Power Grid Honeypot Puts Face on Attacks

TENERIFE, Spain –The rhetoric around hacking the power grid would have you believe it’s a relatively mundane practice. Policymakers, intelligence agencies and vendors, for example, spread the word gleefully, leaning on scenarios such as state-sponsored hackers shutting off the lights in the dead ...

Vulnerabilities in IniNet Solutions GmbH’s SCADA Web Server, allowing a perpetrator to execute arbitrary code

The multiple vulnerabilities of IniNet Solutions GmbH’s SCADA Web Server are caused by buffer overflows in the stack. Exploitation of these vulnerabilities could allow a malicious actor to execute arbitrary code using a long HTTP request field...

BlackEnergy APT Group Spreading Malware via Tainted Word Docs

Attackers have begun using rigged Microsoft Word documents propagated via spearphishing emails to spread the BlackEnergy Trojan. Researchers with Kaspersky Lab’s Global Research and Analysis Team discovered a malicious Word document last week that appears to stem from a campaign against one of th...

iniNet SpiderControl SCADA Web Server Detection

Binary data scadaininetspidercontrolscadawebserverdetect.nbin...

iniNet SpiderControl SCADA Web Server 2.02 Local Privilege Escalation

Binary data scadaininetspidercontrolscadawebserver202.nbin...

iniNet SpiderControl PLC Editor Beckhoff Detection

Binary data scadaappininetspidercontrolplceditorbeckhoffdetect.nbin...

iniNet SpiderControl SCADA Editor Detection

Binary data scadaappininetspidercontrolscadaeditordetect.nbin...

iniNet SpiderControl SCADA Editor 6.30.01 Local Privilege Escalation

Binary data scadaininetspidercontrolscadaeditor63001.nbin...

Advantech WebAccess stack buffer overflow vulnerability (CNVD-2016-00434)

WebAccess HMI/SCADA software provides remote control and management, allowing users to easily view and configure automation devices in facility management systems, power stations and building automation systems. Multiple stack buffer overflow vulnerabilities exist in Advantech WebAccess versions...

Ecava IntegraXor Vulnerabilities

OVERVIEW Independent security researcher Marcus Richerson and Steven Seeley of Source Incite, working with Trend Micro’s Zero Day Initiative, independently identified vulnerabilities in Ecava’s IntegraXor application. Ecava has produced a new version to mitigate these vulnerabilities. Marcus...

Sandworm Team and the Ukrainian Power Authority Attacks

Update 1.11.16 - SANS ICS Team Connects Dots Updating the blog entry to bring attention to the recent analysis published by Mike Assante from the SANS ICS team. "After analyzing the information that has been made available by affected power companies, researchers, and the media it is clear that...

Sandworm Team and the Ukrainian Power Authority Attacks

Update 1.11.16 - SANS ICS Team Connects Dots Updating the blog entry to bring attention to the recent analysis published by Mike Assante from the SANS ICS team. "After analyzing the information that has been made available by affected power companies, researchers, and the media it is clear that...

Hackers Cause World's First Power Outage with Malware

SCADA system has always been an interesting target for cyber crooks, given the success of Stuxnet malware that was developed by the US and Israeli together to sabotage the Iranian nuclear facilities a few years ago, and "Havex" that previously targeted organizations in the energy sector. Now once...

Nordex Control 2 (NC2) SCADA 16 Cross Site Scripting

Nordex NC2 XSS Vulnerability AFFECTED PRODUCTS Nordex Control 2 NC2 SCADA V16 and prior versions. Nordex is a company based in Germany that maintains offices in countries around the world. The affected product, Nordex Control 2, is a web-based SCADA system for wind power plants. According to...

Motorola Solutions MOSCAD SCADA IP Gateway Arbitrary File Download Vulnerability

Motorola Solutions MOSCAD SCADA IP Gateway is a Web-based SCADA system that provides management functions from Motorola Motorola Solutions. An arbitrary file download vulnerability exists in Motorola Solutions MOSCAD SCADA IP Gateway. A remote attacker could use this vulnerability to read arbitra...

Collection Of Awesome Honeypots

A curated list of awesome honeypots, tools, components and much more. The list is divided into categories such as web, services, and others, focusing on open source projects. Honeypots Database Honeypots Elastic honey - A Simple Elasticsearch Honeypot mysql - A mysql honeypot, still very very...

SCADA Engine BACnet OPC Server Vulnerabilities

OVERVIEW Independent researcher Josep Pi Rodriguez has identified three vulnerabilities in the SCADA Engine BACnet OPC Server application. SCADA Engine has produced a new software version that mitigates these vulnerabilities. Josep Pi Rodriguez has tested the new software version to validate that...

iniNet SpiderControl PLC Editor Simatic 6.30.04 - Insecure File Permissions

iniNet SpiderControl PLC Editor Simatic 6.30.04 - Insecure File Permissions iniNet SpiderControl PLC Editor Simatic 6.30.04 Insecure File Permissions Vendor: iniNet Solutions GmbH Product web page: http://www.spidercontrol.net Affected version: 6.30.04 Build 6300400 Summary: Modular and automated...

iniNet SpiderControl SCADA Editor 6.30.01 Privilege Escalation Vulnerability

iniNet SpiderControl SCADA Editor version 6.30.01 suffers from an insecure file permission vulnerability that can lead to privilege escalation. iniNet SpiderControl SCADA Editor 6.30.01 Insecure File Permissions Vendor: iniNet Solutions GmbH Product web page: http://www.spidercontrol.net Affected...

GEOVAP Reliance 4 Control Server Privilege Escalation Vulnerability

GEOVAP Reliance 4 Control Server suffers from an unquoted search path issue impacting the service 'RelianceOpcDaWrapper' for Windows deployed as part of Reliance 4 SCADA/HMI system installer including Reliance OPC Server. This could potentially allow an authorized but non-privileged local user to...