ICS-CERT Publishes 3 Advisories and 1 Update

Today the DHS ICS-CERT published two medical control system security advisories for products from Becton, Dickinson and Company (BD) and an industrial control system advisory for products from Sielco Sistemi. Both BD advisories were previously published on the NCCIC Portal on January 17, 2017. Yesterday ICS-CERT updated their medical control system advisory for products from St. Jude; that advisory was originally published on January 9^th, 2017.

BD Alaris 8015 Advisory

This advisory describes twin insufficiently protected credentials vulnerabilities in the BD Alaris 8015 Point of Care (PC) unit, which provides a common user interface for programming intravenous infusions. The vulnerabilities were self-reported, but the BD Security Bulletin reports that unnamed “independent security researchers” were involved in finding the vulnerability. The advisory provides multiple compensating controls that mitigate the vulnerability.

ICS-CERT reports that both vulnerabilities could be exploited by a relatively unskilled attacker with physical access to the devices. Both would require access to a flash drive; one installed in the unit the other one removeable. A successful exploit would allow the attacker access to the host facility’s wireless network authentication credentials and other sensitive technical data.

There is no mention of this vulnerability on the FDA Medical Device Safety Communications page.

BD Alaris 8000 Advisory

This advisory describes an insufficiently protected credentials vulnerability in the BD Alaris 8015 Point of Care (PC) unit, which provides a common user interface for programming intravenous infusions. The only difference in this advisory is that only an internal flash memory device is involved.

ICS-CERT reports that a relatively low skilled attacker with physical access to the device could exploit this vulnerability. The BD Security Bulletin, however, notes:

“Attack complexity is HIGH based on limited availability of these wireless credentials that are stored in the PCU on internal flash memory. The attacker would then have to use advanced tools to read the flash memory, decode the file system, and then locate and read the credential data. No system privilege is required and an attacker would be able to read the credential data without a user name or password.”

Sielco Sistemi Advisory

This advisory describes an uncontrolled search path element vulnerability in the Sielco Sistemi Winlog SCADA software. The vulnerability was reported by Karn Ganeshen. Sielco Sistemi has released a new version of the software to mitigate the vulnerability. There is no indication that Ganeshen has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT did not comment on the exploitability of this vulnerability except to note that a successful exploit may allow an attacker to load a malicious DLL and execute code on the affected system with the same privileges as the application that loaded the malicious DLL.

St Jude Update

This update provides new information on:

• The versions of the device that are affected by the vulnerability; and

• How the various versions of the device may be affected.

The FDA Safety Communication about this vulnerability has not been updated with the new information.

ICS-CERT Has Been Busy

With the Senate debating a cybersecurity bill that actually includes control system coverage, the folks at ICS-CERT have been hard at work trying to keep the control system community up to date on just how vulnerable our systems are. This week they have published, so far, three alerts, four advisories and their Monthly Monitor.

Alerts

KEP Infilink

WellinTech

Spec View

The DEFCON 20 conference last week was the source of the disclosure for two of the alerts, both reported by Dr. Wesley McGrew of Mississippi State University. Both deal with credential type issues and neither are remotely executable. The only thing of real  interest here (other than to owners of the affected systems) is that these are the only vulnerabilities to be reported at DEFCON 20 that ICS-CERT has been concerned about.

The third alert comes from an uncoordinated disclosure from Luigi. It’s a directory traversal vulnerability. It is remotely exploitable and Luigi has, as always, published proof of concept code on his web site. As expected, ICS-CERT did not include a link to Luigi’s disclosure, but I will. According to Luigi’s web site this disclosure was made back in June, hardly a timely notification by ICS-CERT.

It turns out that Luigi is also a composer. If you like techno type instrumentals, check out some of his tracks. 

Advisories

Siemen SIMATIC

ICONICS

Siemens Synco

Sielco Sistemi

Siemens has self-reported vulnerabilities in two separate systems; it seems that they have gotten on the identifying-correcting-reporting bandwagon. Two versions of  SIMATIC S7-400 CPU have DOS vulnerabilities. Siemens has provided a firmware update for the V6.03 CPU but not the V5 as it has reached end-of-life and has been discontinued. Of course everyone has replaced the older version so it isn’t really a problem (SARCASM alert).

