SCADA Vendors Still Need Security Wake Up Call

Companies that make supervisory control and data acquisition SCADA and industrial control software are still dangerously lax when it comes to application security and vulnerable to attack, according to a researcher from security firm Tenable Inc. who warned that the use of coded administrative...

Security Firms Scramble For SCADA Talent After Stuxnet

Three months after the world first learned of the sophisticated Stuxnet worm, insiders say that there’s a scramble to find and hire engineers with knowledge of both security and the industrial control systems that were Stuxnet’s intended target. Anti virus companies admit their research teams wer...

More Secure Software Needed for Utilities, NERC CSO Says

It took a malware attack with an unprecedented level of sophistication to make it happen, but officials in charge of the security of much of the country’s electrical grid have come ot the conclusion that there is a need for more secure software and better security processes and procedures to...

Rethinking Stuxnet

It’s hard to think of a story in the last few years that has generated more hype, conjecture, posturing, hyperbole and misdirection than Stuxnet, with the possible exception of the Aurora attacks. The commentary and hype around Stuxnet has shifted and morphed over the last few months, and now it...

Netbiter webSCADA Disclosure

STANKOINFORMZASCHITA-10-01 Netbiter® webSCADA – multiple vulnerabilities Authors: Eugene Salov [email protected], Andrej Komarov [email protected] Product: Netbiter® webSCADA CVSS v2 Base Score: 9.0 AV:N/AC:L/Au:R/C:C/I:C/A:C Impact Subscore: 10.0 Exploitability Subscore: 8.0 Availability of...

Stuxnet Analysis Supports Iran-Israel Connections

VANCOUVER – A Symantec researcher filled in more critical details about the Stuxnet worm here, demonstrating the worm’s ability to take control of programmable logic controllers PLCs by Siemens Inc. and disable machinery connected to them. Liam O’Murchu of Symantec, speaking at the Virus Bulletin...

All Eyes On Stuxnet At Annual Virus Researcher Summit

The world will know more about the mysterious Stuxnet virus by week’s end, after top virus researchers reveal the findings of their post mortem on Stuxnet at the annual Virus Bulletin Conference. HED: All eyes on Stuxnet at annual virus researcher summit DEK: Researchers will reveal new details...

Microsoft Missed 2009 Published Article on Stuxnet-Type Attack

A security flaw affecting Microsoft’s Windows operating system that was exploited by the Stuxnet worm was publicly disclosed more than a year before the worm appeared, according to a researcher at Symantec Corp. On September 17, Symantec researcher Liam O Murchu noted on that company’s Connect bl...

New Certifications Will Set High Bar for IT Security Pros

A new non-profit group is developing certifications for information technology security professionals that will set a high bar for IT security practitioners in areas like penetration testing, code auditing and control systems operation. The National Board of Information Security Examiners NBISE i...

Wonderware SuiteLink null pointer dereference

Overview A vulnerability in the way Wonderware SuiteLink handles malformed TCP packets could result in a denial of service. Description Wonderware SuiteLink is a protocol based on TCP/IP that runs as a service listening for connections on port 5413/tcp on Microsoft Windows operating systems. A...

Gesytec Easylon OPC Server fails to properly validate OPC server handles

Overview The Gesytec Easylon OPC Server contains a vulnerability that may allow a remote attacker to execute arbitary code or cause a denial-of-service condition. Description OLE for Process Control OPC is a specification for a standard set of OLE COM objects used in the process control and...

Is backup required?

Do you need Backup? Introduction. Main features of backup. Risks. RAID. Cluster systems. Shadow copy. Version control systems. Application level recovery. Backup security. Version control systems Modern version control systems such as CVS, Subversion, or commercial products can and sometimes quit...

Is backup required?

Do you need Backup? Introduction. Main features of backup. Risks. RAID. Cluster systems. Shadow copy. Version control systems. Application level recovery. Backup security. The introduction of any technology is associated with costs and risks in one way or another. This applies to backup as much a...

MCCS (Multi-Computer Control Systems) Command DoS Exploit

No description provided by source. !usr/bin/perl MCCS Server\Client Command DOS Exploit -------------------------------------- Infam0us Gr0up - Securiti Research Info: infamous.2hell.com Vendor URL: www.xclusive-software.com use IO::Socket; print"\n MCCS Command DOS Exploit\n";...

MCCS (Multi-Computer Control Systems) Command - Denial of Service

MCCS Multi-Computer Control Systems Command - Denial of Service !usr/bin/perl MCCS Server\Client Command DOS Exploit -------------------------------------- Infam0us Gr0up - Securiti Research Info: infamous.2hell.com Vendor URL: www.xclusive-software.com use IO::Socket; print"\n MCCS Command DOS...