ICS-CERT Publishes Last Monitor for 2012

Today the folks at ICS-CERT published their last Monthly Monitor for 2012. Actually still calling it a “Monthly” is just a little misleading because it covers the months of October, November and December.

ICS-CERT Responses

Once again we see another report of an ICS-CERT away team investigation. This time it concerns two SCADA engineering workstations that were infected with “sophisticated malware” via an infected USB drive. It’s a nice discussion of how to go about disinfecting an infected system without appropriate backups. Unfortunately (or fortunately depending on your point of view), it appears that the only thing ICS related was the primary use of the workstations. The name of the malware is not mentioned, but there was no real impact or infection of the SCADA system.

A briefer second piece describes the infection of some computers on the ‘control system network’ with some unidentified ‘crimeware’ again via an infected USB drive. Again, the location of the infection seems to be the only thing of ICS-CERT interest.

Of course, the routine use of USB drives in both cases served at the method of infection. That serves as an educational point, with the point being made that:

“ICS-CERT continues to emphasize that owners and operators of critical infrastructure should develop and implement baseline security policies for maintaining up-to-date antivirus definitions, managing system patching, and governing the use of removable media.” (Pg 2)

A second article provides a brief summary of the ICS-CERT operational responses to cyber incidents in FY 2012. They report a total of 198 cyber-incidents reported by industry. Again the only actual ICS related incident reported was the ‘hacked water system in Illinois’ that wasn’t hacked.

Other Information

There is an interesting discussion of the CVSS Score that is reported in each ICS-CERT Advisory. It explains what the score means and how it is determined.

There is also a nice description of Project Shine, a result of a SHODAN investigation initiated by by Bob Radvanovsky and Jake Brodsky. They reported over 460,000 IP addresses of SCADA systems that appeared to be internet facing. Efforts are being made to identify and contact the owners of the systems to warn them of their exposure. ICS-CERT is concentrating on those critical infrastructure systems identified.

There is also a brief discussion of the continuing ICS-CERT response to the apparent coordinated attack on oil and natural gas pipeline operators. Still no information about direct involvement of control systems, though this piece does note that many “of these incidents targeted information pertaining to the ICS/SCADA environment, including data that could facilitate remote access and unauthorized operations”. (pg 4) This has also led to an increased out-reach effort by ICS-CERT to explain the ICS vulnerabilities present in critical infrastructure.

There is also a nice summary of the vulnerabilities reported in ICS-CERT advisories over FY 2012. Of the 177 different vulnerabilities reported, the largest number (44) were buffer overflow vulnerabilities with input validation vulnerabilities placing a distant second (18 instances).

Finally there is a brief summary of the Industrial Control Systems Joint Working Group (ICSJWG) 2012 Fall Meeting.

Oh, one final note; as usual the Monitor closes out with a listing of recent coordinated disclosures and a list of researchers currently working with ICS-CERT on disclosures. While our friend Luigi is mentioned on the first list on two separate vulnerability notices, he doesn’t make the final ‘working with list’. Could be his new company formed to sell 0-day vulnerabilities puts him outside of the coordinated disclosure network.

ICS-CERT Monthly Monitor and Multiple WinCC Vulnerabilities

Today DHS ICS-CERT published their latest Monthly Monitor and a new advisory for multiple vulnerabilities in Siemen’s WinCC.

Monthly Monitor

The August 2012 ICS-CERT Monthly Monitor was published today. Some interesting topics are included in this issue including medical device vulnerabilities, Indian grid failure, and new disclosure policies. Unfortunately, none of them are up to the typical level of detail we’ve come to expect from ICS-CERT. Summer is a slow time for many news organizations and it appears to have affected the latest issue of the Monthly Monitor. We’ll wait for the September issue.

Siemens Vulnerabilities

Siemens is reporting five vulnerabilities in its WinCC WebNavigator. These were originally reported to Siemens by Positive Technologies. The vulnerabilities include:

• Reflected cross site scripting, CVE-2012-3031;

• Cross site request forgery, CVE-2012-3028;

• Forceful browsing, CVE-2012-3030;

• SQL injection, CVE-2012-3032; and

• ActiveX, CVE-2012-3034.

An attacker with medium skills could remotely exploit these common browser vulnerabilities. Siemens has an update for WinCC 7.0 SP2 that fixes four of these vulnerabilities. The cross site request forgery vulnerability has yet to be patched. For that vulnerability, as an interim solution, Siemens recommends:

• Do not interact with other Internet-related services while being logged in.

