eWeek Hysteria
eWeek.com has an article out today, “Hole Found in Protocol Handling Vital National Infrastructure” (hat tip: Dick Lord of the Steadfast Group for sending it to me). It is full of inaccuracies and hysteria.
First and most importantly, the title is wrong. This article is about the work Lluis Mora presented at S4 on OPC implementation errors. Lluis did not find vulnerabilities or a “hole” in the OPC protocol. What he found was about 1/3 of the implementations tested had made software coding errors that could lead to exploits. If you do the math, this means that 2/3 of the OPC implementations withstood the 24 test cases Lluis ran.
Vendors are addressing these vulnerabilities and security patches are being released.
I’m not going to go throughthe article line by line. If you have to read the article, you will notice that there is nothing inflamatory from Lluis - - just the facts. So the reporter got a lot of juicy comments from Robert Graham of Errata Security. I don’t know Robert personally, and will give him the benefit of the doubt because reporters sometimes spin things to make a story. In fact, the most outrageous comments are not direct quotes.
Author: Dale Peterson
Posted: March 23rd, 2007 under OPC, Vulnerability Disclosure.
Comments: 1
Comments
Comment from Julian L. Rrushi
Time: March 29, 2007, 8:51 am
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1
I have a comment on the fact that it took 5 minutes to Robert to identify a remotely exploitable vulnerability in OPC, since it could implicitly be thought of as a security metric regarding the exposure of critical infrastructures to cyber attack.
Being a SCADA security researcher myself, I have had the chance to study in depth the research work carried out in US/Canada and regarding vulnerability analysis of SCADA protocols and their embedded real-time operating systems. As a resarcher I deem this work to be highly innovative and intelligent. Therefore, while it may be true that SCADA software as released by the respective vendors may be subject to various vulnerabilities, before being deployed such a software is carefully analyzed by world-class vulnerability analysis frameworks. Examples include the DEADBOLT vulnerability analysis framework by MIT, the INL control system plant assessment, or the Achilles SCADA Assurance Platform. It isn’t likely, I believe, that a vulnerability that may be found in an implementation of an industrial protocol in a 5 minutes time frame, or a vulnerability that may be identified even by kids, could exist in real world deployments of SCADA software tested by the aforementioned frameworks.
As a conclusion I can say that to the best of my knowledge US critical infrastructures are highly resilient to cyber attack. Their communication protocols and operating systems are looked after by extremely skilled people who possess the most advanced attack and defense intelligence.
Regards,
Julian L. Rrushi
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQFGC7W7rq0d5u53c2QRAp+PAJ45gZowyClR4QcywILHoBiYSFaYnwCfRbaT
Lioi1pU6E699arDiLc8Ig1Q=
=lnN7
—–END PGP SIGNATURE—–
Write a comment