VxWorks cyber vulnerabilities – it is now open season on control systems

I had a chance to read HD Moore’s blog on VxWorks vulnerabilities - http://blog.metasploit.com/2010/08/vxworks-vulnerabilities.html.  HD is no novice – he developed Metasploit. This is a VERY BIG deal as VxWorks is arguably the most popular real time operating system (RTOS) for industrial control system field devices. We now have the Siemens TARGETED vulnerability which doesn’t take a genius to realize wasn’t just for industrial espionage (the worm cannot be mitigated by use of AntiVirus - http://www.symantec.com/connect/blogs/stuxnet-introduces-first-known-rootkit-scada-devices), the BP oil spill cyber incident which followed the Bellingham, WA gasoline pipeline rupture by 11 years (what have we learned), and now the VxWorks issues. In case people still don’t think ICS cyber is real, a month ago a US water utility lost the ability to supply water to their customers – nothing came out when you turned the tap. These are real issues and need to be addressed. Hopefully, the electric industry doesn’t sit on these issues the way they have with the Aurora demonstration and subsequent NERC Advisory. Obviously, the industry is in need of appropriate training and soon.
Joe Weiss