ICS-CERT Warns of Serious Flaws In Tridium SCADA Software

Trailrunner7 writes "The DHS and ICS-CERT are warning users of some popular Tridium Niagara AX industrial control system software about a series of major vulnerabilities in the applications that are remotely exploitable and could be used to take over vulnerable systems. The bugs, discovered by researchers Billy Rios and Terry McCorkle, are just the latest in a series of vulnerabilities found in the esoteric ICS software packages that control utilities and other critical systems. The string of bugs reported by Rios and McCorkle include a directory traversal issue that gives an attacker the ability to access files that should be restricted. The researchers also discovered that the Niagara software stores user credentials in an insecure manner. There are publicly available exploits for some of the vulnerabilities."

Comments

Re:Of course, since it's SCADA...

[superflex]

Sorry, what? It's not really SCADA? No, actually it's exactly SCADA.

SCADA is a general-use acronym, Supervisory Control And Data Acquisition. It has been in common use in the industrial control system world for at least 20 years. It is not a term specific to Siemens or any other control systems vendor. And it is not incorrect to apply the acronym to application areas like building automation; there can be a fair amount of overlap in system architecture, devices, & communication protocols between building automation and industrial manafacturing automation.

Source: 10 years experience as a industrial control systems engineer.