Info about 0-day SCADA flaws offered for sale
Following in the footsteps of French Vupen Security, Malta-based start-up ReVuln has also decided to sell information about zero-day vulnerabilities to companies and governments instead of sharing it with the developers of the flawed software and hardware.
In a recently released video, the company has showcased a number of 0-day exploits for SCADA systems and claimed that all the vulnerabilities affect the server-side and are remotely exploitable.
According to the company, they discovered vulnerabilities in products by General Electric, Schneider Electric, Kaskad, ABB/Rockwell, Eaton, Siemens and other well known SCADA/HMI vendors.
ReVuln has been founded by independent security researcher Luigi Auriemma and former RIM security researcher Donato Ferrante. Auriemma is well known in the security community for his work in discovering vulnerabilities is any and every kind of software, but in the last few years he has been mostly focusing on ferreting out SCADA vulnerabilities and creating exploits for them.
He would usually share his discoveries with the software manufacturers and with the public on the Bugtraq mailing list, but apparently he had enough of that and is looking to get paid for his efforts.
While not the first company to opt for this kind of business model, ReVuln will surely receive its fair share of criticism directed at all who don’t share the knowledge about vulnerabilities with manufacturers.
The company has instituted a “Zero-day feed” aimed at sharing details about newfound flaws with the customers that subscribe to it, and says that the vulnerabilities included in the feed will remain undisclosed unless either the vulnerability is discovered and reported by a third party or the vendor publicly or privately patches the issue.
ReVuln also offers detailed analysis for vulnerabilities reported to vendors by third party entities, consulting services for improving and testing the security of ICS and industrial systems, and training in vulnerability research, protocols and formats reversing, and algorithms identification.
The company does not mention on its website whether they will – like Vupen claims to do – check out its customers and allow only NATO governments and “partners” to access the zero-day feed.
ReVuln does not concentrate only of discovering SCADA vulnerabilities, but they do represent the majority of the flaws they have found so far. That should not surprise anyone, as SCADA software developers rarely though about security first.