Committee Hearings – Week of 6-2-24

This week, with both the House and Senate in session, there is a moderately busy hearing schedule. The House is continuing to move forward with marking up spending bills with the first moving to the floor this week. There is a hearing on OSHA’s proposed fire brigade rule and a hearing on streamlining the cybersecurity regulatory process.

FY 2025 Spending Bill Hearings

	House
DHS	Subcommittee
DOD	Subcommittee (closed)
FinServices	Subcommittee

The House Rules Committee will hold a rules hearing this afternoon that includes HR 8580, the Military Construction, Veterans Affairs, and Related Agencies Appropriations Act, 2025.

Fire Brigade NPRM

On Tuesday, the Emergency Management and Technology Subcommittee of the House Homeland Security Committee will hold a hearing on “Stakeholder Perspectives on OSHA’s Proposed Rule to Update the Fire Brigades Standard”. The witness list includes:

• David Denniston, Association of Fire Districts of the State of New York,

• Joseph Maruca, National Volunteer Fire Council,

• Evan Davis, International Association of Fire Fighters, and

• Grant Walker, International Association of Fire Fighters, L

Cybersecurity Regulatory Process

On Wednesday, the Senate Homeland Security and Governmental Affairs Committee will hold a hearing on “Streamlining the Federal Cybersecurity Regulatory Process: The Path to Harmonization”.

• Nicholas Leiserson, Office of the National Cyber Director

• David Hinchman, U.S. Government Accountability Office

Short Takes – 6-3-24 – Space Geek Edition

Here’s why a Japanese billionaire just canceled his lunar flight on Starship. ArsTechnica.com article. Pull quote: “"It’s a developmental project so it is what it is, but it is still uncertain as to when Starship can launch," he wrote. "I can’t plan my future in this situation, and I feel terrible making the crew members wait longer, hence the difficult decision to cancel at this point in time. I apologize to those who were excited for this project to happen."”

Blue Origin investigating New Shepard parachute issue. SpaceNews.com article. Pull quote: “That is controlled by a band or line at the throat of the parachute. “What was saw was that the cutters, for some reason, did not cut that line,” he said. The parachutes on Starliner use a similar cutter, but Stich said testing showed no evidence of any problems with those used on Starliner. That provided the “flight rationale” for the Starliner launch to proceed.”

Ursa Major completes ground tests of new hypersonic rocket engine. SpaceNews.com article. Pull quote: “The Draper engine uses a non-cryogenic kerosene peroxide fuel combination that offers a simpler storage solution compared to engines using liquid oxygen. Non-cryogenic fuels stay liquid at room temperature and could be useful for some in-space propulsion applications like lunar landers where the propellants need to be stored for extended periods of time.”

DARPA awards in-orbit manufacturing contract to Momentus. TheRegister.com article. Pull quote: “"The company continues to pursue opportunities to raise additional capital to allow for its continuing operations and the execution of its business plan but does not have definitive commitments at this time," Momentus added in a January SEC filing. The company also announced in the document that it had lost a potential contract with the Space Development Agency for Tranche 2 of its tracking satellite constellation.”

NASA, Mission Partners Target June 5 Crew Flight Test Launch. Blogs.NASA.gov blog post. Pull quote: “Technicians and engineers with ULA (United Launch Alliance) worked overnight and on Sunday to assess the ground support equipment at the launch pad that encountered issues during the countdown and scrubbed the June 1 launch attempt. The ULA team identified an issue with a single ground power supply within one of the three redundant chassis that provides power to a subset of computer cards controlling various system functions, including the card responsible for the stable replenishment topping valves for the Centaur upper stage. All three of these chassis are required to enter the terminal phase of the launch countdown to ensure crew safety.”

Chinese Probe Lands on Moon’s Far Side to Collect Samples for Return. UniverseToday.com article. Pull quote: “Up to 2 kilograms (4.4 pounds) of lunar samples will be stowed inside the lander’s “ascender” stage. The rocket-powered ascender will then lift off from the surface and transfer the samples to the Chang’e-6 orbiter, which is currently in lunar orbit. Following the model set by Chang’e-5, the orbiter will head back toward Earth and release the sample capsule for atmospheric re-entry and touchdown in Inner Mongolia.”