• Log out when WebNavigator is not needed any more.

This is the second web browser vulnerability report in a week in a major control system product. Folks like Microsoft have been dealing with these types of vulnerabilities for a large number of years. I won’t be surprised if researchers include these dedicated web browsers in their ongoing searches for easy to find vulnerabilities.

ICS-CERT Publishes Monthly Monitor and Updates Siemens Advisory

Late yesterday afternoon the folks at DHS ICS-CERT published their March 2012 ICS-CERT Monthly Monitor and an update to a previously issued Siemens system Advisory. The Monthly Monitor provides some information on an interesting phishing attack on an electric utility and the Siemens update addresses some mitigation issues.

Monthly Monitor

ICS-CERT is apparently going to be making it a common feature on their Monthly Monitor to describe an interesting new type of attack that their team has responded to in the previous month. This month it deals with a telephone phishing attack. The two attacks reported to ICS-CERT were unsuccessful due to an alert individual on the receiving end. Reporting (and publicizing) unsuccessful attacks is important because it helps other organizations learn how to avoid the attack.

The other thing about this type of attack is that it would be unusual for it to be directed at just one or two organizations. It will be interesting to see if other electrical distribution organizations were affect by a similar attack. It would also be nice to know if ICS-CERT pushed this information directly to other organizations in the industry.

The ‘Situational Focus’ section of the Monitor has a good discussion of system auditing and logging and another on the role of fusion centers. There is also a helpful description of their ICS Advanced Training course.

As is usual this is an issue well worth reading and circulating.

Siemens Update

The Siemens advisory update is more than a little confusing. This update references a ‘previous’ advisory from back in December. But that advisory has a different number than the current advisory and the vulnerability that is specifically addressed with new information is not found in that original advisory. What happened is that ICS-CERT updated that December advisory in January with new vulnerabilities. Readers might remember that the second advisory provided information on eleven separate vulnerabilities with mitigation measures for some but not all of the vulnerabilities.

This version provides a minor change to the mitigation measures for the telnet daemon. Where the second advisory noted that: “Users have the option of disabling the telnet function on SIMATIC panels when telnet is not actively being used.” The new version is a tad bit more active in its recommendation: “Siemens recommends disabling the telnet function on SIMATIC panels when telnet is not actively being used.”

I pointed out in my posting on the second advisory that ICS-CERT specifically noted that no one had verified the Siemens mitigation measures. This version reports that ICS-CERT has tested two of the service packs identified in the Siemens information and that they resolve the five of the eleven reported vulnerabilities that were actually patched. To address the remaining vulnerabilities the Advisory notes:

“The remaining vulnerabilities are addressed in documentation and a new FAQ entry on Siemens website. If unable to implement these changes, product users should contact their integrator or Siemens product support for assistance.”

I just hope that Siemens is pushing this information to their customers. I would bet that the vast majority of owners never see the ICS-CERT web site or blogs like this one.

ICS-CERT Publishes January Monthly Monitor

FULL DISCLOSURE: There were some very kind comments about this blog in the January ICS-CERT Monthly Monitor (see the last page article on CFATS). Even though, for a blogger, that mention is better than money, this shouldn’t affect my review, as I have generally had good things to say about the Monthly Monitor since it began publishing.

Today the DHS ICS-CERT people published their January edition of their Monthly Monitor, a brief look at industrial control system news over the previous month. This issue highlights two ICS-CERT incident responses in December (one that you may have heard about in the news), industrial cellular security, a short 2011 cybersecurity review and the standard sections that been a major part of the Monthly Monitor’s outreach efforts on behalf of ICS-CERT.

Two Incident Responses

As you would expect, ICS-CERT can’t go into a lot of details in publicly describing any of the incidents that they have been involved in investigating or evaluating; but these two short reports provide some invaluable information about the responses from ICS-CERT and the types of problems that face the community. One dealt with a chemical facility and the other dealt with a railroad.

The chemical facility incident did not apparently involve an actual control system. Rather an advanced persistent attach had been discovered and the company was concerned that it might have involved data exfiltration. The involvement of the control systems at the company might, thus have been placed in a compromised situation.

The result was that “ICS-CERT assisted the company with identifying the scope of the infection and by providing analysis and mitigations for eradicating the threat actor from their network” (page 1). Hopefully it also provided some educational assistance at avoiding similar troubles in the future.

