ICS-CERT Publishes Latest Monitor – Sep-Oct 2017

Yesterday the DHS ICS-CERT published the latest version of the ICS-CERT Monitor. Long time readers of this blog will no doubt understand that I have become less than enamored with this periodical in recent years. It has become more of a corporate selfie than a real communications tool, but occasionally there is an information gem that is worthy of note.

Selfie Components

The Monitor starts with a Trumpian, “look how great I am”, article on a recent training program conducted by ICS-CERT in Japan. It then goes on to announce the publication of a 2-page, color glossy ‘fact sheet’ looking back at last year’s “Recommended Practice: Improving Industrial Control System Cybersecurity with Defense-in-Depth Strategies” update.

There is one page dedicated to ICSJWG news, including an announcement of the Spring meeting dates; April 10–12 in Albuquerque, NM. Unfortunately the ICSJWG web site still does not include an agenda for the fall 2017 meeting, nor is there any mention of the rumored announcement that was made about the reorganization/abolishment/fusion of ICS-CERT.

Finally, we have the standard elements that we have come to know and ignore:

• ICS-CERT Assessment Activity;

• Recent Product Releases;

• Coordinated Vulnerability Disclosure; and

• Upcoming Events

The Gem

Okay, this may be more of a sparkler than a true precious stone, but there is an interesting and worthwhile full-page article on updating of antivirus software in ICS systems. The core assumption in this article is found in the second paragraph:

“The recommended secure network architecture for ICS (Figure 1) places the antivirus, Windows Server Update Services (WSUS), and patch server(s) in the control center LAN DMZ. In this architecture, each level should only send or receive traffic to any directly adjacent level, which precludes the antivirus/WSUS/patch server from communicating directly with either the vendor antivirus servers or the organizational antivirus servers.”

This, of course, leads to the need for downloading the daily AV signature update onto removable media, checking that media for malware, checking the hash, running the update on test environment, and finally, updating the AV on the appropriate ICS systems. All very neat and tidy, and security compliant; I wonder how many folks actually do this. Or is this really the reason that so many folks are starting to talk about how outdated/useless AV is?

Of course, the same process would be required for updates for all Windows OS, control systems, and device software. Again, does this explain the apparently widespread practice of overlooking/ignoring system updates?

ICS-CERT Publishes LCDS Advisory

Today the DHS ICS-CERT published a control system security advisory for the Leão Consultoria e Desenvolvimento de Sistemas (LCDS) LAquis SCADA software. They also published the draft agenda for the Spring 2017 meeting of the ICSJWG in Minneapolis, Minnesota, on April 11-13, 2017.

LCDS Advisory

This advisory describes an improper access control vulnerability in the LAquis SCADA software. The vulnerability was reported by Karn Ganeshen. LCDS has produced a new version to mitigate the vulnerability. ICS-CERT reports that Ganeshen has verified the efficacy of the fix.

ICS-CERT reports that a relatively low skilled attacker, presumably with local access, could exploit the vulnerability to escalate their privileges and modify or replace application files.

ICSJWG Agenda

ICS-CERT has provided a link to the draft agenda for the ICSJWG Spring 2016 Meeting. It looks like there will be a number of interesting presentations from familiar names and organizations.

There appears to be an increasing interest in the interface of safety and security in process engineering. With the recent congressional interest in cyber informed engineering (see S 79 in the 115^th Congress and S 2943 in the last session) Virginia Wright of the Idaho National Labs will be doing a presentation on the INL work on the topic (see here).

ICS-CERT Publishes Meteocontrol Advisory and Meeting Announcement

This morning the DHS ICS-CERT published a control system advisory for a WEB’log application from Meteocontrol. The also published the date for the fall meeting of the ICSJWG.

Meteocontrol Advisory

This advisory describes three vulnerabilities in the Meteocontrol WEB’log application. The vulnerabilities were reported by Karn Ganeshen. Meteocontrol has produced a new version that mitigates the vulnerability. There is no indication that Ganeshen has been provided the opportunity to verify the efficacy of the fix.

The vulnerabilities include:

• Information exposure - CVE-2016-2296;

• No authentication - CVE-2016-2297; and

• Sensitive information exposure - CVE-2016-2298.

ICS-CERT reports that a relatively unskilled attacker could remotely exploit these vulnerabilities to run system commands or access sensitive information.

ICSJWG Fall Meeting

ICS-CERT announced that the Fall 2016 ICSJWG Meeting will be held in Ft. Lauderdale, FL on September 13-15, 2016. The ICSJWG web site will have additional information (including registration and a call for abstracts) in the near future.