Public ICS Disclosures – Week of 07-14-18

This week we have two vendor updates (Rockwell and Siemens), two coordinated disclosures with POC (Sony), and proof-of-concept code (POC) for a recently disclosed vulnerability in Echelon products. There is also an announcement about an update to a security tool from OSIsoft.

Rockwell Update

Rockwell updated their FactoryTalk® Activation Manager advisory (previous update). The new version notes that: “Cisco has released several Snort Rules [Snort Rule 38246, Snort Rule 38247, Snort Rule 39910] to addressing the Flexera software vulnerability.”

NOTE 1: Since at least one other vendor (Schneider) apparently uses the same third-party software these Cisco snort rules may be more widely applicable in the control system community.

NOTE 2: This was published on Friday so there is a good chance that we will see the ICS-CERT version of this advisory updated in the coming week.

Siemens Update

Siemens published an update of their general advisory on the Spectre/Meltdown vulnerabilities. Siemens continues to expand their coverage of the newer versions of this problem; this time adding information on the Lazy FP State Restore and Spectre V1.1 vulnerabilities. While the latest version of the ICS-CERT Spectre/Meltdown alert does provide a link to this advisory, there is no mention of the newer versions of this continuing problem in that alert.

Sony Vulnerabilities

Talos Intelligence published two vulnerability reports (here and here) for coordinated disclosures of vulnerabilities in the Sony IPELA E Series Camera. According to the reports Sony has a patch available to mitigate the vulnerabilities, but there is no indication that they have had the opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Command injection - CVE-2018-3937; and

• Stack-based buffer overflow - CVE-2018-3938

NOTE: This was reported Friday, so there is always a chance that ICS-CERT will report this in the coming week. They have reported on IP camera vulnerabilities before, but do not necessarily report on all such vulnerabilities.

Echelon Exploit

Maxim Rupp published proof-of-concept exploit code on TWITTER for one of the Echelon vulnerabilities reported this week by ICS-CERT. Maxim has reportedly known about this vulnerability for about a year now; no word on why he has not reported it.

OSIsoft Security Audit Tool

OSIsoft announced that they have a new version of their PI Security Audit Tools (v. 2.2.0.3) available. They note that: “This tool is a PowerShell module that performs validation checks for the machine, PI Data Archive, PI AF Server, SQL Server, and PI Vision, indicating areas where the security configuration is out of compliance with best practices, and providing actionable information to address the issue.”

If Sony Had Been a Chemical Plant

The infosec world is still buzzing about the recent hack of Sony and how completely their information systems were owned by the attacker. Researchers will be pouring over this attack for a while trying to figure out how it all happened and what could have been done to prevent it.

The Hack

The Sony hackers took, among other things, valuable intellectual property (high quality digital copies of yet to be released films), thousands of internal documents (one source said 1 terabytes worth), and system access information to include log-in credentials and passwords. The attack was so thorough that Sony was forced to shut down all computer systems for days while they went through and inspected/cleaned every machine.

The TWITERVERSE is all agog, of course about #SonyHack. I’ve made my own small contribution (sans hashtag, of course). The one tweet of mine that I would like to look at in more detail came on Saturday:

“I guess we should be glad that Sony didn't make dangerous chemicals or supply something really important....”

XYZ Chemical Company

So what would have been different if it had been XYZ Chemical Company that had attracted the ire of the GOP attackers? Other than differences in what IP was stolen, probably not much in the immediate results of the attack. The longer term results could have been much more serious to communities around XYZ plants and possibly to the nation.

Intellectual property theft? Well, formulations come to mind first. The wholesale release of formulations would give every competitor here and around the world a leg up in understanding how XYZ makes their products. Even for fully mature product lines, the little tweaks to the formulation a company makes can make a major difference in pricing and performance. This could make for a serious change in competitive status.

The public publishing of the formulations could have other consequences as well. There are a number of chemicals being used in the chemical industry that have raised concerns among environmental activists. If a formulation list included such chemicals the company could come under additional scrutiny from these activists, potentially leading to image issues. Worse yet, if any of the chemicals being used were on the lists of chemicals offensive to various environmental wacko fringe groups, the facility could become a target for varying degrees of physical attacks.

Control System Insecurity

From a security perspective the IP that is of more concern, however, would be process flow diagrams and control system working documents. Those pieces of information would make it much easier for an attacker that has gained access to the control system to figure out how to manipulate the controls in that system in a manner that could disrupt the facility in the worst possible way.

Since most corporate types use a single set of login credentials across the entire spectrum of company computer systems, it is very likely that even if the control systems were not directly breached in the attack, there would be useable log-in credentials for the control systems to be culled from the corporate log-ins. Once an attacker can gain legitimate access to a control system, the various ‘insecure-by-design’ problems become very large vulnerabilities.

If the control system had been directly breached as well the problems become much worse. The shut down and start-up of a chemical control system, particularly with continuous chemical processes like refineries, is not something that is done lightly or quickly. And searching control systems for logic bombs, back-doors, and forms of re-programing is a much more time consuming task than for an IT system of comparable size. The larger the number of PLCs involved the more difficult the task becomes.

Physical Insecurity

One set of computer data files that no one wants to see released are physical security plan files. Password and log-in credentials can be changed fairly easily, but making significant changes to a site security plan are very expensive and time consuming. The public availability of site security plans would make the facility much more susceptible to physical attack or theft of chemicals.

While there are some people that claim that the Sony attackers had at least some physical access to the corporate computer system that would not necessarily mean that that access included detailed information about the site security plan. Most folks entering a facility are aware of only a small part of the over-all security plan for the facility.

For many chemical manufacturing facilities a major source of security concerns can be found in the computer systems of the order handling folks. The timing and sourcing of inbound and outbound chemical shipments makes them that much more vulnerable to off-site attack. Those attacks may allow for inbound shipments to be intercepted and converted to a method of attack (VBIED) or simply diverted to some other nefarious or illegal end.

The Big Picture

The major take away from this attack is that this was no longer a hack to deface a web site, steal money or credentials. This was a full scale attack on a company with the intent of seriously harming the company for some as of yet unknown reason. The scope and scale of the attack is unlike anything we have seen in the corporate world. Unfortunately, as with all things cyber, it will undoubtedly set the new gold standard for serious attacks as it give other groups and hackers ideas about what can be accomplished with a successful cyber attack.