Global Quality Journal

Potential Security Flaw In Siemens' Enabled Industrial Control Systems

Reuters:

Jim FinkleReuters

10:50 p.m. CDT, August 21, 2012

BOSTON (Reuters) - The U.S. government is looking into claims by a cyber security researcher that flaws in software for specialized networking equipment from Siemens could enable hackers to attack power plants and other critical systems.

Justin W. Clarke, an expert in securing industrial control systems, disclosed at a conference in Los Angeles on Friday that he had figured out a way to spy on traffic moving through networking equipment manufactured by Siemens' RuggedCom division.

The Department of Homeland Security said in an alert released on Tuesday that it had asked RuggedCom to confirm the vulnerability that Clarke, a 30-year-old security expert who has long worked in the electric utility field, had identified and identify steps to mitigate its impact.

RuggedCom, a Canadian subsidiary of Siemens that sells networking equipment for use in harsh environments such as areas with extreme weather, said it was investigating Clarke's findings, but declined to elaborate.

Clarke said that the discovery of the flaw is disturbing because hackers who can spy on communications of infrastructure operators could gain credentials to access computer systems that control power plants and other critical systems.

"If you can get to the inside, there is almost no authentication, there are almost no checks and balances to stop you," Clarke said. [Read more]

 

posted by: gqjournal

800,000 French Mobile Customers Lost Access To Voicemail

GIGAOM:

It’s just a couple of months since French mobile network Orange suffered a huge, embarrassing outage that left many of its 26 million customers unable to make any calls for nearly an entire day. Now, just when the company thought it was getting over the damage that caused, it’s been hit with another bug.

On Wednesday afternoon, around 800,000 customers lost access to their voicemail as the result of what it says was an application error that has now been resolved. The outage, which seemed to hit users all around the country, lasted for four hours — far less than July’s more-than-12-hour collapse — and talking to Le Figaro, a company spokesman said it was now, finally, fixed.

The dysfunction related to a small glitch on the Orange network. “Our technicians have made an update to one of our messaging platforms, which created a malfunction. The situation returned to normal around 6pm, ” says a spokesman for Orange.

These are testing times for the country’s No1 network, which is not only under pressure from rivals but has also been trying to endure a corporate scandal at parent company France Telecom that has seen a number of senior executives indicted over the deaths of workers.

But from a technical perspective, it’s not the only one to be suffering from software and network issues.

As Kevin Fitchard pointed out here recently, a run of problems have happened to networks across the world, and in fact the same sort of problem that Orange suffered in July has also happened on Verizon in the U.S. and on Britain’s O2. That was down to a malfunction in a piece of infrastructure known as the Home Location Register. [Read more]

 

posted by: gqjournal

McAFee Update Knocks Users Offline

TheHostingNews:

McAfee, We Have a Problem: Update Glitch Hits BT Users

August 23rd, 2012 By: THN News

(The Hosting News) – McAfee we have a problem: That was surely the message broadband provider BT had when a well-intentioned antivirus update from the security firm began knocking its users offline recently.

McAfee had issued a standard patch for its McAfee VirusScan Enterprise 8.8 edition. However, a key bug in the process didn’t bode well for particular online users.

“We’re aware that some of our customers have lost access to the internet after recent updates by McAfee,” the Internet service provider noted. However, affected users can rest assured that the problem is fixable. On Tuesday, one day after BT acknowledged the problem, McAfee issued two hotfixes via its website.

When describing the problem, the security firm stated, “McAfee has identified an issue with DAT 6807 and 6808 that is causing intermittent issues with VirusScan Enterprise (VSE) 8.8.x. Specifically, these DATs can affect McShield.exe and may cause issues with the On-Access Scanner. If you have deployed either the 6807 or 6808 DAT, McAfee strongly recommends that you perform the remediation steps in the Solution.”

It’s not the first time a company has worked to address its own errors that end up having negative consequences. Earlier this year in February, a routing error knocked 3 million users of ISP company Telstra offline, according to a report from itworld.com. [link]

posted by: gqjournal

Washington State University Could Not Start Year Because of PeopleSoft Bug

PC Advisor:

Oracle software glitch mars semester's start for university, students

Problems with the PeopleSoft system should be fixed next week, according to a Washington State University official

By Chris Kanaracus | 23 August 12

The first week of class at Washington State University has been a tumultuous one for students and parents who depend on financial aid, due to a software glitch in a recently installed Oracle PeopleSoft system.

Hundreds of students and parents, angry and frustrated over delayed financial aid disbursements, have been assailing school administrators this week in search of answers, according to published reports this week.

The problems stem from communication issues between the software's student financials and financial aid modules, said Casey Hanson, director of new media and communications for WSU Information Services, in an interview Thursday.

Technicians are still working on the problem, Hanson said. The issues can also be attributed to the learning curve students and parents are facing while learning to use the system and its new processes, Hanson added.

