Security News
"The impact is that a malicious actor can start and stop the PLC remotely without authenticating with the engineering software," said Trustwave's Seok Min Lim in an advisory this week, adding: "Our research shows that SoMachine Basic does not perform adequate checks on critical values used in the communications with PLC. The vulnerability can potentially be used to send manipulated packets to the PLC, without the software being aware of the manipulation." Although Schneider's PLC design was only supposed to accept a single user session from the engineering software at a time, Trustwave was able to use Address Resolution Protocol poisoning to keep the session alive while logging out the real user.
The Israeli government has issued an alert to organizations in the water sector following a series of cyberattacks aimed at water facilities. According to an alert published by Israel's National Cyber Directorate, the attacks targeted supervisory control and data acquisition systems at wastewater treatment plants, pumping stations and sewage facilities.
A new malware campaign has been found using coronavirus-themed lures to strike government and energy sectors in Azerbaijan with remote access trojans capable of exfiltrating sensitive documents, keystrokes, passwords, and even images from the webcam. According to the researchers, the malware specifically targets supervisory control and data acquisition systems in the energy industry, such as wind turbine systems, whose identities are currently not known.
A threat actor that has been spotted targeting Azerbaijan has shown an interest in the energy sector, specifically SCADA systems related to wind turbines, Cisco's Talos threat intelligence and research group reports. According to Talos, the hackers appear to be interested in the energy sector and industrial control systems.
SecurityWeek has announced that it will offer an Advanced ICS/SCADA Hacking Training program at its 2019 Industrial Control Systems (ICS) Cyber Security Conference, which takes place October 21-24...
Risk Based Security uncovered multiple vulnerabilities in the AK-EM 800 product from SCADA vendor Danfoss. The discovered vulnerabilities Researchers found two critical vulnerabilities. One is...
Here’s an overview of some of last week’s most interesting news and articles: Compromised ad company serves Magecart skimming code to hundreds of websites The attackers managed to compromise...
Attacks aimed at SCADA networks are still much rarer than those targeting IT networks, but the number is slowly rising. And, according to Radiflow CTO Yehonatan Kfir, there’s no time like the...
Tatsoft brings a new open platform to SCADA, IIoT and real-time system developers by releasing FactoryStudio 8.1, the latest version of its .NET-to-the-core application development platform....
A major challenge in industrial control system architecture involves the dual nature of its underlying technologies. That is, a typical ICS component must have the capability to exchange...