Researchers have found multiple vulnerabilities in MOXA ioLogik industrial controllers which are widely used in industrial facilities such as utilities and manufacturing plants. Code injection, weak password policies and lack of protection mechanisms allow hackers to execute arbitrary code within webpages and modify settings of vulnerable devices. Mark James, Security Specialist at ESET commented below.
Mark James, Security Specialist at ESET:
Most of the flaws we see in the automation industry are proof of concept, it usually involves a specific environment to be in place but the impact could in some cases be catastrophic. Automation often involves heavy equipment doing precision work and if it fails it could cause thousands of pounds of damage. If that equipment were to go wrong around or close to humans then there is always the potential of injury or even death.”
It’s virtually impossible to have any software driven machinery that is 100% secure. The very nature of software dictates that’s there is always the possibility of someone somewhere finding a way to do something that was not intended to be done. What’s important is how quickly it’s fixed, as more and more automation takes place it’s important to ensure the security is taken very seriously.
Isolating systems and ensuring only physical access is required to update and maintain systems will keep the attack footprint down.”
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.