Tag Archives: critical infrastructure

Wind River Resolves Critical Infrastructure Vulnerabilities

Last week the real-time embedded systems vendor Wind River Systems released security updates for a large number of critical infrastructure systems.

====================
TL DR:
If any of your enterprise clients use within their network perimeter: modems, routers, firewalls, printers, industrial control or medical monitoring devices; check if any of those devices use Wind River’s VxWorks software based on their TP/IP stack (IPnet). If so, review the FAQs and security advisory linked to below to install the necessary updates.
====================

Why should these vulnerabilities be considered important?
The sheer number of affected devices is thought to be very large due to the prevalence of devices running the vulnerable VxWorks software. I realize the list of devices above is very generic but the FAQs and security advisory are not vendor or model specific. This means you may have some of these devices and not even realize it. Verifying if they are using VxWorks and what version will be a priority.

Since medical monitoring and industrial control devices are included in this advisory; if these vulnerabilities are exploited there is the potential for a threat to human life. E.g. if incorrect results are displayed on a medical device, too much medication is administered, or if temperatures exceed safe levels in an industrial control system.

Due to the nature of four of the vulnerabilities; a border firewall will not always be enough to prevent an attacker exploiting. Broadcast packets could be sent to every device in the network, compromising them all at once.

How can I protect my organization from these vulnerabilities?
Review the FAQs and the security advisory and take the necessary steps to install the relevant patches. If your organisation is affected; first apply the necessary mitigations to any vulnerable device you initially discover while you assess the remaining number of impacted devices and develop a plan/schedule to approach the installation of the patches:

Mitigations listed on Page 3 (onwards) of this security advisory:
https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/security-advisory-ipnet/

FAQs:
https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/ipnet-faq/

From my understanding of the information provided by Wind River they are directly contacting their affected clients and may offer paid for assistance to resolve these vulnerabilities for out of support devices. However, there is a possibility they may inadvertently miss an affected organisation. Please contact Wind River if in doubt:

support@windriver.com

Thank you.

====================
References:
Wind River’s Blog Post:
https://blogs.windriver.com/wind_river_blog/2019/07/urgent-11-further-boosts-vxworks-security.html

Kaspersky ThreatPost article:
https://threatpost.com/urgent-11-critical-infrastructure-eternalblue/146731/
====================

Mitigating the Increasing Risk Facing Critical Infrastructure and the Internet of Things

With attackers and malware authors extending their reach to more and more areas of our everyday lives, both companies and individuals need to take steps to improve the security of their equipment/devices. It’s not just devices such as thermometers (while important) in our homes at risk; devices that impact health and safety as well as entire communities and economies are being / or will be targeted.

For example, last month a cyber-attack took place in Ukraine that while it only lasted approximately 1 hour, served to cause a power outage in an entire district of Kiev. The on-going investigation into this attack believes it to be the same attackers responsible for the December 2015 attack (that attack affected approximately 250,000 people for up to 6 hours).

In a similar manner, a smaller energy company (at an undisclosed location) was a victim of the Samsam ransomware (defined). The attackers initially compromised the web server and used a privilege escalation vulnerability (defined) to install further malware and spread throughout the network. The attackers demanded 1 Bitcoin per infected system. The firm paid the ransom and received a decryption key that didn’t work.

Fortunately, this energy company had a working backup and was back online after 2 days. The root cause of infection? Their network not being separated by a DMZ (defined) from their industrial networks. This Dark Reading article also details 2 further examples of businesses affected who use industrial systems namely a manufacturing plant and a power plant. Both were located in Brazil.

Mark Stacey of RSA’s incident response team says that while nation states have not yet employed ransomware in industrial systems, it will certainly happen. He cites the example of a dam, where the disabling of equipment may not demand a large ransom compared to the act of encrypting the data required for its normal operation.

Former US National Security Official Richard Clarke is suggesting the use of a tried and tested means of increasing the security of all deployed industrial control systems. As it is very difficult convincing those on the Board of Directors to provide budget for something that has not happened/may not happen, he suggests employing an approach similar to that of the Y2K bug. This would require introducing regulations that require all devices after a given date be in a secured state against cyber-attack. He advocates electric power, connected cars and healthcare providers follow this approach and notes that without regulation “none of this is going to happen.” Since these regulations would apply to all ICS/SCADA (defined) vendors, they would also not loose competitiveness

With security analysts predicting further compromises of ICS/SCADA equipment this year, we need to better protect this infrastructure.

For enterprises and businesses, the regulations proposed above should assist with securing IoT and ICS/SCADA devices. However, this is just the beginning. This scanner from Beyond Trust is another great start. As that article mentions the FTC is offering $100,000 to “a company that can discover an innovative way of managing and patching IoT devices.” Securing IoT devices is not an easy problem to solve.

However, progress is happening with securing critical infrastructure and Internet of Things (IoT)(defined) devices. For example, please find below resources/recommendations, tools and products that can help protect these systems and devices.

How can we better secure ICS/SCADA devices?
These devices power our critical infrastructure e.g. power, gas, communications, water filtration etc. The US ICS-CERT has a detailed list of recommendations available from the following links:

ICS CERT Recommended Practices
ICS-CERT Secure Architecture Design
ICS Defense In-Depth (PDF)

An ICS-CERT overview of the types of vulnerabilities that these systems face.

Securing IoT devices in industry
Free IoT Vulnerability Scanner Hunts Enterprise Threats (Dark Reading.com)
Defending the Grid
Network and IoT to underpin Trend Micro’s 2017 strategy

Securing IoT in the medical sector/businesses
Hospitals are under attack in 2016 (Kaspersky SecureList)
Fooling the Smart City (Kaspersky SecureList)

Recommendations for consumer IoT devices are the following
My previous recommendations on securing IoT devices
Blog Post Shout Out: New Wireless Routers Enhance Internet of Things Protection
Securing Your Smart TV
8 tips to secure those IoT devices (Network World)
Who Makes the IoT Things Under Attack? (Krebs on Security)

=======================
I hope that you find the above resources useful for securing ICS/SCADA as well as IoT devices that are very likely a target this year.

Thank you.