Public ICS Disclosures – Week of 02-10-18

This week we have seen an apparently new zero-day reported in an Advantech product, an exploit for a previously released Siemens vulnerability, two new vendor reports from OSIsoft that have not been addressed by ICS-CERT and two vendor reports that were reported late this week that may show up in ICS-CERT advisories.

Advantech Zero-Day

Nassim Asrir reported a remote code execution vulnerability in the Advantech WebAccess product. The report on ExploitDB.com includes exploit code. Asrir reports that an attacker could remotely exploit the vulnerability to execute arbitrary OS commands via a single argument.

Siemens Exploit

M. Can Kurnaz published exploit code on ExploitDB.com this week for a previously published vulnerability in the Siemens SIPROTEC 4 and SIPROTEC Compact product families. ICS-CERT had previously reported that a relatively unskilled attacker could remotely exploit this vulnerability, but this just made it that much easier. A firmware patch was made available almost three years ago to mitigate this vulnerability, so hopefully this exploit will be of no practical use.

OSIsoft Advisories

This week OSIsoft released two new product updates that were specifically listed as ‘security updates’. The two products involved were PI Data Archive 2017 R2 and PI Vision 2017 R2.

There were five ‘issues’ reported in the PI Data Archive alert:

• Privilege escalation;

• Improper handling of serialization or comparison of a variable;

• Improper input validation;

• Authentication protocol flaws; and

• High Availability authentication protocol flaws

The PI Vison alert notes that changes were made in the default configuration of HTTP headers to prevent a cross-site scripting issue and two information disclosure issues.

Possibly Pending on ICS-CERT

We have two vendor reports that were issued on Thursday that may still make it to the ICS-CERT site next week so I will just mention them in passing.

ABB does not generally report their advisories to ICS-CERT, but they updated their Meltdown & Spectre advisory that has been mentioned in ICS-CERT alert on the same topic.

Schneider released a new security advisory listing new products that were affected by one of the previously reported vulnerabilities in their FlexNet Publisher Licensing Service.

ISCD Publishes Two More Industry Outreach Fact Sheets

Today the DHS Infrastructure Security Compliance Division (ISCD) published links to two new fact sheets on their Chemical Facility Anti-Terrorism Standards (CFATS) Knowledge Center. The first is another in the recent series explaining the impact of the CFATS program on various industries; this one addresses laboratories. This is part of the ongoing ISCD outreach effort designed to connect with facilities that have not realized that they may be covered under the CFATS program. The second fact sheet outlines the first steps that a facility needs to take when it determines that it may be affected by the CFATS program.

Laboratory Outreach

This fact sheet is very similar in format and information to the ones that I have previously discussed. The major difference is that the list of potentially affected chemicals is significantly different. One major difference in the list is that it includes a wide variety of chemical warfare agents. Unfortunately, ISCD failed to address the most contentious issue associated with those chemicals; the incredibly small amount (100-g) that qualifies as a screening threshold quantity (STQ) that would require reporting under CFATS.

First Steps

This fact sheet outlines the initial steps that a chemical facility needs to take when it suspects that it may be covered by the CFATS regulations (6 CFR 27), culminating in the submission of a Top Screen. The steps outlined include:

• Check your chemicals of interest (COI);

• Complete Chemical-terrorism Vulnerability Information (CVI) training;

• Register your facility; and

• Submit a Top Screen

As you would expect from a ‘fact sheet’ the explanations provided for each of the steps are very brief and lacking in detail. Fortunately, links are provided to the appropriate parts of the CFATS web site for a more detailed explanation.

Commentary

There is one unusual comment in the first steps fact sheet that I do not recall having seen in any other ISCD publication to date. In the discussion of what constitutes a chemical facility under the CFATS regulations, the fact sheet notes that:

“Under CFATS, a chemical facility is any establishment, from a large facility to an individual person [emphasis added] which possesses or plans to possess at any point in time, certain COI at or above a specified quantity or concentration.”

The definition of ‘chemical facility’ under the CFATS regulations states that {§27.105}:

“Chemical Facility or facility shall mean any establishment [emphasis added] that possesses or plans to possess, at any relevant point in time, a quantity of a chemical substance determined by the Secretary to be potentially dangerous or that meets other risk-related criteria identified by the Department.”

That ‘any establishment’ term is undefined, and I suppose that it could be stretched to include an ‘individual person’. At the very least I would expect to hear some arguments from lawyers if ISCD attempted to push regulatory activity down to a personally owned laboratory not associated with a business.

Having said that, it is not beyond the bounds of possibility that there could exist personal labs (particularly in the biological, pharmaceutical or agricultural sectors) where COI could be found at or above the STQ. The fact that that such laboratories would generally be expected to have less security than a similar corporate lab or even an academic lab would be of potential concern to ISCD as a possible terrorist target.

I am not sure how ISCD would locate such labs in order to conduct outreach activities. I suspect that the most common way of identifying such labs would be as the result of investigations of chemical releases or other chemical incidents by local authorities. If it was a purely local investigation (not the CSB, EPA, or OSHA for instance), I doubt that the word would get back to ISCD.

