10K Reasons to Worry About Critical Infrastructure

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

--742952673-607523299-1327477960=:18919
Content-Type: TEXT/PLAIN; FORMAT=flowed; CHARSET=UTF-8
Content-ID: <alpine.DEB.2.02.1201250154352.19105-+lq4ijtN3NWD1tnzEPnUTA@public.gmane.org>
Content-Transfer-Encoding: quoted-printable

http://www.wired.com/threatlevel/2012/01/10000-control-systems-online/

By Kim Zetter
Threat Level
Wired.com
January 24, 2012

MIAMI, Florida -- A security researcher was able to locate and map more=20
than 10,000 industrial control systems hooked up to the public internet,=20
including water and sewage plants, and found that many could be open to=20
easy hack attacks, due to lax security practices.

Infrastructure software vendors and critical infrastructure owners have=20
long maintained that industrial control systems (ICSes) =E2=80=94 even if=
 rife=20
with security vulnerabilities =E2=80=94 are not at risk of penetration by=
=20
outsiders because they=E2=80=99re =E2=80=9Cair-gapped=E2=80=9D from the i=
nternet =E2=80=94 that is,=20
they=E2=80=99re not online.

But Eireann Leverett, a computer science doctoral student at Cambridge=20
University, has developed a tool that matches information about ICSes=20
that are connected to the internet with information about known=20
vulnerabilities to show how easy it could be for an attacker to locate=20
and target an industrial control system.

=E2=80=9CVendors say they don=E2=80=99t need to do security testing becau=
se the systems=20
are never connected to the internet; it=E2=80=99s a very dangerous claim,=
=E2=80=9D=20
Leverett said last week at the S4 conference, which focuses on the=20
security of Supervisory Control and Data Acquisition systems (SCADA)=20
that are used for everything from controlling critical functions at=20
power plants and water treatment facilities to operating the assembly=20
lines at food processing and automobile assembly plants.

[...]


--742952673-607523299-1327477960=:18919
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_____________________________________________________
Did a friend send you this article? Make it your
New Year's Resolution to subscribe to InfoSec News!
http://www.infosecnews.org/mailman/listinfo/isn
--742952673-607523299-1327477960=:18919--