel a planned talk on how to build SCADA malware earlier in May.
Speaking to Network World, Gordeychik said that there were so many flaws that Siemens has worked out a roadmap to resolve them. What is worrying is how many of these problems could allow an attacker to remotely compromise a vulnerable system. As of now, WinCC is still full of other dangerous vulnerabilities, according to the researchers who withheld specific details of unpatched flaws.
Despite the many security issues that were discovered, Gordeychik praised Siemens for being receptive to findings from Positive Technologies. Gordeychik alluded to the company experiencing the same kind of security wake-up that Microsoft experienced when the Code Red worm appeared in 2001. He noted: "Other SCADA vendors don't want to talk about security at all."
- check out this article at Network World