Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Most Vulns Exploited By Stuxnet Worm Remain Unpatched

timothy posted more than 3 years ago | from the leaping-into-the-mortar-crater dept.

Security 44

chicksdaddy writes with this excerpt from ThreatPost: "The media storm over the Stuxnet worm may have passed, but many of the software holes that were used by the worm remain unpatched and leave Siemens customers open to a wide range of potentially damaging cyber attacks, according to industrial control system expert Ralph Langner. Writing on his personal blog, Langner said that critical vulnerabilities remain in Windows-based management applications and software used to directly manage industrial controllers by Siemens Inc., whose products were targeted by the Stuxnet worm, Threatpost reports."

cancel ×

44 comments

Sorry! There are no comments related to the filter you selected.

Vulns? (4, Interesting)

Enderandrew (866215) | more than 3 years ago | (#36376368)

When did vulns become a word?

And is it really a new story that many companies don't patch immediately for every vulnerability out there?

Re:Vulns? (2, Insightful)

ArhcAngel (247594) | more than 3 years ago | (#36376390)

First 23,000 filesharing Does and now Vulns...WTF? Did /. hire someone from gizmodo or engadget?

Re:Vulns? (2)

Lunix Nutcase (1092239) | more than 3 years ago | (#36376464)

The first one is correct. It is 'Does' as in plural "John Doe [wikipedia.org] ".

Re:Vulns? (0)

Anonymous Coward | more than 3 years ago | (#36376586)

No, John Does is plural. Does is a lot of female deer. Vulns is just gibberish.

Re:Vulns? (2)

bberens (965711) | more than 3 years ago | (#36377336)

The plural of doe is doe. The plural of Doe is Does. Capitalization matters.

Re:Vulns? (1)

ArhcAngel (247594) | more than 3 years ago | (#36376874)

John Does is correct. Does is lazy and incorrect.

Re:Vulns? (1)

Bacon Bits (926911) | more than 3 years ago | (#36379140)

'John and Jane Does' is correct. 'John Does' is lazy and sexist.

Re:Vulns? (0)

Anonymous Coward | more than 3 years ago | (#36379338)

"Johns Doe"

Re:Vulns? (2)

chemicaldave (1776600) | more than 3 years ago | (#36377042)

When did vulns become a word?

Apparently, some years ago. Here's [vuln.sg] a vulnerability information site created in 2006. [whoisdomain.net]

And is it really a new story that many companies don't patch immediately for every vulnerability out there?

It is when we're talking about a high-profile vulnerability.

Re:Vulns? (1)

catmistake (814204) | more than 3 years ago | (#36377104)

Whatever. I've been running my Siemann's centrifuge at home for years without AV or patches... I go online every day, and my system is still tight. Only idiots get viruses.

Re:Vulns? (0)

Anonymous Coward | more than 3 years ago | (#36377146)

Since the day that slashdot has a stupid 'Working' label at the bottom of the browser that doesn't go away.

Re:Vulns? (0)

Anonymous Coward | more than 3 years ago | (#36380526)

Shhhh. It's busy!

Re:Vulns? (1)

dloose (900754) | more than 3 years ago | (#36377858)

When did vulns become a word?

So happy this was the first reply. What an obnoxious headline.

Let's be hype and use stupid abbreviations. (2)

pep939 (1957678) | more than 3 years ago | (#36376384)

Vulns sounds much cooler than Vulnerabilities anyway. Lulz.

Power plants (1)

instagib (879544) | more than 3 years ago | (#36376392)

Let's just hope such devices are not used in nuclear power plants. BTW, are power plants connected to the Internet?

Re:Power plants (1)

Lunaritian (2018246) | more than 3 years ago | (#36376400)

Wasn't the target of Stuxnet some nuclear power plant in Iran?

Re:Power plants (0)

Anonymous Coward | more than 3 years ago | (#36376444)

It was uranium enriching facilities, not power plants, the idea was to prevent the iranians form enriching uranium to obtain nuclear weapons.

Not quite. Uranium enrichment plants. (2)

mmell (832646) | more than 3 years ago | (#36376542)

A place which makes fuel for a nuclear power plant - in this instance, a nuclear power plant designed to release terawatts of power over the course of a few milliseconds.

Re:Power plants (1)

228e2 (934443) | more than 3 years ago | (#36376972)

Nah, they are on their own network, aka "air-gaped". They are compromised when idiots dont use proper cross domain solutions like usb drives, or even worse intermingle computers on restricted networks and the internet.

Re:Power plants (1)

idontgno (624372) | more than 3 years ago | (#36377072)

"air-gaped"

<style voice="InigoMontoya">
I do not think it means what you think it means.
</style>

Let's just say I'm not gonna google "gaped" at work. I'm just sayin'.

Re:Power plants (1)

grassy_knoll (412409) | more than 3 years ago | (#36377816)

According to this article [computerworld.com] original versions of stuxnet attempted to spread via USB and while it did apparently spread it didn't spread far enough to hit the targeted system. Seems like the "spread via infected laptop" is the most likely.

