ICS-CERT Publishes Two More Advisories

Some weeks it seems that everyday there is a new set of advisories from DHS ICS-CERT; this is one of those weeks. Today ICS-CERT published advisories for Siemens WinCC and the Morpho Itemizer. Oh, and they missed listing the Morpho advisory on both the landing page and the Advisories page; they did tweet about it though. When you get busy, mistakes happen unless you have good administrative controls in place.

Siemens Advisory

This advisory is based upon coordinated disclosures from an anonymous researcher and a separate report from Sergey Gordeychik, Alexander Tlyapov, Dmitry Nagibin, and Gleb Gritsai of Positive Technologies. Siemens has prepared an update that is reported to mitigate the multiple vulnerabilities, but there is no indication that the researchers have had a chance to verify the efficacy of the fix.

The vulnerabilities include:

• Forced browsing - CVE-2014-4682 – could allow unauthenticated access to data;

• Session fixation - CVE-2014-4683 – could allow remote privilege escalation;

• Improper privilege management - CVE-2014-4684 – could allow database privilege escalation;

• Permissions, privileges and access control - CVE-2014-4685 – could allow local user to escalate their privileges; and

• Hard-coded cryptographic key - CVE-2014-4686 – cold allow privilege escalation.

ICS-CERT reports that a low-to-moderately skilled attacker could remotely (except CVE-2014-4685) exploit these vulnerabilities. Siemens reports that they have produced an update that mitigates the vulnerabilities in WinCC and expect an update for Simatic PCS7 next month. In addition they suggest the following actions be taken until a hard fix can be established:

• Limit the WebNavigator server access to trusted networks/clients only

• Ensure that the WebNavigator clients authenticate themselves against the WebNavigator server (e.g. use client certificates)

• Restrict access to the WinCC database server at port 1433/tcp to trusted entities

• Deactivate all unnecessary OS users on WinCC server

• Run WinCC server and engineering stations within a trusted network, or

• Ensure that the WinCC server and the engineering stations communicate via encrypted channels only (e.g. establish a VPN tunnel).

Morpho Advisory

This advisory looks at a single hard-coded-credential vulnerability reported by Billy Rios and Terry McCorkle. ICS-CERT reports that: “Morpho has decided not to address this vulnerability at this time.” Since the Itemizer® 3 is not strictly speaking an industrial control system (it’s an analytical system controller) it could look like this is no big thing. It could, however, have an effect on police investigations that would rely on these pieces of equipment to identify drug and explosives trace evidence. A cyber savvy defense attorney could use this uncorrected vulnerability to cause a judge to question the validity of test data from this machine and potentially reverse a drug or explosives conviction or the use of the evidence in court.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit this vulnerability to gain administrative access to the system. Not much you can’t do once you have that access.

ICS-CERT Medical Device Alert and FDA Response

Yesterday the DHS ICS-CERT published an alert for a hard-coded password vulnerability affecting roughly 300 medical devices across approximately 40 vendors reported by Billy Rios and Terry McCorkle of Cylance. No link is provided for the specific report that instigated this alert. This vulnerability is hardly news since there have been news reports about the Rios and McCorkle work in this area since at least January.

This may have more to do with today’s publication in the Federal Register (78 FR 35940) of a notice of availability of FDA draft guidance on “recommendations to consider and document in FDA medical device premarket submissions to provide effective cybersecurity management and to reduce the risk that device functionality is intentionally or unintentionally compromised”.

According to this FDA notice: “The draft guidance, when finalized, will represent the Agency's current thinking on management of cybersecurity in medical devices.”

A copy of the draft guidance is available from the FDA web site. After a quick scan of the document I find it disturbing that it concentrates on the information security aspects of the problem rather than on the control system issues. While I certainly wouldn’t want anyone to have access to medical information about or from a device implanted in my body, I would be much more concerned about the ability of some unauthorized person (or even an authorized person in some cases) to change device settings without my consent or informed approval.

The FDA is soliciting public comment on this draft-guidance. Comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket # FDA-2013-D-0616). It appears that the FDA will be working expeditiously (SARCASM Alert) on this issue; they are requesting comments be filed by September 12, 2013.

ICS-CERT Publishes Tridium Advisory

Earlier today the DHS ICS-CERT published an advisory for a directory transversal vulnerability in the Tridium NiagaraAX software. Billy Rios and Terry McCorkle reported the vulnerability in a coordinated disclosure.

This Advisory

ICS-CERT reports that a moderately skilled attacker could remotely exploit this vulnerability and execute arbitrary code on the system. Tridium has produced version specific patches to mitigate the vulnerability, but there is nothing in the advisory to indicate that anyone has independently verified the efficacy of the patch.

