Wonderware Information Server

Overview ICS-CERT Advisory ICSA-11-195-01P was originally released to the US-CERT Portal on July 14, 2011. This web page release was delayed to allow users sufficient time to download and install the update. Independent security researchers Billy Rios and Terry McCorkle have identified a...

Stuxnet Worm Revealed – Installation, Injection and Mitigation !

In the videos below, Joel Langill deconstructs each part of the worm to show it in action. In the second video you'll see the best practices that InfoSec Institute uses we have a training course dedicated to SCADA control systems which includes a robust Stuxnet lab to mitigate this type of...

Moxa Device Manager Tool MDM2_Gateway Response Remote Overflow

Binary data moxamdmtool23.nbin...

NY Times: Stuxnet Traced to Five Iranian Internet Domains

The Stuxnet Worm attempted to infiltrate five industrial complexes in Iran over a span of ten months according to a report in the New York Times based on a Stuxnet Dossier published by Symantec. Stuxnet was designed to not only attack industrial control systems built by Siemens Corporation, which...

Exposing SCADA Systems With Shodan

Editor’s Note: The U.S.’s Industrial Control System Computer Emergency Response Team ICS-CERT recently issued a warning to its members about the ability of attackers to discover ICS systems using a simple search on Shodan, a public search engine that is used to locate systems accessible from the...

[SECURITY] Fedora 12 Update: pootle-2.1.2-1.fc12

Pootle is web application for managing distributed or crowdsourced translation. It's features include:: Translation of Gettext PO and XLIFF files. Translation of monolingual files subtitles, Java properties, etc Submitting to remote version control systems VCS. Managing groups of translators Onli...

[SECURITY] Fedora 13 Update: pootle-2.1.2-1.fc13

Pootle is web application for managing distributed or crowdsourced translation. It's features include:: Translation of Gettext PO and XLIFF files. Translation of monolingual files subtitles, Java properties, etc Submitting to remote version control systems VCS. Managing groups of translators Onli...

Search Engine Finds Vulnerable SCADA Systems

UPDATED: ICS-CERT, the emergency response team for industrial control systems, has warned companies that run SCADA Supervisory Control and Data Acquisition software that the systems running it may be easily discovered using a free Web based search engine dubbed Shodan. The warning came in the for...

Richard Clarke Highlights Overlapping Techniques in Cyber Crime, Espionage, and Warfare

The difference between cyber crime, cyber espionage, and cyber war is often just a matter of a few keystrokes, as they use the same techniques. Richard Clarke, chairman of Good Harbor Consulting, highlighted this during his keynote at the RSA Europe 2010 conference in London. Cyber Crime Cyber...

SCADA Vendors Still Need Security Wake Up Call

Companies that make supervisory control and data acquisition SCADA and industrial control software are still dangerously lax when it comes to application security and vulnerable to attack, according to a researcher from security firm Tenable Inc. who warned that the use of coded administrative...

Security Firms Scramble For SCADA Talent After Stuxnet

Three months after the world first learned of the sophisticated Stuxnet worm, insiders say that there’s a scramble to find and hire engineers with knowledge of both security and the industrial control systems that were Stuxnet’s intended target. Anti virus companies admit their research teams wer...

More Secure Software Needed for Utilities, NERC CSO Says

It took a malware attack with an unprecedented level of sophistication to make it happen, but officials in charge of the security of much of the country’s electrical grid have come ot the conclusion that there is a need for more secure software and better security processes and procedures to...

Rethinking Stuxnet

It’s hard to think of a story in the last few years that has generated more hype, conjecture, posturing, hyperbole and misdirection than Stuxnet, with the possible exception of the Aurora attacks. The commentary and hype around Stuxnet has shifted and morphed over the last few months, and now it...

Netbiter webSCADA Disclosure

STANKOINFORMZASCHITA-10-01 Netbiter® webSCADA – multiple vulnerabilities Authors: Eugene Salov [email protected], Andrej Komarov [email protected] Product: Netbiter® webSCADA CVSS v2 Base Score: 9.0 AV:N/AC:L/Au:R/C:C/I:C/A:C Impact Subscore: 10.0 Exploitability Subscore: 8.0 Availability of...

Stuxnet Analysis Supports Iran-Israel Connections

VANCOUVER – A Symantec researcher filled in more critical details about the Stuxnet worm here, demonstrating the worm’s ability to take control of programmable logic controllers PLCs by Siemens Inc. and disable machinery connected to them. Liam O’Murchu of Symantec, speaking at the Virus Bulletin...

All Eyes On Stuxnet At Annual Virus Researcher Summit

The world will know more about the mysterious Stuxnet virus by week’s end, after top virus researchers reveal the findings of their post mortem on Stuxnet at the annual Virus Bulletin Conference. HED: All eyes on Stuxnet at annual virus researcher summit DEK: Researchers will reveal new details...

Microsoft Missed 2009 Published Article on Stuxnet-Type Attack

A security flaw affecting Microsoft’s Windows operating system that was exploited by the Stuxnet worm was publicly disclosed more than a year before the worm appeared, according to a researcher at Symantec Corp. On September 17, Symantec researcher Liam O Murchu noted on that company’s Connect bl...

New Certifications Will Set High Bar for IT Security Pros

A new non-profit group is developing certifications for information technology security professionals that will set a high bar for IT security practitioners in areas like penetration testing, code auditing and control systems operation. The National Board of Information Security Examiners NBISE i...

Wonderware SuiteLink null pointer dereference

Overview A vulnerability in the way Wonderware SuiteLink handles malformed TCP packets could result in a denial of service. Description Wonderware SuiteLink is a protocol based on TCP/IP that runs as a service listening for connections on port 5413/tcp on Microsoft Windows operating systems. A...

Gesytec Easylon OPC Server fails to properly validate OPC server handles

Overview The Gesytec Easylon OPC Server contains a vulnerability that may allow a remote attacker to execute arbitary code or cause a denial-of-service condition. Description OLE for Process Control OPC is a specification for a standard set of OLE COM objects used in the process control and...