Mars is more prone to devastating asteroid impacts than we thought, new study hints. LiveScience.com article. Pull quote: “The simulations revealed that every Earth year, about 52 large asteroids wander dangerously close to Mars — about 2.6 times more than the 20 or so that approach Earth annually. Although these asteroids come closer to Mars than the Earth CAPHAs do to our planet, they also travel more slowly.”

Short Takes – 6-1-24

GOP faces internal battle over defense spending. TheHill.com article. Pull quote: “Reed will likely hold back from endorsing a top-line defense spending number until Senate Majority Leader Chuck Schumer (D-N.Y.), Senate Appropriations Committee Chair Patty Murray (D-Wash.), House Democratic Leader Hakeem Jeffries (N.Y.) and Rep. Rosa DeLauro (D-Conn.), the ranking member on the House Appropriations Committee, reach a deal with their GOP counterparts on the top-line defense and nondefense spending numbers.”

Procurement: USN Fails at Ship Building. StrategyPage.com article. Pull quote: “The American warships are still, on average, more powerful than their Chinese counterparts. This is largely due to the American nuclear aircraft carriers and nuclear submarine forces. China has nothing like these but does have more anti-ship missiles on their ships plus cruise and ballistic missiles launched from land to hit American ships far from the Chinese coast. American warships are generally well-protected from those but supply ships aren’t. At all. The primary American weakness is seaborne supply and the Chinese are well aware of that.”

House Republican sounds the alarm on threats to food and agriculture sector. CyberScoop.com article. Pull quote: “Finstad, who chairs the House Agriculture Subcommittee on Nutrition, Foreign Agriculture and Horticulture, chided the U.S. Department of Agriculture for lacking direction when it comes to assisting the sector against cybersecurity threats — which is one of the reasons he introduced legislation [HR 7062, the Farm and Food Cybersecurity Act of 2024] to address the issue earlier this year alongside Rep. Elissa Slotkin, D-Mich., and Sens. Tom Cotton, R-Ark., and Kirsten Gillibrand, D-N.Y.”

The launch of Boeing’s crewed Starliner space capsule is called off yet again. NPR.org article. Pull quote: “NASA said the scrub was "due to the computer ground launch sequencer not loading into the correct operational configuration after proceeding into terminal count" and that teams were working to understand the cause.”

NASA, Mission Partners Forgo June 2 Launch of Crew Flight Test. Blogs.NASA.gov blog post. Pull quote: “NASA, Boeing, and ULA (United Launch Alliance) are forgoing a Crew Flight Test launch attempt Sunday, June 2, to give the team additional time to assess a ground support equipment issue at Cape Canaveral Space Force Station’s Space Launch Complex-41 in Florida.”

Bird flu can infect cats. What does that mean for their people? ScienceNews.org article. Pull quote: “The U.S. Department of Agriculture has found viral particles in muscle and other tissue from a dairy cow that was being culled, the agency said May 24. None of the meat entered the food supply, but the incident highlights that raw beef might contain the virus. (For anyone worried about their summer cookout, cooking burgers spiked with H5N1 to 145° Fahrenheit (medium) or higher was enough to inactivate the virus, the agency says.)”

GOP senator aims to block floor action over Trump conviction. Axios.com article. Pull quote: “Eight Republican senators are vowing to vote against any spending bills, judicial nominees or other Democratic legislation brought to the floor in protest of former President Trump's conviction on 34 felony charges.”

Study: Derailment risk rises with the number of cars in a freight train. Trains.com article. Pull quote: “The researchers then estimated derailment risk while taking into account the reduced overall accident risk that comes from moving freight on fewer but longer trains. They concluded that, compared to a 50-car train, a 100-car train has an 11% higher risk of derailment and that the odds of a wreck rise as the number of cars in a train increases.”

