ICS-CERT Publishes Three Advisories – Two from HeartBleed

Today the DHS ICS-CERT published three advisories for vulnerabilities in industrial control systems applications from Siemens, Progea Movicon, and Innominate. Two of those (the first and last) are related to HeartBleed.

Siemens Advisory

This advisory provides a list of Siemens products that contain or are affected by the HeartBleed vulnerability. They currently only provide one updated to mitigate the vulnerability but do note that they are working on the other product updates. The unusual move to self-identify vulnerable systems before mitigation measures are available was almost certainly undertaken because tools to test for the HeartBleed vulnerability and exploit code for the bug both exist in the wild.

Siemens reports that the following products are affected:

● eLAN-8.2 eLAN < 8.3.3 (affected when RIP is used - update available)

● WinCC OA only V3.12 (always affected)

● S7-1500 V1.5 (affected when HTTPS active)

● CP1543-1 V1.1 (affected when FTPS active)

● APE 2.0 (affected when SSL/TLS component is used in customer implementation)

Siemens has an update available for eLAN (v 8.3.3) and recommends the following interim mitigation measures for the other products until the appropriate update is published:

● WinCC OA V3.12:

o Use VPN for protecting SSL traffic

o Use WinCC OA in a trusted network

●  S7-1500 V1.5:

o Disable the web server, or

o Limit web server access to trusted networks only

o Remove the certificate from the browser

● CP1543-1 V1.1:

o Disable FTPS, or

o Use FTPS in trusted network, or

o Use the VPN functionality to tunnel FTPS

● APE 2.0:

o Update OpenSSL to 1.0.1g before distributing a solution. Follow instructions from Ruggedcom [3] to patch APE 2.0

The VPN recommendations should have come with a caveat that the VPN should have its HeartBleed status investigated before it is used to protect a control system remote access.

Progea Advisory

This advisory is for an information disclosure vulnerability reported by Celil Ünüver of SignalSEC Ltd in a coordinated disclosure. Progea has developed an update that ICS-CERT reports has been checked and validated by Celil.

ICS-CERT reports that a moderately skilled attacker could remotely execute an attack using this vulnerability to gain access of OS version information.

Innominate Advisory

This advisory notes that Bob Radvanovsky of Infracritical notified ICS-CERT that Innominate has updated their mGuard product firmware to deal with the HeartBleed vulnerability included in versions of those devices. The advisory points at the Innominate advisory published last Friday. Bob also reported this last Friday on the SCADASec List.

HeartBleed Reporting

It will be interesting to see how many of these HeartBleed advisories get published by ICS-CERT. Most of these will end up being self-reported (even the Innominate advisory was essentially self-reported). I also doubt that there will be much more information in any of the upcoming advisories than we have seen in these two today.

It may be easier for ICS-CERT to just set up a HeartBleed page and updated it when necessary by listing the vendors that have published firmware or software updates that mitigate the vulnerability. I think it would be easier and more informative.

CSB to Approve Final Report on Tesoro Refinery Explosion

The Chemical Safety Board published a meeting notice in today’s Federal Register (79 FR 21208) announcing a meeting in Anacortes, WA to review the draft final staff report on the Tesoro Refinery Explosion of April 2^nd, 2010. The public meeting will be held on May 1^st, 2014.

An earlier meeting was also supposed to consider the review of the final staff report, but that was changed to just an informational exchange hearing because of apparent internal Board conflicts on the issue safety case programs.

This notice does not include the normal statement about the Board receiving public comments after the staff report is presented. This may be an oversight or they may just intend for the comments heard at the earlier meeting to be full extent of the public record that will be considered by the Board prior to voting on the acceptance of the staff report.

OSHA Submits PEL RFI to OMB

Yesterday the OMB’s Office of Information and Regulatory Affairs reported that the DOL’s Occupational Safety and Health Administration (OSHA) submitted a request for information (RFI) concerning a possible rulemaking to update the OSHA permissible exposure limit (PEL) regulations. This RFI has been on the Unified Agenda since the Fall of 2011.

The last time that OSHA attempted to update the PEL listings was in 1989 and that rulemaking was overturned by the Courts. Apparently OSHA has been trying to figure out since then how to overcome the 11th Circuit Court of Appeals’ objections to ‘deficiencies in OSHA's analyses’.

Given the controversial nature of this issue, I expect a lengthy OMB review of the RFI.

RHETORICAL QUESTION: Does ‘RFI’ really mean ‘We don’t know what to do so Punt?’

FRA Submits Risk Reduction NPRM to OMB

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received from the Federal Railroad Administration a notice of proposed rulemaking (NPRM) to implement the congressionally mandated (and a year and a half overdue) Railroad Risk Reduction Program (49 USC §20156).

The advance notice of proposed rulemaking was published in December of 2010 (75 FR 76345). Only twelve comments were received about that ANPRM (one from yours truly based upon this blog post). Interestingly no comments were received from any freight railroad or chemical shipper.

