Thousands of Industrial Energy Systems can be Remotely Hacked

Thousands of Industrial Energy Systems can be Remotely Hacked

Homeland Security is warning US industrial power and energy plants that a common internet-connected device is vulnerable to a string of serious security vulnerabilities.

The ESC 8832 data controller, which allows a plant worker to see exactly how an industrial unit is working at a glance, could by trivially exploited by a “low skilled” attacker, the US government department’s Computer Emergency Readiness Team (CERT) posted in an advisory.

"The device supports different accounts with distribution of system privileges. An attacker can gain access to functions, which are not displayed in the menu for the user by means of brute force of a parameter," said the advisory.

This is allowed because the internet-connect device has a web interface, which hackers can easily exploit to gain greater access to the device than intended.

Perhaps the worst part of the situation is the fact that the company that develops the software says this is a security concern they cannot patch. They said there is no code space to install a security patch for the system.

There are thought to be more than 4,000 units in the field, according to a newsletter dated late-2012.

The flaws were discovered by independent security researcher Maxim Rupp.

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

Featured

New Products

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises.

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.