Re:Power plants (0)

Anonymous Coward | more than 3 years ago | (#36377742)

I would say, yes they are, however the Siemens systems should not be directly connected to the out side world. IIRC the Stuxnet worm was ment to infect the Siemens systems via flash drive. It would infect non-control systems, hoping someone would cross contaminate the Siemens system with a infected flash drive from one of the non-control systems. I would imagine that most power plants operate in a similar fashion, however the threat could be mitigated by policy implementations (if the employee's followed them)

Re:Power plants (1)

sjames (1099) | more than 3 years ago | (#36380984)

Hope springs eternal!

put on tinfoil hats (0)

Anonymous Coward | more than 3 years ago | (#36376534)

Of course it's unpatched, the governments responsible for stuxnet have probably mandated that those vulns be left available for them.

Of course.... (0)

Anonymous Coward | more than 3 years ago | (#36376544)

if they got fixed, then the Western governments would be without backdoors into the systems of the Iranians, etc.

If you're firewalled the vuln is not a worry. (3, Informative)

grink (116056) | more than 3 years ago | (#36376644)

In the electric utility industry if you are considered bulk power and have critical assets your firewalls must be configured with DENY (http://www.nerc.com/files/CIP-005-3.pdf) as the default rule and only allow defined connections. All the big players in the US and Canada have their control networked segmented off and they don't have access to the Internet.

Re:If you're firewalled the vuln is not a worry. (0)

Anonymous Coward | more than 3 years ago | (#36376956)

I think this is a perfect example of someone who believes that if it's written so shall it be done.

This is not the real world.

SCADA systems are installed everywhere, not in datacenters with proper layered defense strategies. You simply cannot manage the hacked together networks in order to provide full remote access to these control systems which is demanded.

Security is an after thought.

Re:If you're firewalled the vuln is not a worry. (0)

Anonymous Coward | more than 3 years ago | (#36377256)

What kind of person doesn't have their firewall configured with DENY as default and only allow defined connections? If your firewall is configured to ALLOW by default and then you add rules to DENY specific things you are doing it wrong.

Re:If you're firewalled the vuln is not a worry. (1)

biodata (1981610) | more than 3 years ago | (#36377408)

It's one thing to set the defaults on the firewalls but another about who gets let inside? How many of these organisations employ oversees or offshore IT contractors with access inside the firewalls?

Re:If you're firewalled the vuln is not a worry. (0)

Anonymous Coward | more than 3 years ago | (#36379840)

CIP-004 requires a Personel Risk Assessment done for each individual with access and CIP-005 which requires strong authentication for starters. CAN-0005 forbids remote access for a device that is not inside a PSP/ESP and treating the remote access device as a CCA, which in turn makes it subject to CIP-005 & CIP-007. The only exception I could see to provide remote support insight into what you're doing would be if you had a method to allow remote support to see your screen, but not have any sort of control. We have regulations to cover this, regular audits, and fines that back it up ($1M/violation/day).

http://www.ferc.gov/enforcement/civil-penalties.asp [ferc.gov]

Re:If you're firewalled the vuln is not a worry. (0)

Anonymous Coward | more than 3 years ago | (#36377416)

As Stuxnet demonstrated, infecting a laptop that will eventually be used to configure a SCADA system can be enough The Internet does not have to be the attack vector and most people attacking a SCADA system are probably not worried about ex-filtrating data and just want to cause damage to/with the SCADA equipment.

Re:If you're firewalled the vuln is not a worry. (1)

chuckugly (2030942) | more than 3 years ago | (#36377632)

From what I recall the Iranians were pwned via thumb drives ......

Re:If you're firewalled the vuln is not a worry. (2)

grassy_knoll (412409) | more than 3 years ago | (#36377872)

Firewall won't help you against a infected laptop connecting directly to a PLC.

See this article [computerworld.com] or, even better, Ralph Langner's TED talk [ted.com] .

Re:If you're firewalled the vuln is not a worry. (1)

betterunixthanunix (980855) | more than 3 years ago | (#36377878)

Security should not be based on a single system like that. Your firewall may be compromised, an attacker may access to a system behind the firewall, etc. It is just bad practice to leave critical vulnerabilities unpatched.

Re:If you're firewalled the vuln is not a worry. (0)

Anonymous Coward | more than 3 years ago | (#36378110)

In the electric utility industry if you are considered bulk power and have critical assets your firewalls must be configured with DENY (http://www.nerc.com/files/CIP-005-3.pdf) as the default rule and only allow defined connections. All the big players in the US and Canada have their control networked segmented off and they don't have access to the Internet.

Except that's not how Stuxnet worked: it infected Windows machines, and then tried to find the Siemens' SCADA control software, and then infect that.

It doesn't matter whether the controllers were network enabled, as long as the desktops/laptops were. Even if they weren't, you could perhaps infect the PCs via USB keys.

Re:If you're firewalled the vuln is not a worry. (0)

Anonymous Coward | more than 3 years ago | (#36380662)

Iran's nuclear program facilities had firewalls configured with "DENY as the default rule" and weren't worrying about any "vuln" either. Haha.

