Bills Introduced – 04-18-18

With both the House and Senate in session yesterday there were 58 bills introduced. Of those, one may be of specific interest to readers of this blog:

HR 5576 To address state-sponsored cyber activities against the United States, and for other purposes. Rep. Yoho, Ted S. [R-FL-3]

Two separate things that may draw my further attention to this bill. First, and most obvious to long time readers, I will watch the definitions used in the bill to see if this bill will specifically address ‘activities’ targeted at control systems. Even if control systems are not covered, how the bill intends to ‘address’ the ‘cyber activities’ may still cause me to expand (slightly) my coverage of cybersecurity issues.

ICS-CERT Updates HatMan Attack Report

Yesterday the DHS ICS-CERT updated their Malware Analysis Report on the HatMan ( or TRITON or TRISIS depending on which analysis you are looking at) attack on a Schneider  Triconex Tricon safety shutdown system installation in Saudi Arabia. While this is labeled as an ‘update’ it is closer to a complete re-write of the original document. The new information comes from a joint investigation by ICS-CERT and Schneider.

This is a technical report about the processes involved in the HatMan malware. It does include a mention of how the newly reported Schneider Triconex vulnerabilities were used by the malware. I will leave to more technically qualified personnel the task of reviewing the technical information provided in the report.

Having said that, there is one important point made about the operation of the malware on page 16. Under section 5.3.5 the report states:

“This code is run when the compromised TS protocol command is received and provides RAT-like functionality. Most importantly, it allows an actor to read and write memory—including within the in-memory firmware region—and execute arbitrary code regardless of the key switch position, including “RUN.” This allows an actor to effect changes on the controller while it is in full operation, not just while it is being reprogrammed.”

This may be the critical portion of the malware because it bypasses one of the primary protections designed into safety instrumented systems, essentially the manual safety switch. This type of protection is used in a number of control system elements (particularly PLCs) and is supposed to provide a level of control over the reprogramability of the devices. Being able to subvert this control re-emphasizes the ‘insecure by design’ nature of PLCs in particular. It is not clear from this report whether the techniques used in the HatMan malware against the Triconex devices would be adaptable to overcoming this safety switch feature in other systems.

Section 7 of the report, “Detection/Mitigation”, is well worth reading as a stand alone document. The statement about Yara rules, a standard detection tool advocated by ICS-CERT in many instances, should be read and memorized by researchers as a caution about relying on any specific tool:

“This is not a reliable method for detection, as the files may or may not be present on any workstation, and such a rule cannot be used on a Tricon controller itself; however, it could be useful for detection with agent-based detection systems or for scanning for artifacts.

And the final paragraph is probably the best summation of the current state of control system security that I have seen:

“Ultimately, the best mitigation strategy for this malware—and others of the same sort—is to employ defense in depth and follow any relevant best practices. Rather than solely attempting to protect vulnerable targets—such as the Triconex devices targeted by HatMan—one prevents an attacker from ever reaching them.”

S 1281 Passes in Senate – Hack DHS Act

Yesterday the Senate amended and then passed S 1281, the Hack the Department of Homeland Security (Hack DHS) Act of 2017, by a voice vote. The Senate took up the substitute language adopted by the Senate Homeland Security and Governmental Affairs Committee with a small change being made by a floor amendment.

The amendment changed the language in §2(c) of the bill. It changed the reporting requirements for the report to Congress on the pilot program outlined in the bill, changing the reporting time frame from 90-days to 180-days. The amendment was adopted by unanimous consent. The amendment was offered by Sen. McConnell (R,KY) for Sen. Hassan (D,NH), the author of the bill.

The bill, as amended, would require DHS to establish “a bug bounty pilot program to minimize vulnerabilities of Internet-facing information technology of the Department” {§2(b)(1)}. The bill uses an IT-limited definition of ‘information system’, so building control, access control, and security monitoring functions would not technically be covered by the pilot program.

The bill was brought to the floor under the Senate’s ‘unanimous consent’ process. A single senator could have prevented the bill from being considered. This means that the bill had a significant measure of bipartisan support and no opposition. If the bill is taken up in the House (and I suspect that it will), it is almost certain to be considered under the House ‘suspension of the rules’ process with limited debate and no amendments from the floor.

