ICS vulnerabilities can be more easily exploited than previously thought

On August 1, DHS issued a bulletin on the Anonymous hacker group -DHS Bulletin: Anonymous/LulzSec Has Continued Success Using Rudimentary Hacking Methods:

Anonymous has stated its intent to target companies related to certain Critical Infrastructure / Key Resources sectors. Future attacks are likely to continue but will likely remain limited in scope due to a lack of advanced capabilities. Some members of LulzSec have demonstrated moderately higher levels of skill and creativity that include using combinations of methods and techniques to target multiple networks. This does not take into account the possibility of a higher-level actor providing LulzSec or Anonymous more advanced capabilities. Therefore, it may be advisable to adjust monitoring of both internal and external resources for indications of a pending or ongoing attack on cyber or telecommunications networks.

There are several mistaken assumptions about cyber vulnerabilities of control systems – they are much more vulnerable:

- Zero days are the worst case. This is not true as many ICS are still vulnerable to older exploits.

- You need advanced hacking skills to attack control systems. This is not true as can be seen with Dillon Berensford (minimal ICS experience), Ralph Langner (14 bytes to take control), systems running connected to the Internet with no password (Jonathan Pollet’s presentation at BlackHat), etc. 

Don’t take the Anonymous group or others with supposed lack of advanced hacking skills too lightly.

Joe Weiss