[Infowarrior] - SCADA hack talk canceled after U.S., Siemens request

[Richard Forno]

May 18, 2011 4:10 PM PDT
SCADA hack talk canceled after U.S., Siemens request

by Elinor Mills

http://news.cnet.com/8301-27080_3-20064112-245.html
   
The researchers were scheduled to give their talk at the TakeDown Conference in Dallas today.

Two researchers say they canceled a talk at a security conference today on how to attack critical infrastructure systems, after U.S. cybersecurity and Siemens representatives asked them not to discuss their work publicly.

"We were asked very nicely if we could refrain from providing that information at this time," Dillon Beresford, an independent security researcher and a security analyst at NSS Labs, told CNET today. "I decided on my own that it would be in the best interest of security...to not release the information."

Beresford said he and independent researcher Brian Meixell planned on doing a physical demonstration at the TakeDown Conference and shared their slides and other information on vulnerabilities and exploits with Siemens, ICS-CERT (Industrial Control Systems Cyber Emergency Response Team), and the Idaho National Lab on Monday.

ICS-CERT could not be reached for comment late today, and a U.S.-based representative for Siemens, a German company, did not respond to a call or e-mail. Siemens was expected to make a statement on Thursday, according to Beresford.

Earlier in the day, an organizer of the conference said that it was Siemens and the Department of Homeland Security that had requested that the researchers hold off on their talk.

The presentation was entitled "Chain Reactions--Hacking SCADA" (supervisory control and data acquisition), which is technology used in manufacturing and critical-infrastructure systems. About 300 people were registered to attend the TakeDown Conference, which is happening today and tomorrow in Dallas.

"Combining traditional exploits with industrial control systems allows attackers to weaponize malicious code, as demonstrated with Stuxnet. The attacks against Iran's nuclear facilities were started by a sequence of events that delayed the proliferation of nuclear weapons," a summary of the talk says. "We will demonstrate how motivated attackers could penetrate even the most heavily fortified facilities in the world, without the backing of a nation state. We will also present how to write industrial grade malware without having direct access to the target hardware. After all, if physical access was required, what would be the point of hacking into an industrial control system?"

Last year's Stuxnet was believed to be the first malware designed specifically to target industrial control systems. Experts say it was written to seek out particular Siemens software and was likely aimed at sabotaging Iran's nuclear program.

News of the cancellation first spread on Twitter, when another presenter at the conference, Jayson Street, tweeted: "Since DHS just banned next speaker from giving his talk [on SCADA] I'm up next!"

However, Beresford said they were merely asked to not give the talk.

"Dillon was not threatened or prevented from speaking. Rather, he made the decision based on the potential negative impact to human life and the fact that the vendor's proposed mitigation had failed," NSS Labs Chief Executive Rick Moy said in an e-mail. "ICS-CERT has done a great job of assisting us with this process, and we look forward to Siemens being able to address the issue for their customers."

Updated 5:53 p.m. PT with clarification that it was ICS-CERT that was involved; adds more details and comment from researcher.