ICS-CERT Publishes 2 Medical Advisories and 5 ICS Advisories

Yesterday the DHS ICS-CERT published two medical device control system advisories for products from Biosense Webster, Inc (BWI) and Abbott Laboratories. They also published five industrial control system advisories for products from Schneider Electric (2) and Rockwell Automation (3).

Stratix Industrial Managed Ethernet Switch Advisory

This advisory describes eight vulnerabilities in the Allen-Bradley Stratix Industrial Managed Ethernet Switch. The 3^rd party vulnerabilities were originally reported by Cisco in their IOS, IOS XE, and IOS XR Software. Rockwell specifically reports that only these 8 (of 22 Cisco reported) vulnerabilities apply to this product. Cisco has released new SNORT rules for some of the vulnerabilities and both Rockwell and Cisco have offered workarounds.

The eight reported vulnerabilities are:

• Improper input validation (4) - CVE-2018-0171, CVE-2018-0174, CVE-2018-0172, CVE-2018-0173;

• Resource management errors - CVE-2018-0156;

• PK-errors - CVE-2018-0155;

• Improper restriction of operations within bounds of a memory buffer - CVE-2018-0167; and

• Use of an externally controlled format string - CVE-2018-0175

ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to effect a loss of availability, confidentiality, and/or integrity caused by memory exhaustion, module restart, information corruption, and/or information exposure.

Stratix and ArmorStratix Switch Advisory

This advisory describes eight vulnerabilities in the Allen-Bradley Stratix and ArmorStratix Switches. The 3^rd party vulnerabilities were originally reported by Cisco in their IOS, IOS XE, and IOS XR Software. Rockwell specifically reports that only these 8 (of 22 Cisco reported) vulnerabilities apply to this product (Note: not the same as 8 as above). Rockwell has provided updates for the affected products. Cisco has released new SNORT rules for some of the vulnerabilities and both Rockwell and Cisco have offered workarounds.

The eight reported vulnerabilities are:

• Improper input validation (6) - CVE-2018-0171, CVE-2018-0156, CVE-2018-0174, CVE-2018-0172, CVE-2018-0173, CVE-2018-0158, CVE-2018-0167;

• Improper restriction of operations within bounds of a memory buffer - CVE-2018-0167; and

• Use of an externally controlled format string - CVE-2018-0175

ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to effect a loss of availability, confidentiality, and/or integrity caused by memory exhaustion, module restart, information corruption, and/or information exposure.

Stratix Services Router Advisory

This advisory describes four vulnerabilities in the Allen-Bradley Stratix Services Router. The 3^rd party vulnerabilities were originally reported by Cisco in their IOS, IOS XE, and IOS XR Software. Rockwell specifically reports

 that only these 4 (of 22 Cisco reported) vulnerabilities apply to this product. Rockwell has provided updates for the affected products. Cisco has released new SNORT rules for some of the vulnerabilities and both Rockwell and Cisco have offered workarounds.

The four reported vulnerabilities are:

• Improper input validation - CVE-2018-0158;

• Improper restriction of operations within bounds of a memory buffer (2) - CVE-2018-0151, and CVE-2018-0167; and

• Use of an externally controlled format string - CVE-2018-0175

ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to effect a loss of availability, confidentiality, and/or integrity caused by memory exhaustion, module restart, information corruption, and/or information exposure.

Triconex Advisory

This advisory describes two vulnerabilities in the Schneider Triconex Tricon safety system. The vulnerabilities were discovered by ICS-CERT and Schneider during the investigation of the HatMan attack. Schneider has new firmware that mitigates the vulnerabilities.

The two reported vulnerabilities are:

• Improper restriction of operations within bounds of a memory buffer (2) - CVE-2018-8872 and CVE-2018-752.

ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to allow the attacker to misinform or control the Safety Instrumented System which could result in arbitrary code execution, system shutdown, or the compromise of safety systems. These vulnerabilities were exploited during the HatMan attack.

NOTE: Interestingly, Schneider has not yet published their security notification on these vulnerabilities.

InduSoft Web Studio Advisory

This advisory describes a buffer overflow vulnerability in the Schneider InduSoft Web Studio and InTouch Machine Edition products. The vulnerability was reported by Tenable. Schneider has new versions that mitigate vulnerabilities. There is no indication that Tenable has been provided an opportunity to verify the efficacy of the fix.

ICS-CERT reports that a relatively low-skilled attacker can remotely exploit the vulnerability to allow remote code execution that, under high privileges, could completely compromise the device.

