ICS-CERT Publishing Old Updates

NOTE: As of 5-3-13, 19:30 CDT the issues identified in this post with this update have been resolved. The link now takes one to the September 27th, 2012 version updated to the new HTML format.

Yesterday I was kind of surprised when ICS-CERT published an update to the Ruggedcom Advisory that was news before the original advisory was published. Today, I am more than surprised; I am more than a little concerned because ICS-CERT re-published as new an update to the SHAMOON JSAR that was originally published last September.

Now this could just be a problem of updating all of the old .PDF alerts to the new .HTML model, but today’s publication certainly claims that the date for the –A update is April 30^th, 2013 not September 27^th, 2012.

Now there was a second update to this advisory published last October. As I noted in that earlier blog post the second update was not that impressive, but it did provide some new information. That information is not included in today’s “update”.

Now the links to the ICS-CERT publications in the previous blog posts about the updates are no longer particularly useful. The first update (-A) link now takes you to today’s version of the update (virtually the same as the original outside of some formatting changes and the ‘wrong’ change date). The second update (-B) link now takes you to the original version of the JSAR (again in the new HTML format) with a bogus ‘original release date’ of October 16^th, 2012.

I understand that it is easy to make inadvertent changes to documents when you fool with reformatting the documents. This is why historical records do not typically get reformatted; there is no need to put their information integrity at risk.

BTW ICS-CERT: If you need copies of the original .PDF files to correct the historical record, let me know. I have copies of most of the alerts and advisories back to June of 2010. I’ll be happy to ship them to you on a thumb drive….. ;-)