The Earlier Advisory

Experiencing a sense of déjà vu I went back and did a search of my blog. Sure enough there was an earlier advisory for the Tridium NiagaraAX software based upon an earlier disclosure by Rios and McCorkle that included (among other vulnerabilities) a directory traversal vulnerability. Alert readers might recall that the coordinated disclosure in that case was outed by the Washington Post resulting in ICS-CERT issuing an alert for a coordinated disclosure

Now there is not a great deal of detail in these ICS-CERT advisories or alerts about the reported vulnerabilities. In the case of these two directory traversal vulnerabilities both involve access to the system via the Web server running on Port 80/TCP. Rios and McCorkle did verify that the earlier patch and recommended changes to the configuration setting corrected the vulnerability.

This means that either Rios and McCorkle found a completely separate vulnerability or they made a mistake in validating the earlier patch. I think I’ll vote with the former. It’s a shame that the Tridium engineers didn’t discover this second vulnerability when they were checking out the earlier directory traversal vulnerability. They could have corrected both at the same time and won kudos for catching the unreported vulnerability.

ICS-CERT Updates Two Notices and Issues New Advisory

This has been a busy week for the folks at the DHS Industrial Control System Cyber Emergency Response Team (ICS-CERT); they updated a recently issued alert and an advisory and issued a new advisory. The Unitronic Advisory was updated as was the Alert for ULE-OCP; actually that alert was re-issued after ICS-CERT got names straightened out. A new advisory was issued for Honeywell’s TEMA system.

Open Automation Software

The OPC Systems Alert that was published on Monday as part of the ICS-CERT response to the latest Luigi disclosures has been superseded by a new alert that corrected some apparent system naming errors that had been included in the Luigi documentation. Amazingly the link to the superseded document still works. Unfortunately, ICS-CERT cannot blame this error on Luigi because they refuse, as a matter of policy, to disclose the names of security researchers who release vulnerability information through an uncoordinated disclosure process.

BTW: I had an error in my blog posting on Monday’s three Alerts. Fortunately, Dan, a sharp eyed reader, caught the error and notified me of the problem. When I went to correct the problem this new version of the alert was already published and I put the link to the corrected document in that post. If anyone is interested that original Alert can be found here, at least for the time being. [NOTE: As of 1-12-12 this old alert is no longer available via this link. I'm not sure when it went dead]

Unitronics UniOPC

If this revision was not written by a lawyer is had to have at least been directed by a lawyer, probably the vendor’s lawyer. This is a three part change that you have to be very alert to track. The first change adds a footnote to a link to the web site of the third party vendor that provided the offending component. The second changes “other applications that support OLE for Personal Computers (OPC)” to read “other OPC applications”. The final revision changes “resides in the https.ocx component of ‘IP*Works! SSL’” to read “resides in the https50.ocx component of “IP*Works! SSL” and removes the footnote link to the third party vendor web site. This is a highly consequential change [Sarcasm Warning].

Honeywell Temaline Access Control

This new Advisory for the Honeywell Enterprise Buildings Integrator (EBI) system is based upon a coordinated disclosure by Billy Rios and Terry McCorkle. If you haven’t heard about this dynamic duo you certainly will; they discovered 665 vulnerabilities in 75 HMI applications in 100 days (see the Digital Bond posting for more details; make sure to read the Reader Comments) and coordinated them all through ICS-CERT. In any case this doesn’t look like it belongs in the list of 665 vulnerabilities and it isn’t really about an industrial control system as chemical engineers think about such systems, but it is potentially important to chemical facility security none-the-less.

It does involve a component of Honeywell’s Enterprise EBI called Temaline. According to the Honeywell web site:

“Honeywell Temaline offers handling and monitoring of electronic access control, visitor/contractor management, time and attendance and mustering. Integration with security management, enterprise resource planning (ERP) and closed-circuit television (CCTV) systems provides one-window access to and control over the cardholder database to determine who is allowed access to what places and at what times.”

The vulnerability occurs in the Tema Remote Installer that includes an ActiveX function that is “configured to ignore file authentication”. A moderately skilled attacker could remotely exploit this vulnerability to craft, download and install an MSI file that could allow execution of arbitrary code. It would seem to me that that code could include allowing an attacker physical access through the security system by any number of means.

Honeywell developed a patch for this vulnerability; unfortunately that patch also kills legitimate uses of the offending MSI file. Work-around instructions for that issue are included in the patch directions.