Biosense Advisory

This advisory describes a large number of vulnerabilities in the BWI CARTO 3 System, a 3D cardiovascular mapping platform. The vulnerabilities were self-reported. BWI has a new version available that mitigates the vulnerabilities. These vulnerabilities have not been reported on the FDA device safety page.

ICS-CERT reports that an uncharacterized attacker with persistent physical access could exploit these vulnerabilities to access information stored in the device, including individually identified health information about patients, affect the integrity of CARTO 3, or deny availability of the device. If the CARTO 3 V4 System is networked, an attacker with persistent physical access may also be able to access other systems within the user’s network.

NOTE: The 12+ pages of vulnerability listing consist of Microsoft vulnerabilities listed back to 2012. There are publicly available exploits for many of these vulnerabilities.

Abbott Advisory

This advisory describes two vulnerabilities in the Abbott Implantable Cardioverter Defibrillator and Cardiac Synchronization Therapy Defibrillator. The vulnerabilities were reported by MedSec Holdings. Abbott has produced a firmware update to mitigate the vulnerability. There is no indication that MedSec Holdings has been provided an opportunity to verify the efficacy of the fix. These vulnerabilities have been reported by the FDA on their medical device safety page.

The two reported vulnerabilities are:

• Improper authentication - CVE-2017-12712; and

• Improper restriction of power consumption - CVE-2017-12714

ICS-CERT reports that an uncharacterized attacker could remotely exploit these vulnerabilities to gain unauthorized access to an ICD to issue commands, change settings, or otherwise interfere with the intended function of the ICD.

Committee Hearings – Week of 04-15-18

With both the House and Senate in session this week the budget process continues. We also have a confirmation hearing for the Coast Guard Commandant.

FY 2019 Budget

These are budget hearings, so they will not delve into policy matters in any great depth. We may see brief mentions of cybersecurity in either (or both) of these hearings.

4-17-18 House – Energy and Commerce Committee  - Oversight of the Federal Energy Regulatory Commission and the FY2019 Budget

4-17-18 House – Homeland Security Subcommittee - FY 2019 Budget - United States Coast Guard

Commandant Confirmation

On Thursday the Senate Commerce, Science, and Transportation Committee will hold a confirmation hearing on promoting Vice Admiral Karl L. Schultz to Admiral and Commandant of the Coast Guard.

We may hear mention of chemical transportation safety and security issues, but it would be in passing on a high-level policy discussion. Schultz will be in favor of safety and security; detials will come later.

Bills Introduced – 04-13-18

On Friday, with just the House in session, there were 23 bills introduced. Of those, three may be of specific interest to readers of this blog:

HR 4 To reauthorize programs of the Federal Aviation Administration, and for other purposes. Rep. Ryan, Paul D. [R-WI-1]

HR 5515 To authorize appropriations for fiscal year 2019 for military activities of the Department of Defense and for military construction, to prescribe military personnel strengths for such fiscal year, and for other purposes. Rep. Thornberry, Mac [R-TX-13]

HR 5517 To improve assistance provided by the Hollings Manufacturing Extension Partnership to small manufacturers in the defense industrial supply chain on matters relating to cybersecurity, and for other purposes. Rep. Panetta, Jimmy [D-CA-20]

The first two are important authorization bills. The FAA bill has already been printed and includes a title on unmanned aircraft systems that will be looked at here. The NDAA will be watched for cybersecurity provisions. Note that it is odd for Speaker Ryan to introduce the FAA authorization bill and even more so for him to use one of his reserved bill numbers.

I will be looking at HR 5517 for control system security issues. The defense industrial base regulation is always a potential forward indicator of possible congressional action on cybersecurity issues.

NIST Announces CSF 1.1 Webinar

Earlier this week the National Institute for Science and Technology (NIST) announced a webinar providing an overview of the Cybersecurity Framework (CSF) version 1.1. The webinar will be held April 27^th, 2018 at 1:00 pm EDT.

The webcast page describes the webinar as:

“This webcast will provide the audience with a brief history of how the Framework was developed, supply an understanding of basic components of the Framework (Core, Implementation Tiers, and Profiles), demonstrate how the Framework can be used by organizations, highlight the latest features added in version 1.1, and introduce the Framework Roadmap and Industry Resources.  The audience will have an opportunity to ask questions during a Q&A session at the end of the presentation.”

NIST will be using #CyberFramework for its live TWITTER® chat during the webinar.

Register early.