The second response story apparently relates to an incident that made the news earlier this month where one DHS organization announced that there had been a foreign based cyber-attack on a railroad control system. Apparently this was more of an attack than we had seen in the water system story, but it wasn’t an attack specifically directed at the railroad. The article reminds security managers that (page 1):

“This incident underscores that Critical Infrastructure Key Resource (CIKR) own-ers and operators should evaluate existing cybersecurity countermeasures they have in place against broader cybersecurity risks. Any number of non-targeted cybersecurity events can impact operations when systems are Internet accessible.”

As is usual with this newsletter, the publishing team includes links to ICS-CERT or US-CERT documents that provide additional information regarding the topic. In this case they link to a short handout about ICS-CERT incident handling procedures with emphasis on how to get ready for a fly-away team investigation.

Industrial Cellular Security

There is a full page article about security issues associated with the wide variety of cellular devices that are available for industrial control system applications. It’s a very interesting primer; well worth the read. There are two interesting outside-of-DHS documents listed in the article, unfortunately the links were corrupted in the printing process; cut-and-paste them though and they work fine.

Coordinated Disclosure Researchers

At the end of every issue, ICS-CERT makes a plug for its coordinated disclosure program. Knowing that many researchers can use the free publicity, they include a listing of researchers that are currently working with ICS-CERT to help resolve exploits that they have discovered. Their efforts are apparently succeeding as the list of names continues to grow each issue. In fact, they have expanded the effort by adding a listing of ‘Notable’ researchers, listing the specific projects that they have worked on.

An interesting note about these two lists of researchers is the inclusion of one specific name that is well known to readers of this blog; Luigi Auriemma. Readers will certainly remember that Luigi sprang full blown on the ICS scene with a large number of uncoordinated disclosures on a single day; he took a lot of heat for that from a number of people. Apparently ICS-CERT has forgiven Luigi his trespasses and brought him at least partially into the fold; welcome Luigi.

ICS-CERT Publishes October Monthly Monitor

This morning the DHS Industrial Control System Cyber Emergency Response Team (ICS-CERT) published the October edition of their Monthly Monitor, a publication that

 highlights recent activities and information products affecting industrial control systems (ICS).

As we have come to expect with this publication we can find a combination of discussions about nearly current (the October issue address issues from September) ICS security issues, descriptions of various ICS-CERT activities, and probably most importantly extensive links to more detailed information. Anyone involved with industrial control systems should make it a habit to read this brief newsletter.

Risk Reporting and Evaluation

In their discussion of the “Dynamic Nature of Vulnerability Reporting and Disclosure” ICS-CERT reminds us that “each issue identified with potential impact to ICS systems must be assessed, understood, and addressed to minimize the overall risk to critical infrastructure and key resources (CIKR) owners and operators”. This appears to be a response to some recent criticism that ICS-CERT is spending too much time responding to common HMI vulnerabilities like those disclosed by Luigi rather than larger problems like general PLC communication security issues. As is usual in controversies of this sort, both sides have valuable points in their favor, making this an issue that needs further ‘frank and open’ discussions to reach a reasonable compromise.

Incident Information

One of the things that this publication does poorly is addressing current incidents. For instance, they mention in passing that:

“ICS-CERT recently responded to a particular incident relating to Internet facing substations. Access to monitoring and diagnostic functions could have been exploited using a known authentication bypass vulnerability. This is but one of many examples that have been brought to the attention of ICS-CERT over the past month.” (page 2)

Generally speaking ICS-CERT cannot report on any details regarding incidents that they respond to. First there is the confidentiality issues concerning system details of supported organizations; if they violate that confidentiality, no one will come to them for help ever again. Secondly they don’t want to give attackers any feedback on how effective their efforts were.

Having said that; it would be beneficial to the ICS community if a little more statistical detail were made available about the types of attacks discussed. Further down the page in a separate article they report that the FY 2011 incidents were up from the previous year (130 vs 40). Similar generic information could be provided about the types of incidents; for example how many internet facing control system incidents were reported? How many of them were just identification of vulnerabilities? How many of them were exploits that had been attempted and how many of those were ‘successful’?

You could have the same type of data available for a variety of incident types; DOS, information theft, system compromise, etc. This data could help industry and researchers prioritize their work.

