Rare SCADA vulnerability discovered

Share this article:
Updated Friday, May 9 at 4:53 p.m. EST

Researchers have discovered a rare bug in a Windows-based control software package used by as many as one-third of the world's industrial plants.

The vulnerable software component, Wonderware SuiteLink, is used to help facilitate communications over TCP/IP networks for SCADA (supervisory control and data acquisition) systems, according to an advisory from Core Security Technologies, which discovered the flaw.

The vulnerability, first reported to Wonderware in January, could permit remote attackers to connect to the SuiteLink TCP port and send malicious packets, thus causing a denial-of-service, according to the advisory.

According to the National Vulnerability Database, the flaw earns a 7.5 CVSS score (out of 10). A successful exploit could permit unauthorized access, information disclosure and service disruption.

A Wonderware spokeswoman said the company issued a technical alert to solution and support providers, guiding them on how to remedy the issue. She said the flaw can only be exploited by a malevolent insider.

"Wonderware is not aware of any customer or installation that has been affected by this issue," the spokeswoman said. "This vulnerability...can only be exploited by a deliberate malicious attack from within an organization by someone with access to the industrial network."

Paul Ferguson, advanced threat researcher at Trend Micro, told SCMagazineUS.com on Thursday that this is the first publicly reported SCADA vulnerability that he is aware of. More, though, are sure to come as these systems becoming increasingly connected to the internet and become reliant on common operating platforms, he added.

"It used to be that SCADA control systems, most of them were all [based on] proprietary protocols and any type of problems that they had were usually taken care of and weren't really publicly known," he said. "What's happened over the course of the past 10 years...these systems are falling prey to the same types of vulnerabilites that the enterprise commercial software industry is finding as well."

According to Wonderware, it has sold more than 500,000 software licenses to 100,000 plants worldwide. Customers include oil and gas, food and beverage, utilities, pharmaceuticals, electronics, metals and automotive.
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters


More in News

Florida Supreme Court rules warrants a must for real-time cell location tracking

Florida Supreme Court rules warrants a must for ...

The Florida Supreme Court put the kibosh on warrantless real-time tracking using location data obtained from cell phone providers.

Modular malware for OS X includes backdoor, keylogger components

Modular malware for OS X includes backdoor, keylogger ...

The modular malware was named "Ventir," by researchers at Kaspersky.

Fake Dropbox login page nabs credentials, is hosted on Dropbox

Fake Dropbox login page nabs credentials, is hosted ...

Symantec researchers received a phishing email linking recipients to a fake Dropbox login page that is hosted on Dropbox's user content domain and served over SSL.