The second Siemens advisory deals with a default password in their Synco OZW Web Server device used for building automation systems. This would allow access to the building automation network which may (not mentioned in the ICS-CERT Advisory) include security systems. A firmware update is available, but changing the default passwords is a simpler option.

Dr. McGrew (mentioned above) was responsible for the coordinated disclosure of the authentication by-pass vulnerability in the ICONICS  GENESIS32 and BIZVIS Security Configurator. ICONICS is releasing a patch that disables the backdoor security login in some versions (no word on the others) and plans to implement a “more secure encryption algorithm” in the future. There is a publicly available exploit for this vulnerability. HMMM… did Dr. McGrew talk about this at DEFCON as well? Maybe this should have been an alert instead of an advisory.

The Sielco Sistemi advisory closes out two ICS-CERT Alerts for the Winlog SCADA system (one from a Luigi disclosure and another by Michael Messner). Sielco Sistemi has provided a software update that has been verified by Messner (oops, I guess Luigi is on the outs again).

Monthly Monitor

The latest two-month issue of the Monthly Monitor is, as always, a worthwhile read. They provide an interesting update to their previous report on the apparently on-going phishing attacks on pipeline companies. In my opinion the most important part of that discussion is found in the second paragraph on the first page:

“Recent reports and analysis conducted by ICS-CERT indicate that information pertaining to the ICS/SCADA environment, including data that could facilitate remote unauthorized operations, has been exfiltrated as part of this campaign. Despite this, ICS-CERT has not received any reports of unauthorized access into the ICS environment; however, this may be due to limited monitoring and intrusion detection capabilities in the targeted companies control networks. The intent of the attackers remains unknown.”

While this spear phishing campaign appears to be solely directed at pipeline companies, owners of all control systems need to pay attention to this. It is a classroom lesson in how to go about a systematic attack on control systems; infiltrate the system to gain the knowledge necessary to formulate an effective attack on the system. Much the same thing must have been done to prepare the Stuxnet attack.

There is also an interesting snippet about what may be the ‘next’ systemic vulnerability, inadequate keys or certificates in embedded devices. It is apparent that ICS-CERT is concerned about this apparently wide-spread vulnerability. They note that:

“ICS-CERT is currently coordinating with multiple vendors that could be affected by this vulnerability.”

Typically I would expect silence about a vulnerability that is this important until the vendors either have a chance to fix it, or ICS-CERT gives up on their cooperation. Either ICS-CERT is changing their policy (maybe because this is so important) or the level of cooperation that they are receiving leaves much to be desired. We’ll be watching for advisories on this topic and will wonder when people like Luigi start to look for these on their own.

ICS-CERT Advisories on Two International SCADA Systems

Yesterday the DHS Industrial Control System Cyber Emergency Response Team (ICS-CERT) published advisories for two different industrial control systems from European companies; ARC Informatique and Sielco Sistemi. Both alerts deal with HMI related vulnerabilities.

ARC Informatique

This advisory provides updated information on an ICS-CERT alert issued in September for multiple ActiveX vulnerabilities in their PcVue system. The original alert was based upon an uncoordinated Luigi disclosure, but another researcher, Kuang-Chun Hung of Security Research and Service Institute Information and Communication Security Technology Center (ICST), had also initiated a coordinated disclosure on one of the vulnerabilities. Both researchers received credit in this advisory.

The four vulnerabilities identified in the initial alert have been verified and corrected by a patch provided by ARC Informatique. According to ICS-CERT it would take a moderately skilled attacker, using a social engineering style attack to successfully exploit these vulnerabilities

Sielco Sistemi

This advisory follows a limited distribution version that was made available on October 25^th. Independent researcher Paul Davis identified a buffer overflow vulnerability in the Winlog HMI system. This vulnerability can only be exploited through a corrupted project file and could result in a system crash or execution of arbitrary code. New versions of the affected programs are available from the vendor.

CVE Link Problems

ICS-CERT continues to have problems with the links to the NIST CVE listings for these vulnerabilities. None of the CVE links published in these two advisories worked this morning. The error message for the Sielco Sistemi vulnerability said the CVE number did not exist and the ones for the ARC Informatique vulnerabilities said that the link did not provide a properly formatted CVI number.

I’m not sure if the problem is an ICS-CERT or an NIST problem, but it continues to plague the links in the ICS-CERT advisories.