Uncoordinated Disclosure Credit

More than a few of us that routinely blog about ICS security issues have questioned the ICS-CERT policy of not disclosing the name of researchers that publicly disclose newly discovered vulnerabilities rather than go through a coordinated disclosure process directly through the vendors or through reporting agencies like ICS-CERT. While that remains the official policy of ICS-CERT this edition does give back-door credit to Luigi Auriemma for his most recent batch of disclosures; they quote a PCWorld.com article about the disclosures and include Luigi’s name in that quote.

This final section of the Monitor “Open Source Situational Awareness Highlights” is a valuable contribution to the discussion within the community. I think that there is generally a good mix of sources include, though the quoting of blogs is kind of lite. While the Threat Post blog is quoted twice I have yet to see informative ICS blogs like those by Dale Peterson, Joel Langill, Eric Byres, or even mine (okay that’s a stretch but the other three are important contributors to the cyber security community).

ICS-CERT Publishes September Monthly Monitor

On Friday the DHS Industrial Control System Cyber Emergency Response Team (ICS-CERT) published the September edition of their Control System Monitor. Articles in this issue included reports on the latest spear-phishing campaign, hurricane response, and an update on the cross-vendor working group.

Spear Phishing Campaign

The newsletter reports on what appeared to be a focused campaign of spear phishing attacks on the energy, nuclear and government sectors. ICS-CERT reports that their analysis showed that this campaign appeared to be targeting control systems engineers. The article notes that ICS-CERT issued two alerts on this campaign in July.

The last bit of information will be news to most readers of this blog, as I certainly didn’t report on those alerts. The reason is that they were published on the US-CERT Control Systems Center secure portal. ICS-CERT explains that limited dissemination by stating that:

“While ICS-CERT strives to make as much information publicly available as possible, the indicators in these Alerts are considered sensitive and cannot be disseminated through public or unsecure channels.”

These alerts would be essentially counter-intelligence reports and there is always a fine line that has to be drawn about releasing such information. Too wide a release will alert the adversary about the means used to detect their attack which would allow the refinement of the attack. Too little release would leave the targeted organizations unaware of the potential threat. It is easy to criticize such decisions in hind sight and without responsibility for protecting the information.

Having said that, I would think that it would have been helpful for ICS-CERT to have published a limited information alert on their open access web page with a note for the potentially affected industries to get more information from the secure portal. That is, after all, what this article in the Monthly Monitor is doing. A more timely alert on the same lines may have protected more systems from potential attack or identified successful attacks earlier. At the very least it would have ensured that bloggers, like me, would have addressed the issue, spreading the word to a wider audience.

Interestingly it appears that this campaign may have been the reason that the previous issue of the Monthly Monitor included an article on the topic of spear phishing. If so, kudos to ICS-CERT for a creative partial-solution to the timely disclosure problem.

Hurricane Response

The article on the ICS-CERT monitoring efforts during Hurricane Irene helps to remind people that a full look at security includes protecting an organization against the effects of natural hazards as well as human attacks. The article provides a brief discussion about the importance of contingency plans for response to interruptions caused by both man-made and natural disasters.

Cross-Vendor Working Group

There is an interesting but brief article on the kick-off meeting of the cross-vendor working group of ICSJWG that is trying to “develop a unified approach for addressing serious security issues that exist across many vendor platforms”. One particular sentence in report may draw some criticism from the control system security blogger community;

“An inaccurate perception exists that the vendor community does not fully understand control system security challenges.”

There will certainly be a disagreement about the extent of the ‘community’ that does or does not ‘fully understand’ the control system security challenge. I think that we all can agree however, that a wider and fuller understanding would be helpful in all parts of the community.

May ICS-CERT Monthly Monitor

Yesterday, the DHS Industrial Control System Cyber Emergency Response Team (ICS-CERT) published the May issue of their Monthly Monitor. This the second of what hopefully will be a long run of monthly documents that “highlights recent activities and information products affecting industrial control systems (ICS) and provides a look ahead at upcoming ICS related events”.

There is a lot of good information summarized in this publication with extensive links to source documents. I particularly appreciate the section on ‘Incident Response’ This provides sanitized descriptions of actual cyber security events that the ICS-CERT people have dealt with in the last month. Some of them have already been dealt with in the open media, but most have never been publicly released.

This month’s issue contains a brief report about a security researcher’s identification of a vulnerable, internet-facing control system to ICS-CERT. In the Analysis section there is a brief update about the tools that researchers use to identify such sites.

This is a good publication for anyone involved in the management of control system security.