ICS-CERT Updates Meltdown Alert Again

Today the DHS ICS-CERT published the second update of their Meltdown Alert for this week. The update provides new information on the alert that was originally published on January 11^th, 2018 and updated on January 16^th, 2018, January 17^th, 2018, January 30^th, 2018, and on February 20^th, 2018.

The update provides links to three new vendor documents. They are:

• Beckman Coulter;

• Siemens (actually this link is good, but the one in the update does not work);

• Stryker (this is a direct link, the one in the update is a link to a link)

Both the Beckman and Stryker links take you to documents that were dated in January, so they are very preliminary notifications with little information. The Siemens document is dated today, and it provides some level of actionable detail for a number of industrial products.

NOTE: Siemens also released two other new security notifications this morning as well as updating six previously issued notifications. We may see these tomorrow on ICS-CERT, but more likely it will be next week.

Sigh – ICS-CERT Updates WannaCry Alert Again (#8)

Today the DHS ICS-CERT published another update to their WannaCry Alert that was originally published on May 15^th. There is no new information specifically from ICS-CERT, but links are provided to information from four new vendors:

• Beckman Coulter (multiple products);

• Samsung (generic);

• Toshiba (generic); and

• Toshiba Medical Systems (generic).

Beckman takes a very detailed approach, but one that is significantly different than the one Siemens has used. They start off by providing a single web page that is the source of information about each of their product lines. Then they classify each product into specific and limited categories:

• Not a Microsoft OS – no problem;

• Microsoft patch has already been deployed by Beckman;

• Neither patch nor WannaCry is applicable to the version of Windows® used;

• Products where hardware firewall is recommended;

• Products where detailed specific recommendations are provided; and

• Oops, we don’t know yet; wait for more information.

Each time Beckman identifies a product as a firewall candidate, they include a link to an interesting article about firewall protections against WannaCry by the NH-ISAC. The Q&A at the end of that brief article is particularly well done. I am surprised that ICS-CERT has not included that link in this Alert.