Skip to main content

DHS warns of Chinese infrastructure software vulnerabilities

China Qinshan Nuclear Plant II (under construction)
Image used with permission by copyright holder

The U.S. Computer Response Readiness Team—a part of the Department of Homeland Security—has issued a bulletin (PDF) warning of software vulnerabilities in two software applications widely used in China to help control public utilities, chemical and manufacturing plans, and even weapons systems. The vulnerabilities are classic heap-based buffer overflow errors, the same type of exploit that has been repeatedly leveraged by malware authors for Windows and other operating systems.

If exploited successfully, the flaws could enable attackers to execute arbitrary programming on the systems, or perform a remote denial of service attack. Successful attacks could be highly destructive, shutting down plants and utilities or potentially creating dangerous conditions in chemical or manufacturing facilities that could lead to much larger problems. Exploitation of the problems in weapons systems could be potentially disastrous.

The U.S.’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) says it has coordinated with NSS Labs researcher Dillon Beresford (who uncovered the problems), as well as Sunway and the China National Vulnerability Database, and patches are available now that address both problems. However, it could take months for industries and operations to install the patches, leaving a potential window of vulnerability where the bugs could be exploited. There are currently no known exploits in the wild.

Sunway applications are mainly used in China, but are also utilized in parts of Asia, Africa, Europe, and the Americas, according to the advisory.

In an era when cyberattacks against corporations and infrastructure are increasingly common, the vulnerabilities highlight the potential risk of Internet based attacks against infrastructure systems. The Sunway software in question is used in supervisory control and data acquisition (SCADA), SCADA systems often control critical infrastructure and manufacturing processes, but were often developed before the Internet became widely available and, in many cases, were never intended to be part of network systems. Although companies have increasingly built Internet-enabled interfaces to SCADA systems, the systems themselves often have never undergone significant security audits.

Last year, the sophisticated Stuxnet worm targeted Siemens WinCC industrial control software in an apparent attempt to hamstring Iran’s uranium enrichment efforts, demonstrating how industrial systems can be vulnerable to Internet-based attacks.

Editors' Recommendations

Topics
Geoff Duncan
Former Digital Trends Contributor
Geoff Duncan writes, programs, edits, plays music, and delights in making software misbehave. He's probably the only member…
Lenovo sale: Get up to 67% off ThinkPad Laptops, from $600
Lenovo ThinkPad X1 Carbon Gen 12 front angled view showing display and keyboard.

Lenovo has a huge laptop sale going on right now with select ThinkPad laptops available from just $600. If you need a new system for your small business, working on the move, or other productivity-focused plans, these are the laptop deals for you. With over a dozen laptops in the sale, it’s a good idea to take a look at the sale for yourself, but we’re also here with some insight into the best deals.

What to shop for in the Lenovo laptop sale
Lenovo is one of the best laptop brands for reliability and business purposes. One great starting point is being able to buy the for $600. According to Lenovo, it normally costs $1,839 which seems a little unrealistic but in keeping with Lenovo’s overly enthusiastic estimated value system. However, whatever the discount, this is a good laptop for the price. It has a 12th-generation Intel Core i5-1235U processor, 16GB of memory, and 256GB of SSD storage. For the display, you get a 14-inch full HD screen with 45% NTSC and 300 nits of brightness. There’s also a 1080p full HD RGB/IR Hybrid webcam with a privacy shutter and dual microphones.

Read more
Ghost of Tsushima is already shaping up to be a monster PC port
Jin wearing the Sarugami armor with Iki island in the background.

Sony detailed the features that will be available in the Ghost of Tsushima PC port on Tuesday, setting the stage for when the game launches on May 16. Despite some rocky PC ports from PlayStation Studios and porting studio Nixxes in the past, Ghost of Tsushima already looks impressive.
Ghost of Tsushima DLSS, FSR, and XeSS
It's launching with all of the modern bells and whistles a PC gamer could want. That includes support for Nvidia's DLSS 3 and AMD's FSR 3, both of which support upscaling and frame generation. There's also support for Intel XeSS, as well as native anti-aliasing modes for FSR and DLSS. This runs the game at native resolution but uses the anti-aliasing of the upscalers for improved image quality -- read our explainer on Nvidia Deep Learning Anti-Aliasing for more on that.

There's a treasure trove of features here that means virtually every PC gamer will have access to performance-boosting tech. FSR 3 support at launch is particularly noteworthy. Adoption of AMD's frame generation tech has been slow, and although we've seen it in recent games, it usually isn't available at launch.

Read more
The 5 best laptops for architects in 2024
AutoCAD

Architecture applications tend to require a lot of hardware resources, so laptops that work for architecture tend to be more like workstations than anything else. Of course, that does mean that they come at a pretty steep price, which is why we've picked our favorite laptops that will give you the most bang for your buck. The laptops below should easily handle most architecture applications you throw at them, although if you don't quite find what you're looking for, you may want to check out our list of the best laptops for CAD and 3D modeling.
The Best Laptops for Architects in 2024

Buy the  if you want the best overall laptop for architects
Buy the  if you want the best MacBook for architects
Buy the  if you want the best thin and portable laptop for architects
Buy the  if you want the best large-screen laptop for architects
Buy the  if you want the best dual-screen laptop for architects

Read more