Senate Committee Confronts NSA Director on Surveillance
The Senate Appropriations Committee grilled NSA Director Gen. Keith B. Alexander over the agency’s surveillance of Americans’ phone call data.
Critical Infrastructure
Unnamed, Popular ICS Firmware Contains Hard-Coded FTP Credential
A researcher has discovered that an unnamed industrial control system device’s firmware contains a hard-coded credential that enables it to connect to the device vendor’s FTP service.
Schneider Patches 18-Month Old SCADA Bugs
More than 18 months after a security researcher revealed a long list of vulnerabilities in its SCADA products, Schneider Electric has released patches for a subset of those bugs for a couple of the affected products.
WASHINGTON–The topic of critical infrastructure security may be the prettiest girl at the dance right now for both politicians and technology companies, but the problem of attackers going after these targets is one that security people have been dealing with for some time. But that doesn’t mean they have a good handle on it or clear solution for the problem. In fact, there are still a number of old obstacles standing in the way of addressing the issue.
ICS-CERT released an advisory about a vulnerability in TURCK automation gear discovered by an IOActive researcher that enabled access to hard-coded passwords contained within the devices.
A report from legislators Ed Markey and Henry Waxman provides insight into the state of cybersecurity with U.S. electric grid utilities and compliance with mandatory and voluntary standards.
Two industrial control system researchers have built an ICS honeypot they hope others will deploy on critical infrastructure networks.
Sometime around 2:45 PM Eastern Standard Time yesterday, Syria’s border gateway protocols (BGP) were severed and the country disappeared from the Internet. Just as quickly as it had fallen, Syria came back online this morning.
Researchers at Cylance released details of a custom exploit designed to defeat a vulnerability in a Tridium Niagara Framework device installed at Google’s Sydney, Australia campus.
ICS-CERT updates a number of recommendations for critical infrastructure operators to prevent infections from the Shamoon wiper malware. Shamoon struck Saudi oil company Aramco, destroying more than 30,000 workstations.
