Below is the specific link to Luigi Auriemma’s website which explains in detail the security issues and vulnerabilities not simply with the Siemens FactoryLink software, but also with Iconics, Datak, and 7 Technologies software.
(from Luigi Auriemma’s site: http://aluigi.altervista.org/)
Vulnerabilities in Siemens Tecnomatix FactoryLink 8.0.1.1473 (SCADA)
21 Mar 2011: adv1 – adv2 – adv3 – adv4 – adv5 – adv6 – factorylink_1/6
Vulnerabilities in Iconics GENESIS32 9.21 and GENESIS64 10.51 (SCADA)
21 Mar 2011: adv1 – adv2 – adv3 – adv4 – adv5 – adv6 – adv7 – adv8 – adv9 – adv10 – adv11 – adv12 – adv13 – genesis_1/13
Vulnerabilities in 7-Technologies IGSS 9.00.00.11059 (SCADA)
21 Mar 2011: adv1 – adv2 – adv3 – adv4 – adv5 – adv6 – adv7 – adv8 – igss_1/8
Vulnerabilities in DATAC RealWin 2.1 (Build 6.1.10.10) (SCADA)
21 Mar 2011: adv1 – adv2 – adv3 – adv4 – adv5 – adv6 – adv7 – realwin_2/8
The responses from these four vendors (per their websites) are as follows:
Iconics:
On March 21, 2011, US-CERT issued a series of alerts regarding possibly vulnerabilities in four companies’ SCADA software products, based upon the work of an independent researcher. One alert discussed possible vulnerabilities in ICONICS’ GENESIS32™ and GENESIS64™ products.
ICONICS takes this alert very seriously and in cooperation with US-CERT is investigating the issues raised in the alert, as well as whether any further action is required.
ICONICS recommends that control system devices and servers should not directly face the Internet and should be located behind secure firewalls. If remote access is required, secure methods, such as Virtual Private Networks (VPNs) should be employed.
ICONICS is not aware of any instance in which an ICONICS SCADA system has been compromised by unauthorized access.
Siemens on the other hand has simply stated that this is an obsolete product which they no longer support.
Cyril Kerr, Datac’s CEO, said that the vulnerabilities were found in its RealWin product, which is demo version of its RealFlex 6 SCADA product. RealFlex runs on an OS called QNX. However, since companies interested in the product probably don’t have that OS, Datac created RealWin, which runs on Windows and can be used to show RealFlex’s features, Kerr said.
RealWin is used as a standalone application in some instances for machine control, but in environments where it is not connected to the Internet. If a customer wants to connect the system to the Internet, Datac recommends RealFlex, Kerr said. Datac’s engineers are looking into the vulnerabilities reported in RealWin but said the problems are “not a real threat.”
“Our RealFlex 6 SCADA software is very secure and has gained a reputation as an extremely robust SCADA system used in thousands of sites around the world,” Kerr said.
(from Jeremy Kirk at Computer World)
And from the 7 Technologies Website:
Our development team took the situation very seriously and a security patch with bug fixes was quickly released for distribution through the normal IGSS update procedures. The security update closes the potential vulnerabilities which the security report uncovered.
It should be emphasized that the reported security issue is only relevant if you run IGSS without a firewall.
It should be noted that we strongly recommend that systems running IGSS-installation always should be placed behind a firewall. If this recommendation is followed, the security report will not be an issue for IGSS-installations.