The Railroad Risk Reduction Program would be required to be implemented by all Class I railroads and any other freight railroad that has been identified by the Secretary of Transportation as having “inadequate safety performance". Two main components of the RRR Program would be a technology implementation plan and a fatigue management plan. Both would be spelled out in the railroad’s risk mitigation plan.

There is no telling how long this NPRM will remain under review at OMB; that is as much a political question as it is a regulatory question. Given the ‘high priority’ that rail safety appears to be in Congress and in the Administration due to the number of crude oil train derailments in the last year, I would hope that the OMB will act quickly on this NPRM. I won’t hold my breath though.

Rail Emergency Response Equipment

I read some interesting testimony this weekend from Tod Perlin, Fire Chief from the Town of Rangely, ME. He was one of the US first responders that aided the local Canadian fire department during the immediate aftermath of the Lac-Megantic crude-train derailment last year. His description of what happened is very moving and well worth reading.

There is one very important point that he made in his testimony at the THUD Subcommittee of the Senate Appropriations Committee hearing on rail safety. He mentioned that, in addition to pumping water out of a local lake (the ‘lac’ of Lac-Megantic) because the local fire hydrant system was compromised in the explosions following the derailment, fire fighters used ”8000 gallons of foam [that]was trucked in from the refinery in Toronto to help extinguish the burning rail cars”.

This is one of the major emergency response problems for crude oil and ethanol transportation emergencies; special fire-fighting foam is needed to put out these fires; water just spreads the flames. Fire-fighting agencies that have fuel terminals or refineries in their response areas will typically have access to these specialized foams (and the associated equipment to apply the foam), but most fire-fighters will not have access to this important tool. It is just too expensive and hard to justify on short budgets.

One way to ensure that first responders to rail accidents involving unit trains of crude oil or ethanol have immediate access to the essential (and correct type of) fire-fighting foam would be to require railroads to haul a specialized car at the rear-end of such unit trains that carries the appropriate foam and the necessary application equipment. This way fire departments along rail rights-of-way would not need to stock the required equipment; they would only have to pay for the training in its use.

If the equipment was properly designed and the operation clearly documented, the training costs could probably be almost eliminated. If a crew of fire-fighters had to read a 5 minute tutorial on the use of the equipment, it would still be much more readily available than a foam unit being trucked in from the nearest refinery or fuel depot.

To the best of my knowledge, these cars do not yet exist. But this is clearly a need that calls out for fulfillment. And if the railroads and shippers cannot figure that out, maybe they need some encouragement from the FRA and PHMSA.

ICS-CERT Publishes Unusual Saturday Alert Update

Earlier today the DHS ICS-CERT published an update to their HeartBleed (okay OpenSSL Vulnerability) Alert that was issued and updated earlier this week. They have also provided a link to an FBI “Private Industry Notification” that provides Snort signatures for detecting exploits of the HeartBleed vulnerability.

The updated alert (Version ‘B’) points at the FBI Snort document. It also provides a link to the free ‘Snort Community Rules’ that were updated today (presumably with HeartBleed signatures).

The alert also reports that there are ‘additional indicators of compromise’ available on the Control Systems compartment of the US-CERT secure portal. You might want to check those out.

While I don’t have access to the Secure Portal, I certainly would recommend anyone running an industrial control system consider requesting access. There are too many times that the really good information (I hope it is really good) is kept under limited distribution for legitimate reasons.

“ICS-CERT encourages U.S. asset owners and operators to join the Control Systems compartment of the US-CERT secure portal. Send your name, e-mail address, and company affiliation to ics-cert@hq.dhs.gov.”

NTSB Announces Inquiry into Crude Oil and Ethanol Shipping

The National Transportation Safety Board published a meeting notice in Monday’s Federal Register (79 FR 20922-20933; available on line today) concerning a public forum to be conducted about the rail transportation of crude oil and ethanol. The public meeting will be held on April 22^nd thru 23^rd in Washington, DC.

The NTSB members will be acting as a board of inquiry and there will be a number of invited panels of technical experts from the Federal Road Administration (FRA), the Pipeline and Hazardous Material Safety Administration (PHMSA), railroad owner/operators, emergency responders and industry groups. A listing of the panels and their members can be found on the Forum agenda web page and the panel member biographies can be found here.

Areas to be addressed during the two-day meeting include:

• A review of crude oil and ethanol railroad accidents

• Tank Car Design, Construction, and Crashworthiness

• Rail Operations and Approaches to Risk Management

• Emergency Response to Tank Car Releases of Crude Oil and

Ethanol

• Federal Oversight and Industry Initiatives Related to Crude Oil and Ethanol Transportation by Rail

The NTSB is soliciting public input on the topics being considered. Written comments may be emailed to the NTSB at railsafetyforum@ntsb.gov. There are no provisions for the public to provide oral presentations at the forum. The forum will be web cast and the web cast will be available for three months after the meeting.