Hackers Crash Controller via Web Service

There were 2 types of incidents ocurring at the same location in the same time frame: (1)  Hackers opened connections with our device , sent messages of unknown nature, then stopped communicating without closing the connection.  This exposed a bug in the control product.  After timing out the connection, the connection was left open.  After repeated attacks, all connections were consumed leaving the ethernet port unavailable for legitimate users. (2)  Hackers sent a WEB page to the device containing some java script and the text: ” Hello! Welcome to http://worm.com Hacked by Chinese”.  This exposed a bug in TCP/IP stack that caused invalid data access abort in the CPU.  This results in the controller going through a reset, which drives all outputs to their off state.

Two engineers worked on this problem full time for 3-4 weeks each.  The hard part was being able to identify the cause so we could reproduce it at the vendor’s site.  Our internal firewalls greatly reduce the likelyhood of these attacks getting through.  The customer in this case is a development partner, so we worked with them to capture the activity with a network analyzer.  Once the cause(s) were identified, the fixes were easy.