19 Nov 2012 | 2012
The Unsolicited Response Podcast occurs whenever events warrant. Late last week I recorded an interview with Bob Radvanovsky who is the owner of SCADASEC and one of the leaders of Project Shodan Intelligence Extraction (Project Shine). Project Shine has found over...
16 Nov 2012 | 2012
Register Now for S4 2013 – Awesome Research This Year NextGov reports the US National Highway Safety Traffic Safety Administration plans to “‘conduct rule-making ready research to establish electronic requirements for vehicle control...
15 Nov 2012 | 2012
Keep track of the latest S4 updates on our S4 site. We have two great new additions to the S4 2013 agenda. Both happen to involve the Siemens WinCC / S7 product family. Loyal blog readers have probably heard recently of Positive Technologies whitepaper SCADA Safety in...
13 Nov 2012 | 2012
These are typical, illustrative, and sad. Conversation 1: PLC Vendor A PLC vendor reached out to Digital Bond and encouraged us to share any results we found on their systems with them. He said they were very interested in security and understood they needed to do...
9 Nov 2012 | 2012
EnergySec has formed the Publicly Accessible Control Systems Working Group (PACS-WG) to try to track down and remove Internet accessible devices identified in Project Shine and elsewhere. The kickoff webinar is next Friday. Eric Byres and Tofino have teamed with Joel...
8 Nov 2012 | 2012
A I spoke recently with Kelly Jackson Higgins of Dark Reading about the number of vulnerabilities being found post-Stuxnet. This obviously is due to the increased attention from researchers and hackers. The data also shows some vendors and products have a steady...
7 Nov 2012 | 2012
Last September, I did a guest blog post titled “Online-Malware-Support-Shows-Infected-ICS-Computers”, where I searched for HiJackThis posts containing automation software. Basically, there are forums available to users that had been infected with viruses....
6 Nov 2012 | 2012
All ICS are not created equal — at least not from an impact to the critical infrastructure. There is a tendency to treat every ICS vulnerability or ICS security issue as a dire impact to a nation’s critical infrastructure. Those responsible for securing...
6 Nov 2012 | 2012
Reid Wightman and HD Moore wrote up an Nmap NSE script to detect if your PLC running the CoDeSys ladder logic runtime lacks effective authentication to access the application command shell, transfer files, … the insecure by design issues covered on the Project...
5 Nov 2012 | 2012
It is hard for me to write it any better than 3S, from their site: In general, we do not offer any standard tools in CODESYS which are to protect the controller from a serious cyber attack. Should the offered password functionality suggest such a protection, this was...
