Siemens SCADA hacking talk pulled over security concerns

Siemens was unable to fix the issue in time for the TakeDownCon security conference

A planned presentation on security vulnerabilities in Siemens industrial control systems was pulled Wednesday over worries that the information in the talk was too dangerous to be released.

Independent security researcher Brian Meixell and Dillon Beresford, with NSS Labs, had been planning to talk Wednesday at a Dallas security conference about problems in Siemens PLC (programmable logic controller) systems. These are the industrial computers widely used to open and shut valves on factory floors and power plants, control centrifuges, and even operate systems on warships.

But the researchers decided to pull the talk at the last minute after Siemens and the U.S. Department of Homeland Security pointed out the possible scope of the problem, said Rick Moy, CEO of NSS Labs. His company had been working with DHS's ICS CERT (Industrial Control Systems Cyber Emergency Response) group for the past week-and-a-half trying to get the issues resolved. "The vendor had proposed a fix that turned out not to work, and we felt it would be potentially very negative to the public if information was put out without mitigation being available," he said.

It is common for security researchers to talk about security bugs once the software in question has been patched. But if the vendor can't get the issue fixed in time, that can create problems for security researchers, who may be expecting to talk about the issue at a hacker conference.

That's what happened at the TakeDownCon conference, where the security researchers had been set to talk.

In the past, technology companies have threatened legal action against researchers, but Moy said that in this case the lawyers were not involved. "It's a temporary hold on the information; it's not that it's being buried," he said. "We just don't want to release it without mitigation being out there for the owners and operators of the SCADA [supervisory control and data acquisition] equipment."

Siemens and DHS did not force them to pull the talk. "They said, 'It's up to you. Here's some more information about the number of devices and where they're deployed,'" he said.

Moy declined to say much about the actual Siemens PLC flaw that Beresford and Meixell discovered for fear that it would disclose aspects of the bugs.

SCADA security has been a hot topic in the research community following last year's discovery of the Stuxnet worm, thought to have been designed to disrupt Iran's nuclear program.

In a description of their talk, Meixell and Beresford said they would show how to write "industrial-grade" malware. "We will demonstrate how motivated attackers could penetrate even the most heavily fortified facilities in the world, without the backing of a nation state," they wrote in an abstract describing their presentation.

Robert McMillan covers computer security and general technology breaking news for The IDG News Service. Follow Robert on Twitter at @bobmcmillan. Robert's e-mail address is robert_mcmillan@idg.com

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags energyindustry verticalssiemensNSS LabsExploits / vulnerabilities

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?