From: threat post
A class of SCADA vulnerabilities discussed at a recent conference is getting attention not only for the risks they pose to master control systems at electric utilities, but also for illuminating a dangerous gap in important critical infrastructure regulations.
Researchers Adam Crain and Chris Sistrunk demonstrated several weaknesses in vendor implementations of the DNP3 communication protocol in a number of products during the S4 Conference last week. The flaws, many of which have been patched, demonstrate how an attacker could target a non-critical, serial-based piece of field equipment at an electrical substation and knock out visibility over all of a utility’s substations. The vulnerabilities in some DNP3 implementations could allow attacks against master control systems from a field device by sending a malicious frame, or message to the control system.
“What’s different about our research is that most have focused on actual field devices—devices in substations or devices on poles—and 50 percent of our testing was on the master systems, things that communicate to all of the field devices and bring that data back to the operations center,” Crain said. “The difference is, if you had access, here you could knock out visibility to a whole system, hundreds of substations, by affecting one or two servers that are monitoring all of that.”
Leave a Reply