There were 2 types of incidents ocurring at the same location in the same time frame: (1) Hackers opened connections with our device , sent messages of unknown nature, then stopped communicating without closing the connection. This exposed a bug in the control product. After timing out the connection, the connection was left open. After repeated attacks, all connections were consumed leaving the ethernet port unavailable for legitimate users. (2) Hackers sent a WEB page to the device containing some java script and the text: ” Hello! Welcome to http://worm.com Hacked by Chinese”. This exposed a bug in TCP/IP stack that caused invalid data access abort in the CPU. This results in the controller going through a reset, which drives all outputs to their off state.

No responses yet