Other factors played a role as well, such as the onrush of activity that accompanies the beginning of a semester, and "severe" budget cuts suffered of late by the school, according to Hanson. The latter has meant fewer staffers are available to help students and parents work with the system. "We're doing more with less," Hanson said. "It's kind of a perfect storm with all these items."

The system, which cost roughly US$15 million, is called Zzusis. The student financials module was the last phase of the project and went live recently. It and other parts of Zzusis replace a series of legacy student-information software systems at the school, which has more than 26,000 students and is located in Pullman.

While the system was tested before the final go-live, "probably more would have been better" [Read more]

posted by: gqjournal

No Bikes Program For NYC; Mayor Bloomberg: "The Software Doesn't Work"

New York Post:

Red-faced city officials finally admitted yesterday that the ambitious bike-share program won’t begin until next spring — an about-face from earlier denials that the program was just behind schedule.

Mayor Bloomberg blamed the holdup on software troubles, saying the extra time will help Alta Bicycle Share work out the bugs.

“The software doesn’t work. Duh,” the mayor said on his weekly WOR radio show. “We’re not going to put it out until it does work.”

The Post first reported last month that the share program might not be ready this year, putting in jeopardy one of the mayor’s signature transportation initiatives. [Read more]

posted by: gqjournal

SEC Reviewing Knight's Software Process

Reuters:

Dormant software caused problem

* SEC asking if glitch should have been caught

By Jessica Toonkel and John McCrank

Aug 16 (Reuters) - U.S. regulators are working to figure out whether the trading snafu at Knight Capital Group that resulted in a $440 million loss and nearly destroyed the firm was exacerbated by a breakdown in risk management, according to a source familiar with the situation.

A team of U.S. Securities and Exchange Commission's trading and markets division staff and the Office of Compliance Inspections and Examinations are focused on trying to uncover what happened and whether the problem should have been caught, said the source, who declined to be identified because the individual is not allowed to talk to the press.

One of the questions being asked by the SEC is why there appeared to be a breakdown in controls. There was no single point person at Knight to deal with the problem when it occurred, leading to further confusion and extending the time it took to stop the flow, according to a second source.

A spokesman for the SEC declined to comment on the nature of the investigation, instead referencing an August 3 SEC statement on the matter that said there were rules in place that should have prevented the problem. [Read more]

posted by: gqjournal

Google Security Bug Bounties Go Up

eWeek:

Google is raising the rewards it pays to security researchers who find bugs in its Chrome Web browser, following a decline in the number of security issues found by flaw finders.

On Aug. 14, Google boosted the bounties it pays as part of its Chromium Vulnerability Rewards Program, an initiative for recognizing researchers who submit bugs to the company. Google increased the minimum bounty from $500 to $1,500, and added other bonuses that could raise rewards by $3,000 in total. The next day, the company announced that it would repeat the Pwnium contest, a $2 million competition for finding severe and exploitable bugs, and will pay up to $60,000 for the most severe issues.

Google is raising the payouts to researchers in an attempt to get them to dig deeper into the code and find flaws, said Chris Evans, engineering manager for Google's Chrome Security Team. The participants in its current program have apparently tapped out the easiest classes of vulnerabilities, leaving the more difficult-to-discover issues, he said. [Read more]

posted by: gqjournal

Chaos Monkey Wreaks Havoc: Probing Operational Quality

ZDnet:

Crash your cloud, before it crashes itself: Netflix shares tool to help find unknown bugs

Summary: The just-released Chaos Monkey tool lets cloud administrators unleash a mischievous program onto their cloud to randomly break components. But why would anyone want to do this?

By Jack Clark for Cloud Watch | July 30, 2012 -- 16:25 GMT (09:25 PDT)

Name any major failure that has struck a cloud recently - Amazon, Microsoft, Heroku - and the reason for the failure will be the same: an unforeseen problem.

But it doesn't have to be that way. Netflix, which operates a vast multi-continent video distribution cloud on top of Amazon Web Services, got so annoyed with unforeseen bugs in its own software that it designed a tool named Chaos Monkey to go out into its cloud and break things. The only difference between Netflix's tool and a real outage is that Chaos Monkey runs only in office hours.

"Failures happen and they inevitably happen when least desired or expected. If your application can't tolerate an instance failure would you rather find out by being paged at 3am or when you're in the office and have had your morning coffee?" Cory Bennett and Ariel Tseitlin wrote in a post to the company's engineering blog on Monday. 

"Over the last year Chaos Monkey has terminated over 65,000 instances running in our production and testing environments. Most of the time nobody notices, but we continue to find surprises caused by Chaos Monkey which allows us to isolate and resolve them so they don't happen again."

The tool runs within Amazon Web Services. It seeks out workloads running in Auto Scaling Groups and terminates the virtual machines (instances) at random. [Read more]

posted by: gqjournal