Bills Introduced – 02-15-18

With the Senate heading home for a week in district (and the House preparing to do the same) there were 65 bills introduced yesterday. Of those, four may be of specific interest to readers of this blog:

HR 5040 To authorize the President to control the export, reexport, and transfer of commodities, software, and technology to protect the national security, and to promote the foreign policy, of the United States, and for other purposes. Rep. Royce, Edward R. [R-CA-39]

S 2444 A bill to provide for enhanced energy grid security. Sen. Cantwell, Maria [D-WA]

S 2445 A bill to provide for the modernization of the electric grid, and for other purposes. Sen. Cantwell, Maria [D-WA] 

S 2447 A bill to accelerate smart building development, and for other purposes. Sen. Cantwell, Maria [D-WA]

With all of these bills I will be looking for control system cybersecurity issues in determining whether or not to continue coverage of the bill in this blog. I suspect hat S 2444 has the highest chance of future coverage.

As always, the large number of bills introduced before an extended stay outside of Washington is seldom due to an increased interest in legislative activity. Most of the bills introduced yesterday will receive no consideration on the Hill. Most are introduced to allow the submitter to claim to be taking action of interest in speaking before organizations and financial supporters back home.

ICS-CERT Publishes 4 Advisories and One ABB Update

Today the DHS ICS-CERT published four new control system security advisories for products from Schneider Electric (2), GE and Nortek. Additionally, they provided an update for a previously published advisory for products from ABB.

StructureOn Advisory

This advisory describes an unrestricted upload of file with dangerous type vulnerability in the Schneider StruxureOn Gateway software management program. The vulnerability is being self-reported.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability to upload a malicious file to any directory on the device, which could lead to remote code execution. The Schneider security advisory reports that the file must be a .zip file with specifically modified metadata for this vulnerability to be exploited.

IGSS Mobile Advisory

This advisory describes two vulnerabilities in the Schneider IGSS Mobile application (iOS and Android). The vulnerabilities were reported by Alexander Bolshev (IOActive) and Ivan Yushkevich (Embedi). Schneider has produced updates for both versions. There is no indication that either researcher has been provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Improper certificate validation - CVE-2017-9968; and

• Plaintext storage of password - CVE-2017-9969

ICS-CERT reports that a relatively low-skilled attacker with local access (okay they, actually said: “Locally exploitable”; that may not mean ‘local access’) could exploit the vulnerability to execute a man-in-the-middle attack. In addition, passwords can be accessed by unauthorized users.

NOTE: Marc Ayala pointed out to me that anyone can download these apps from the appropriate (iOs/Android) app store. This means that it would be easy to exploit a compromised mobile password. All the attacker needs to do is to get access to the IGSS configuration file on an oh so secure smart phone to compromise the password.

GE Advisory

This advisory describes two vulnerabilities in the GE D60 Line Distance Relay. The vulnerabilities were reported by Kirill Nesterov of Kaspersky Labs. GE has released new firmware that mitigates the vulnerability. There is no indication that Nesterov was provided an opportunity to verify the efficacy of the fix.

The two reported vulnerabilities are:

• Stack-based buffer overflow - CVE-2018-5475; and

• Improper restriction of operations within bounds of memory buffer - CVE-2018-5473

ICS-CERT reports that relatively low-skilled attacker could remotely exploit the vulnerability to execute arbitrary code on the device.

Nortek Advisory

This advisory describes a command injection vulnerability in the Nortek Linear eMerge E3 Series access control interface. The vulnerability was reported by Evgeny Ermakov and Sergey Gordeychik. Nortek recommends upgrading the system using established procedures. There is no indication that either researcher was provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker could remotely exploit the vulnerability  to execute malicious code on the system with elevated privileges, allowing for full control of the server.

ABB Update

This update provides additional information on an advisory that was originally published on November 14^th, 2017. The update reports that the new update of Mesh OS mitigates the KRACK vulnerability in these devices.

NOTE: The updated ABB security advisory that forms the basis for this ICS-CERT update was published on January 11^th, 2018.

House NHTSA Oversight Hearing

Today the Digital Commerce and Consumer Protection Subcommittee of the House Energy and Commerce Committee held an oversight hearing looking at the DOT’s National Highway Transportation Safety Administration (NHTSA). The sole witness at the hearing was Heidi King, the Deputy Administrator (the de facto Administrator since no one has yet been nominated to that position) for NHTSA.

There was no mention of cybersecurity in any of the statements published on the Committee’s web site (Committee Chair Latta, Subcommittee Chair Walden, and Ms King), but the Committee Staff background memo does include (pg 6) a brief, 3-paragraph, summary of cybersecurity issues related to automated driving systems.

Watching the video of the hearing it is clear that this was intended to be a wide ranging oversight hearing that touched on a number of issues. Unfortunately, few of the congress critters asking questions had much interest in cybersecurity issues. There were only three cybersecurity related question (at 1 hour 10 minutes, at 1 hour 20 minutes and at 2 hours 30 minutes into the video). King’s responses to the questions were very generic with the one strong point being made that she appreciated the formation of the Automotive ISAC.

