Showing posts with label systems. Show all posts
Showing posts with label systems. Show all posts
Thursday, July 27, 2017
Positive Technologies helps to eliminate critical vulnerabilities in Siemens and Schneider Electric SCADA systems
Positive Technologies helps to eliminate critical vulnerabilities in Siemens and Schneider Electric SCADA systems
Ilya Karpov, a Positive Technologies expert, detected vulnerabilities in products intended for building automation systems in various industries — from petrochemical to power plants.
Ilya found a problem related to clear-text password storage in Schneider Electric systems — InTouch Machine Edition 2014 (version 7.1, Service Pack 3, Patch 4) and InduSoft Web Studio (7.1.3.4), as well as in their previous builds. The vulnerability that got the CVE-2015-1009 identifier and 6.4 base mark though cannot be exploited remotely requires only a low-qualified internal attacker.
Schneider Electric specialists recommend users to install new security updates as soon as possible (a patch for InTouch Machine Edition 2014 and a patch for InduSoft Web Studio) and restrict physical access of the personnel to these systems in order to decrease a potential risk of confidential information disclosure by internal attackers.
In July, Siemens issued a special update for the April note, where it thanked Ilya Karpov for detecting a dangerous and easy-to-use vulnerability that was threatening security of quite a few Siemens SIMATIC-based solutions:
- SIMATIC HMI Basic Panels 2nd Generation — all the versions up to WinCC (TIA Portal) V13 SP1 Upd2;
- SIMATIC HMI Comfort Panels — all the versions up to WinCC (TIA Portal) V13 SP1 Upd2;
- SIMATIC WinCC Runtime Advanced — all the versions up to WinCC (TIA Portal) V13 SP1 Upd2;
- SIMATIC WinCC Runtime Professional — all the versions up to WinCC (TIA Portal) V13 SP1 Upd2;
- SIMATIC WinCC Runtime Professional — all the versions up to WinCC (TIA Portal) V13 SP1 Upd2;
- SIMATIC HMI Mobile Panel 277 (WinCC TIA Portal) — all the versions up to WinCC (TIA Portal) V13 SP1 Upd4;
- SIMATIC HMI Multi Panels (WinCC TIA Portal) — all the versions up to WinCC (TIA Portal) V13 SP1 Upd4;
- SIMATIC WinCC V7.X — all the versions up to V7.3 Upd4;
- SIMATIC PCS 7 — all the versions up to V8.1 SP1.
The CVE-2015-2823 error rated 6.8 allows using user password hash function in order to authenticate locally and remotely at the server. You dont even have to know the password.
All necessary tests for security issues detected in Siemens SIMATIC software have been added to the knowledge base of the PT MaxPatrol vulnerability and compliance control management system.
Positive Technologies started to cooperate with leading ICS vendors long ago. The large-scale study “SCADA safety in Numbers” was presented on 2012. A year later, PT experts created Choo Choo Pwn — an up-to-date large-scale railway model, whose components (trains, railroad crossing gates, and traffic lights) are controlled by an ICS based on three real SCADA systems. The model was used for SCADA security contest at Positive Hack Days, the annual international conference on information security.
In 2014, the contest infrastructure was significantly changed to allow detection of zero-day vulnerabilities within a wider range of systems and industrial protocols including: transport, city lighting system, power plants and various robots. The contest’s winner Alisa Shevchenko was thanked by Schneider Electric for the vulnerabilities she identified.
This years Choo Choo Pwn was even more realistic: the participants couldnt send a command leading to a failure because the traffic security logic wouldnt let that happen. So, the goal of the challenge was to break the transport security means.
Available link for download
Sunday, May 7, 2017
Private Health Care Systems Subsidize the Older Folk
Private Health Care Systems Subsidize the Older Folk
My wife and I are old and grey, well one of is, me. We are both retired and receive Social Security and Medicare benefits. This appears to be a great evil to some in our society. We are just lazy folk living off the hard work of others such as our children and grandchildren. Of course, if we didn’t have these benefits we might be doing that anyway. Never mind the fact that we paid for these benefits over our lifetimes.
But those who still see evil in the dreaded “Obamacare” that young folk will get shafted by this program have to pay for older deadbeats with more need of medical coverage. I mean they have it hard enough paying off the college debts because we don’t subsidize higher education to the extent we used to. So, they doomsday folk say these young people won’t pay what they are supposed to under Obamacare because the penalty will be cheaper than the cost.
Au contraire ma soeur, that is not the case. The argument is spurious (false, or just a damn lie) because those most of those from age 19 to 34 get their health care from their employer. They pay the same premiums as those who are older than themselves and need more healthcare. So, dear youth, despite what the naysayers tell you, you are already subsidizing older folk; that is what private health care systems do. Thus you 20 million young folk, Obamacare doesn’t change a thing, you will still have to subsidize older folk. Don’t worry, in a few years you will get subsidized whether you use Obamacare or not.
The President hopes that about 2.7 million of the young will purchase coverage in the new agencies. The 20 million getting health care from their employers therefore that subsidy is about 8 times more than the bad old Obamacare. Huh? Weren’t you paying attention?
Now folk in most countries seem to understand this very well. Private or public health care systems work the same; the young subsidize the older folk. If the doomsday folk were honest about all this you’d know that, but they use a lot of smoke and mirrors to try and scare you.
Remember Obamacare used to be called Romneycare, then the naysayers we’re backing a different horse.
Available link for download
Subscribe to:
Posts (Atom)