Re:If you're firewalled the vuln is not a worry. (1)

sjames (1099) | more than 3 years ago | (#36381088)

So, how many have deny by default and each port (udp and tcp) from 1-65532 individually permitted for any source address?

How many have "no access to the internet" but wide open access to poorly protected machines that do have full internet access?

Of course, Iran's downfall was the sneakernet connection between the red and black networks.

Blackhat (2, Interesting)

Anonymous Coward | more than 3 years ago | (#36376762)

The blackhat presentation that supposedly will happen, though i believe the presentation will be killed at the last minute if not sooner, will shed light on a system that NO ONE at the top wants people to know about.

These systems are EVERYWHERE. They are ALL broken.

This isn't "chicken little", the DHS has already put an end to full disclosure of SCADA vulnerabilities and that only happens when they're REALLY scared.

People deserve to know the truth about these systems. If they are attacked it's the direct responsibility of the people who implemented the systems which will turn out to be lowest bidder contracted help with little to no dedication to security.

WE DESERVE EVERYTHING WE GET!

Re:Blackhat (1)

AB3A (192265) | more than 3 years ago | (#36378114)

Uh, no. DHS did not squelch anything. They made a request and NSS labs obliged.

This is important: the issue here is not about the PLC, it is about the process it controls. Ultimately Siemens is the small fry here. The real problem are the utilities and other critical infrastructure that depend upon this stuff. They can't just throw a patch at it like you would do with a PC. They have to validate that patch and that means expensive down time and careful planning. There are literally months when logistics prevent me from patching. Divulging this stuff to the public so soon runs the risk of attacks against infrastructure that could not be patched in time.

The problem is that most people do not understand the reality of what PLC networks are like. If you're on the same network as a PLC, regardless of OEM, you own it. End of story.

The network where PLC gear works is not an office network. It was never designed to be compatible with office networks. The fact that they use commonplace protocols such as Ethernet and IP does not mean they're suitable for office computing. These choices were made primarily because these technologies are cheap, not because we were encouraging interconnection with offices. There is no technology available that can secure a PLC on a network. It inherently trusts the remote I/O it may have. It has to trust the programs it receives. Very few people, even among OEM companies, understand this.

Nobody has yet built a key server system designed to work at the latencies and diversity needed for industrial networking. It is not nearly as trivial as it may look. I say this as someone who is participating on the committee that is doing this very sort of thing. DNP (IEEE 1815) has a secure authentication addition to the protocol, compatible with IEC 62351-5. We are working very hard to make sure that this works in an environment where things can afford to take a little extra time if needed (in a SCADA system).

So far nobody has managed to do this with a PLC environment.

Thus, saying "if you send this or that to a PLC, you can break it" is silly. You don't even have to break the PLC, you can break the process it controls. That's far worse.

Meanwhile, with Siemens acting as if the WinCC compromise doesn't exist, I have to wonder if they understand what I have just written. They've known of this situation for over three years and what have they done? I'm glad our company doesn't use WinCC, and it will be a long time before we seriously consider using their PLC gear.

And so it begins... (1)

Anonymous Coward | more than 3 years ago | (#36376946)

What we're seeing here is the start of security considerations in these industries. This is as to facilities security as the "Green Card" email is to spam.

There is as close to no security in most of these facilities as makes no difference. If I can get on your network (disgruntled employee, WiFi leakage, worm, Trojan, etc. etc.) I can trash your system with software I can buy for $25 on eBay or from any of the factory automation vendors, or build it from available specs.

This is not a Siemens/Stuxnex problem, it's universal. All PLC vendors have a problem, all Windows SCADA/Factory Automation packages are vulnerable.

It's such an easy attack vector it's laughable.

The next step will be "security by obscurity", vendors locking down systems by not publishing information. Nothing will happen until there is a publicly visible attack, then we'll see a "Patriot Act" style response from the politicians, which will do nothing.

Re:And so it begins... (1)

mlts (1038732) | more than 3 years ago | (#36378104)

I can see laws being passed, but definitely nothing that actually will force companies to zip their flies up.

We will see laws mandating DRM, squashing anonymity, demanding websites have a license for any accounts, root/Administrator taken away from computer users, DRM stacks in all Internet connected hardware with core/edge NAC enforcing it, and so on. Basically, everything on the *AA laundry list of wants.

So, the next SCADA attack will likely result in the Internet ending up like Compuserve for everyone but the true blackhats... and I'm sure the ISPs will be more than willing to tack on the old Compuserve fees for hours on as well.

Stop using Windows (0)

Anonymous Coward | more than 3 years ago | (#36383076)

Personally, I think if you use Microsoft's quaint little desktop games-loader (oh sorry, its steet name is "Wnnn d'ohs") for anything critical, you should be jailed.

That's right, jailed.

For recklessly endangering life and property.

hello webmaster (1)

formation (2241238) | more than 3 years ago | (#36386600)

Check to see if your Company name is available http://bit.ly/m2IHF4 [bit.ly]

hello webmaster (1)

formation (2241238) | more than 3 years ago | (#36386648)

Check to see if your Company name is available http://bit.ly/m2IHF4 [bit.ly]
Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>