Rail safety experts question conclusions of long-train derailment study. Trains.com article. Pull quote: ““The authors acknowledge an important limitation, namely the lack of exposure or ‘denominator’ data that are necessary to calculate rates. Specifically, they don’t know train-miles by train length, so they cannot calculate rates,” he explains. “To their credit the authors applied a novel statistical approach to try and overcome this but they have made a number of implicit assumptions that may affect their results and need to be investigated before the results can be accepted.””

Chemical Incident Reporting – Week of 5-25-24

NOTE: See here for series background.

Lupton, AZ – 4-26-24

Local news reporting: Here, here, and here.

Multicar train derailment. Fire and explosions. No injuries reported. I-40 closed. NTSB investigators reported on-site.

Not CSB reportable.

Yes, this is an older accident (I just ran across the news items this week), but I am including it because it ‘should have’ shown up in last week’s Transportation Chemical Incidents – Week of 4-20-24 blog post, but it did not. Just another reason for my continuing review of PHMSA’s Incident Statistics database.

Wynnewood, OK – 5-21-24

Local news reporting: Here, here and here.

Explosion and fire at hydrotreater unit at local refinery. 3 injured, 1 dead. No data on damage reported.

CSB reportable.

Youngstown, OH – 5-28-24

Local news reporting: Here, here, here, and here.

Potential gas explosion in downtown building. Seven people transported to hospital, 1 in serious condition. 1 person missing.

Technically a CSB reportable. The chemical release does not have to come from an industrial facility. NHTSA is investigating as a gas pipeline incident.

Canandaiuga, NY – 5-29-24

Local news reporting: Here, here, and here.

A herbicide application truck overtured with unnamed herbicide leaking from 400-gal tank. No injuries and no damages reported.

Not CSB reportable, transportation incident.

WILLISTON, ND – 5-29-24

Local news reporting: Here.

Produced water (water from fracking operation, contaminated with crude oil and mineral salts) spill at oil well site. Most of the 35,000-gal was recovered. No injuries or damage were reported.

Not CSB reportable.

Review - CISA Publishes CIRCIA NPRM Correction

CISA published a correction to their Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) notice of proposed rulemaking in Monday’s (available on line today) Federal Register (89 FR 47471-47472). This correction addresses the issue of the definition of ‘covered entity’ for “for pipeline facilities and systems” as outlined in CISA’s April 4^th, 2024 NPRM.

Monday’s ‘correction’ would change the NPRM entry for §226.2(b)(14)(iv) to read:

“(iv) A pipeline facility or system owner or operator required to report cyber incidents by the Transportation Security Administration;”

With this correction being made to April’s NPRM, the comment period (which was to end on Monday, June 3^rd, 2024) has been extended to July 3^rd, 2024. I would not be surprised to see requests for a further extension of that time. Comments may be submitted through the Federal eRulemaking Portal (www.regulations.gov; Docket # CISA-2022-0010).

 

For more information on this correction, including a look at why CISA had to make the change, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/cisa-publishes-circia-nprm-correction - subscription required.

Bills Introduced – 5-31-24

Yesterday, with the House and Senate meeting in pro forma session, there were 15 bills introduced. One of those bills will receive additional attention in this blog:

HR 8590 To amend the Homeland Security Act of 2002 to require the Attorney General, in coordination with the Secretary of Homeland Security, to establish counter-UAS system training and require the Attorney General and Secretary of Homeland Security, in coordination with the Administrator of the Federal Aviation Administration to establish related standards for initial and recurrent training programs or certifications for individuals seeking to operate counter-UAS detection and mitigation systems, equipment, or technology, and for other purposes. Strong, Dale W. [Rep.-R-AL-5]

Review – Public ICS Disclosures – Week of 5-25-24

This week we have 16 vendor disclosures from Bosch, Broadcom (3), ELECOM (4), Dassault Systèmes (2), Flexera, Hitachi, HPE, Omron (2), and SEL. There are also nine vendor updates from Hitachi Energy (2), HP (2), HPE (4), and Mitsubishi. We have 16 researcher reports for products from AutomationDirect (8), FortiGuard, libigl (6), and Nokia. Finally, we have an exploit for products from Siemens.