King did make a very interesting point in her response to the last question, from Rep. Costello (R,PA). She noted that vehicle owners had a very important role to play in regard to vehicle cybersecurity. After once again praising the formation of the Auto ISAC, she said:

“Cybersecurity is not the domain of highly technical experts alone, but in fact cybersecurity is a concern to all of us. We see from our own experience, whether it be in our home computers or in our phones, there may be vulnerabilities that are driven by users, and so part of the cybersecurity journey will be to educate all of us to be thoughtful about how we use our devices or our cars, and make sure that we are all partners in our cybersecurity journey.”

It will be interesting to see if the auto industry actually attempts to try to make autonomous vehicle cybersecurity inherently secure, or whether they will follow the model of the computer and smart phone manufacturers and make security a feature that must be selected by the owner, often without specifically notifying the owner of the security options available.

ICS-CERT Publishes Two Advisories

Today the DHS ICS-CERT published two control system security advisories for products from Schneider Electric and WAGO.

Schneider Advisory

This advisory describes a security misconfiguration vulnerability in the Schneider IGSS SCADA software. The vulnerability was reported by Ivan Sanchez of Nullcode. Schneider has developed a new version that mitigates the vulnerability. There is no indication that Sanchez has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively high-skilled attacker with local access could exploit the vulnerability to crash or execute arbitrary code.

WAGO Advisory

This advisory describes an improper authentication vulnerability in the WAGO PFC200 Series. The firmware vulnerability is due to a vulnerability in the CoDeSys Runtime that is included in that firmware. The CoDeSys Runtime vulnerability was reported by Reid Wightman in 2012 and was addressed by ICS-CERT in 2013. The vulnerability was reported in this WAGO product by SEC Consult. NOTE: ICS-CERT published an alert about this vulnerability last December.

ICS-CERT reports that a relatively low-skilled attacker could use a publicly available exploit to remotely exploit the vulnerability to gain unauthorized access to the PLC to perform operations on the file system without authentication.

Committee Hearings – Week of 02-11-18

This week both the House and Senate will be in session. The big news is, of course, the President’s FY 2019 budget request is arriving on the Hill. This leads to the official start of the spending bill process, so the various committee budget hearings will start to provide a look at how those spending bills are going to shape up. There are also three oversight hearings this week in the House that may be of specific interest to readers of this blog: NHTSA, Positive Train Control and the CFATS program.

FY 2019 Budget Hearings

The actual budget being submitted by the President is essentially a meaningless exercise as Congress has their own internal considerations that drive the budgeting and spending process. The hearings starting this week, however, will provide a window into what the various oversight committees will be looking to see in the final spending bills.

Senate Budget Committee – 02-13-18;

House Budget Committee – 02-14-18; and

House Transportation Committee – 02-14-18

NHTSA Oversight

The Digital Commerce and Consumer Protection Subcommittee of the House Energy and Commerce Committee will hold an oversight hearing on Wednesday of the National Highway Traffic Safety Administration (NHTSA). The Deputy Administrator will be the only witness. This hearing is likely to focus on cybersecurity as it pertains to data protection in advanced driving systems, but we may hear questions on operational controls as well.

PTC Oversight

On Thursday the Railroads, Pipelines, and Hazardous Materials Subcommittee of the House Transportation Committee will be holding an oversight hearing of the progress of the implementation of the congressionally mandated positive train control network. With the spate of recent rail accidents that involved sections of track not currently under PTC the questions will be sharp and unfriendly. The witness list includes:

• Juan D. Reyes III, Federal Railroad Administration;

• Robert Sumwalt, National Transportation Safety Board;

• Edward Hamberger, Association of American Railroads;

• Richard Anderson, Amtrak

• Paul Skoutelas, American Public Transportation Association

• John P. Tolman, Brotherhood of Locomotive Engineers and Trainmen

The Staff summary of the PTC program points out (pg 6) that the freight railroad systems is significantly further along the implementation process than is the passenger rail system. The current flexible deadline for PTC implementation is December 31^st, 2018.

CFATS Oversight

On Thursday the Cybersecurity and Infrastructure Protection Subcommittee of the House Homeland Security Committee will be holding an oversight hearing on the Chemical Facility Anti-Terrorism Standards (CFATS) program, focusing on industry feedback. There is no witness list currently available, but I expect that we will see industry representatives from the major chemical manufacturing organizations.

The CFATS program is currently set to expire on December 18^th, 2018. This hearing is the first step in the reauthorization process. I do not expect to see any major complaints from industry about the program, but it will be interesting to see what questions about the new threat assessment model being used by DHS to determine which facilities are included in the program. I also expect to see some serious questions about the personnel surety vetting program.

There has not yet been a reauthorization bill introduced. This may not be necessary if Congress does not see any need for specific revisions to the program. We could see Congress return to the annual extensions of the program in spending bills that we saw before the current program authorization bill was passed in 2014. It will be interesting to see if any of the witnesses address this reauthorization process question in their prepared testimony.