Security firm showcases vulnerabilities in SCADA software, won't report them to vendors

The vulnerability information will be sold to private buyers as part of a commercial service, the company says

Malta-based security start-up firm ReVuln claims to be sitting on a stockpile of vulnerabilities in industrial control software, but prefers to sell the information to governments and other paying customers instead of disclosing it to the affected software vendors.

In a video released Monday, ReVuln showcased nine "zero-day" (previously unknown) vulnerabilities which, according to the company, affect SCADA (supervisory control and data acquisition) software from General Electric, Schneider Electric, Kaskad, Rockwell Automation, Eaton and Siemens. ReVuln declined to disclose the name of the affected software products.

SCADA software runs on regular computers, but is used by owners of critical infrastructure and other various types of industrial facilities to monitor and control industrial processes.

According to by ReVuln, the vulnerabilities it showcased Monday can allow attackers to remotely execute arbitrary code, download arbitrary files, execute arbitrary commands, open remote shells or hijack sessions on systems running the vulnerable SCADA software.

The attackers "can take control of the machine with the maximum privileges (SYSTEM on Windows) granted by the affected service," ReVuln co-founder and security researcher Luigi Auriemma said Monday via email. "They can install rootkits and other types of malware or obtain sensitive data (like passwords used on other computers of the same network) and obviously they can control the whole infrastructure."

The attacks can be executed from another computer on the internal network or, in many cases, from the Internet. Most of the products were designed to allow remote administration over the Internet, according to their documentation, Auriemma said.

It's also common to find such systems exposed to the Internet because of insecure configurations, the researcher said. "Shodan [a search engine that can be used to discover Internet-accessible industrial control systems] is giving us tons of interesting results about machines of big known companies that we can exploit remotely just at this moment."

General Electric, Schneider Electric, Rockwell Automation and the U.S. Department of Homeland Security, which operates the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) did not respond to requests for comment sent Monday.

"ICS-CERT has just contacted us some minutes ago requesting more details but we don't release information," Auriemma said. The vulnerabilities "are part of our portfolio for our customers so no public details will be released; they will remain private," he said.

Along with French vulnerability research firm VUPEN, ReVuln is among a few companies that openly sell vulnerability information to government agencies and other private customers and refuse to report the vulnerabilities their researchers find to the affected vendors so they can be fixed.

"The vulnerabilities included in our Zero-day feed [a subscription-based service] remain undisclosed by ReVuln unless either the vulnerability is discovered and reported by a third party or the vendor publicly or privately patches the issue," the company states on its website.

It's a somewhat controversial business model that has been criticized by digital rights advocates and various people from the IT security industry who argue that it makes the Internet less safe because the vulnerabilities remain unpatched and known to third parties who may be interested in exploiting them for offensive purposes.

However, the practice is not new. It's been known for years in the security research community that some companies and independent researchers are selling information about unpatched vulnerabilities to governments and other private buyers, but such transactions used to be done discreetly.

In the absence of additional details and vendor confirmation, it's hard to independently confirm the existence of these vulnerabilities. However, Auriemma's reputation as a prolific vulnerability researcher and his past work in the field of SCADA security lends credibility to his company's claims.

During the past few years, before creating ReVuln together with former RIM security researcher Donato Ferrante, Auriemma reported dozens of vulnerabilities in SCADA software.

"Luigi [Auriemma] has found many vulnerabilities in SCADA and ICS [industrial control systems] in the past, and I'm sure he will continue to in the future," said Dale Peterson, CEO of Digital Bond, a Sunrise, Florida-based company that specializes in ICS security research and assessment, Tuesday via email. "He is talented."

That said, finding vulnerabilities in SCADA software is not that hard to do, Peterson said. "The issue with these applications is they were developed without security integrated into the development process."

"It is similar to what Microsoft was doing in the 90s," he said. "Without a security development lifecycle you will see the common programming mistakes that lead to vulnerabilities and exploits over and over."

As far as ReVuln's business model is concerned, "Digital Bond's position is that the person who finds the vulnerability can decide what to do with it," Peterson said. "Report to the vendor, a CERT, sell it, publish it, or keep it for future use. We have done all of the above and make our decision on a case by case basis."

"It really doesn't matter if this is right or wrong for ICS or any market," Peterson said. "It is the way it is so there's no value in discussing responsible disclosure."

David Harley, a senior research fellow at security vendor ESET, said Tuesday via email that, while he belongs to a generation of researchers that prefers responsible to unrestricted disclosure, he can understand that vulnerability researchers expect something in return for their efforts.

However, if security researchers who find vulnerabilities in industrial control systems don't self-regulate or get support for their work through a government program, they run the risk of meeting legal and other forms of pressure because issues that can affect national security attract particular attention, Harley said.

"Vupen lays claim to a certain amount of self-regulation (in terms of being choosy about its customers): I don't know about Revuln, but at least what they're doing isn't full, promiscuous disclosure," Harley said.

"I can't say I feel comfortable with this, but it may be that legitimized and monetized research will work out better for the online world than multitudes of individuals and unofficial groups working semi-covertly," the ESET researcher said. "If so, let's hope too much damage isn't done while that market stabilizes."

As far ReVuln's customer selection process goes, Auriemma said the company "accepts trusted customers from reputable countries only."

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags siemensReVulnsecurityKaskadgeneral electricDigital BondRockwell AutomationesetExploits / vulnerabilitieseatonSchneider Electric

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Essentials

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?