(Not) making the grade

The researchers working on Project Basecamp found significant security issues with programmable logic controller PLC they tested. Some PLCs were too brittle and insecure to even tolerate security scans and probing. The D20 ME PLC by General Electric – a widely deployed industrial system – fared t...

Security audits

A presentation on Project Basecamp was a highlight of the conference. The talk presented the findings of a volunteer-led security audit of leading programmable logic controllers PLCs. The audit found that decrepit hardware, buggy software and pitiful or nonexistent security features make thousand...

UPDATE: Looking For a 'FireSheep' Moment, Researchers Lay Bare Woeful SCADA Security

Miami, Florida – A no-holds barred presentation at the S4 Conference laid bare the woeful state of security for many industrial control systems that power the world’s critical infrastructure. Organizers have also cooperated with security scanning firms Rapid7 and Tenable to release modules for th...

Koyo DirectLogic PLC Password Brute Force Utility

This module attempts to authenticate to a locked Koyo DirectLogic PLC. The PLC uses a restrictive passcode, which can be A0000000 through A9999999. The "A" prefix can also be changed by the administrator to any other character, which can be set through the PREFIX option of this module. This modul...

Allen-Bradley/Rockwell Automation EtherNet/IP CIP Commands

The EtherNet/IP CIP protocol allows a number of unauthenticated commands to a PLC which implements the protocol. This module implements the CPU STOP command, as well as the ability to crash the Ethernet card in an affected device. This module is based on the original 'ethernetip-multi.rb' Basecam...

MicroLogix 1100 PLC Default Credentials

The remote device appears to be a MicroLogix 1100 PLC that can be accessed using default HTTP credentials. An attacker could leverage this issue to gain administrative access to the affected device. Binary data scadamicrologixdefaulthttp.nbin...

Modicon PLC HTTP Default Account/Password Detection (SCADA)

Binary data 6287.prm...

Rockwell Automation PLC HTTP Server Administrator Access Detection (SCADA)

Binary data 6285.prm...

Koyo Ecom Modules Vulnerabilities

Overview This Advisory is a follow-up to the ICS-CERT Alert titled “ICS-ALERT-12-020-05A—Koyo Ecom100 Vulnerabilities” that was originally published January 20, 2012, on the ICS-CERT web page and updated on February 14, 2012. ICS-CERT is aware of a public report of vulnerabilities with...

GE PLC telnet Server Detection (SCADA)

Binary data 6281.prm...

GE PLC telnet Server Default Account/Password (SCADA)

Binary data 6282.prm...

GE PLC telnet Server Default Account/Password (SCADA)

Binary data 6283.prm...

CVE-2011-5007

Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB AC500 PLC and possibly other products, allows remote attackers to execute arbitrary code via a long URI to TCP port 8080...

Stack overflow

Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB AC500 PLC and possibly other products, allows remote attackers to execute arbitrary code via a long URI to TCP port 8080...

CVE-2011-5007

Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB AC500 PLC and possibly other products, allows remote attackers to execute arbitrary code via a long URI to TCP port 8080...

CVE-2011-5007: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB AC500 PLC and possibly other products, allows remote attackers to execute arbitrary code via a long URI to TCP port 8080...

optima apiftp server 1.5.2.13 - Multiple Vulnerabilities

Luigi Auriemma Application: Optima APIFTP Server http://www.optimalog.com/home.html Versions: = 1.5.2.13 Platforms: Windows Bugs: A NULL pointer B endless loop Exploitation: remote Date: 13 Nov 2011 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1 Introduction 2 Bugs 3 The Co...

Duqu computer virus Detected by Iran civil defense organization

Duqu computer virus Detected by Iran civil defense organization The virus is called W32.Duqu, or just Duqu create fear after the opening Pandora's Box of Stuxnet. The head of Iran's civil defense organization told the official IRNA news agency that computers at all main sites at risk were being...

IRAI AUTOMGEN 8.0.0.7 - Use-After-Free

Luigi Auriemma Application: IRAI AUTOMGEN http://www.irai.com/a8e/ Versions: = 8.0.0.7 aka 8.022 Platforms: Windows Bug: use after free Exploitation: file Date: 10 Oct 2011 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1 Introduction 2 Bug 3 The Code 4 Fix =============== 1...

Researcher Will Demo Crippling Siemens Attack Using Metasploit

For years, there’s been an argument that the sophistication of industrial control systems is enough to keep script kiddies – or low-skilled hackers – away. Well, so much for that. Researcher Ralph Langer says that he will use a presentation at an upcoming security conference in Washington D.C. to...