Thousands of Industrial Energy Systems can be Remotely Hacked

• By Sydny Shepard
• May 31, 2016

Homeland Security is warning US industrial power and energy plants that a common internet-connected device is vulnerable to a string of serious security vulnerabilities.

The ESC 8832 data controller, which allows a plant worker to see exactly how an industrial unit is working at a glance, could by trivially exploited by a “low skilled” attacker, the US government department’s Computer Emergency Readiness Team (CERT) posted in an advisory.

"The device supports different accounts with distribution of system privileges. An attacker can gain access to functions, which are not displayed in the menu for the user by means of brute force of a parameter," said the advisory.

This is allowed because the internet-connect device has a web interface, which hackers can easily exploit to gain greater access to the device than intended.

Perhaps the worst part of the situation is the fact that the company that develops the software says this is a security concern they cannot patch. They said there is no code space to install a security patch for the system.

There are thought to be more than 4,000 units in the field, according to a newsletter dated late-2012.

The flaws were discovered by independent security researcher Maxim Rupp.