<Embarrassing Update: Duqu not Duku, no excuse, corrected throughout blog> The newly discovered Duqu malware and its relationship with Stuxnet and ICS was the big news yesterday. The ICS-CERT Alert is actually concise and informative. It points out that the Duqu...
Who created and used Stuxnet? This would be a big story in the mainstream press and the biggest story in ICS security to date by far. Unfortunately we have nothing but motive and speculation with almost no hard facts on the culprit — at least publicly disclosed....
Terry McCorkle’s presentation at DerbyCon, 100 Bugs in 100 Days: An Analysis of ICS (SCADA) Software is available online. He did this research in his spare time with Billy Rios, and it is informative technically and culturally. The research focused on freely...
(Following NERC security is a full time endeavor these days. To that end, digitalbond.com is looking for a NERC correspondent. Ideally this would be someone who follows NERC security as part of their job, has the ability to comment publicly, and has some opinions and...
There was first shock and then sympathy for ICS-CERT Acting Director Marty Edwards’ statement at WeissCon that only software bugs are treated as vulnerabilities by ICS-CERT. The important converse of this statement is any exploitable security weaknesses that are...
Last week two ICS security related offerings were highlighted by Microsoft, one old and one new. Kevin Sullivan suggested again that ICS vendors with legacy applications running on any version of Windows look at the Enhanced Mitigation Experience Toolkit (EMET)....
In 2006, the US Dept. of Energy issued an Energy Sector Security Roadmap with specific goals and milestones. We scored the progress on the roadmap in an earlier blog, and it did drive DoE’s research funding and other efforts in the intervening years. This month...
Italian researcher Luigi Auriemma has released another set of vulnerability advisories and proof of concept exploit code for a variety of ICS products. He is finding overflows on the proprietary services the vendors are writing. You hear often in ICS,...
Dave Teumim’s Industrial Network Security, published by ISA, is a very basic, very short book that does a good job of introducing cyber security to an ICS manager with zero security experience. This “book” really is more of a pamphlet....
RLast week I introduced our Project Basecamp – Hacking PLC’s. This will be the Digital Bond paper at S4. There have been a number of questions of what we are doing, why we are doing it, what disclosure process we will follow … I’ll start with...
