Industrial Control Equipment May be Vulnerable to New Style of Attacks: Report

By Beecher Tuttle October 24, 2011

Security experts have been able to replicate quickly and inexpensively last year's high-profile attacks on computerized industrial control equipment in power plants in Iran – breaches that were known at the time as being so sophisticated they could only have been pulled off by a nation-state or a well-financed group of investors, according to the Associated Press.

The news could predict a new round of attacks on facilities that utilize electronic controller systems like the ones that were targeted by the Stuxnet worm in Iran.

In September of 2010, computer security company Symantec said that the Iran attacks "would not be easy for a normal group to put together," and would have to be initiated by individuals with intimate knowledge of industrial control systems.

But a year later, security researchers like Dillon Beresfordr have identified as many as a dozen vulnerabilities in the same kind of industry controllers as those used in Iran. What is worse, Beresfordr did it on his own in just two months, while investing only $20,000 in the project, says the AP.

"What all this is saying is you don't have to be a nation-state to do this stuff. That's very scary," Joe Weiss, an industrial control system expert, told the news source. "There's a perception barrier, and I think [Beresfordr] crashed that barrier."

The difficulty with mitigating attacks like those against Iran is that industrial controllers are very expensive and have large shelf-lives. This makes replacing the systems a major project for every company, government or facility that utilizes them.

Unfortunately, the AP references several examples of consulting firms that found multiple vulnerabilities in power plants, correctional facilities and other U.S.-based institutions that rely on industrial controllers.

Compounding the report is the fact that researchers have identified a new malicious program based on the infamous Stuxnet worm. Symantec – which discovered the malware, dubbed Duqu – said that it shares a lot of Stuxnet's code and compares equally in terms of sophistication.

“Duqu’s purpose is to gather intelligence data and assets from entities, such as industrial control system manufacturers, in order to more easily conduct a future attack against another third party,” the Symantec researchers said. “The attackers are looking for information such as design documents that could help them mount a future attack on an industrial control facility."

So far, Duqu has only affected a few organizations in Europe, says Symantec.

Beecher Tuttle is a TechZone360 contributor. He has extensive experience writing and editing for print publications and online news websites. He has specialized in a variety of industries, including health care technology, politics and education. To read more of his articles, please visit his columnist page.

Edited by Rich Steeves

TechZone360 Contributor

Related Articles

10 Benefits of Drone-Based Asset Inspections

By: Frank Segarra    1/15/2018

Although a new and emerging technology, (which is still evolving), in early 2018, most companies are not aware of the possible benefits they can achie…

Read More

VR Could Change Entertainment Forever

By: Special Guest    1/11/2018

VR could change everything from how we play video games to how we interact with our friends and family. VR has the power to change how we consume all …

Read More

Making Connections - The Value of Data Correlation

By: Special Guest    1/5/2018

The app economy is upon us, and businesses of all stripes are moving to address it. In this age of digital transformation, businesses rely on applicat…

Read More

3 Ways to Improve Your VR Projects

By: Ellie Martin    1/4/2018

There is no denying that VR is here and will most likely only increase in velocity as a terminal speed is yet to be even hypothesized. That is why it …

Read More

Alphabet to See Schmidt Step Down

By: Maurice Nagle    12/21/2017

In 2001, Google brought Eric Schmidt on board as CEO. To 10 years later become executive chairman, and continue to serve in this capacity through rest…

Read More