A security researcher working for NSS Labs, an electronics security firm, reportedly identified security flaws in Siemens industrial control management systems that compromise the critical infrastructure systems to hackers. Siemens SCADA systems were the center of last year's Stuxnet attacks where the computer worm reportedly affected Iran's nuclear facilities. Industry news source Dark Reading reported that the researcher and Siemens had been collaborating along with the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) to come up with fixes for the flaws identified but NSS Labs found out that the fixes Siemens came up with still did not fully protect the affected systems. The researcher Dillon Beresford noted that he was able to bypass the fix within 45 minutes, and notified both Siemens and ICS-CERT of this issue.
Beresford has gone public criticizing Siemens for not informing its customers that they "are at elevated risk of such attacks, which could affect electrical generators, water distribution systems and other critical infrastructure that run on Siemens technology." However, Reuters reported that a Siemens representative's response was that "company officials are in a better position to assess potential security risks than researchers from an outside firm [and] NSS Labs did not have enough information to determine the severity of the risk."
|
|
||