Advisories

Bosch Advisory - Bosch published an advisory that describes an uncontrolled resource consumption vulnerability in their CC13XX-26XX-SDK, BLE5-STACK and CC2340 SDK, BLE5-STACK products.

Broadcom Advisory #1 - Broadcom published an advisory that describes a URL parsing vulnerability in their Spring Framework product.

Broadcom Advisory #2 - Broadcom published an advisory that discusses ten vulnerabilities (three with known exploits) in their Brocade ASCG product.

Broadcom Advisory #3 - Broadcom published an advisory that describes a default community strings vulnerability in their Brocade Directors, Brocade Fabric OS, and Brocade Switches.

ELECOM Advisory #1 - JP-CERT published an advisory that describes an OS command injection vulnerability in the ELECOM WRC-X5400GS-B and WRC-X5400GSA-B wireless LAN routers.

ELECOM Advisory #2 - JP-CERT published an advisory that describes two vulnerabilities in multiple wireless LAN routers and wireless LAN repeaters from ELECOM.

ELECOM Advisory #3 - JP-CERT published an advisory that describes an OS command injection vulnerability in multiple ELECOM wireless LAN routers.

ELECOM Advisory #4 - JP-CERT published an advisory that describes three vulnerabilities in multiple ELECOM wireless LAN routers.

Dassault Advisory #1 - Dassault published an advisory that describes a deserialization of untrusted data vulnerability in their DELMIA Apriso product.

Dassault Advisory #2 - Dassault published an advisory that describes a deserialization of untrusted data vulnerability in their DELMIA Apriso product.

Flexera Advisory - Flexera published an advisory that discusses four vulnerabilities in their FlexNet Publisher.

HPE Advisory - HPE published an advisory that discusses a hardware logic contains race condition vulnerability in their ProLiant DL/ML and MicroServer products.

Omron Advisory #1 - Omron published an advisory that describes an insufficient verification of data authenticity vulnerability in their NJ/NX-series Machine Automation Controllers.

Omron Advisory #2 - Omron published an advisory that discusses three vulnerabilities in their NJ/NX-series Machine Automation Controllers.

SEL Advisory - SEL published a version update for their SEL Compass software.

Updates

Hitachi Energy Update #1 - Hitachi Energy published an update for their AFF660/665 series advisory that was originally published on January 30^th, 2024.

Hitachi Energy Update #2 - Hitachi Energy published an update for their IED ConnPacks advisory that was originally published on November 15^th, 2022. The link provided currently goes to the original version of the advisory.

HP Update #1 - HP published an update for their LaserJet Pro advisory that was originally published on February 20^th, 2024 and most recently updated on April 29^th, 2024.

HP Update #2 - HP published an update for their Laser Jet Managed Printers advisory that was originally published on February 20^th, 2024. The provided link currently goes to a blank page.

HPE Update #1 - HPE published an update for their ProLiant DL/DX/ML/SY/RL/XL/Edgeline Servers that was originally published on April 2^nd, 2024 and most recently updated on May 14^th, 2024.

HPE Update #2 - HPE published an update for their Aruba ArubaOS-CX Switches advisory that was originally published on May 8^th, 2024.

HPE Update #3 - HPE published an update for their NonStop Web ViewPoint Enterprise advisory that was originally published on April 1^st, 2024.

HPE Update #4 - HPE published an update for their Tomcat-based Servlet Engine advisory that was originally published on March 9^th, 2018.

Mitsubishi Update - Mitsubishi published an update for their MELSEC and MELIPC Series advisory that was originally published on June 14^th, 2022 and most recently updated on July 27^th, 2023.

Researcher Reports

AutomationDirect Reports - Talos Intelligence published eight reports describing 13 vulnerabilities in the AutomationDirect P3-550E PLCs.

FortiGuard Report - Horizon3 published a report that describes the identification of CVE-2024-23108 and CVE-2024-23109, command injection vulnerabilities, in the FortiGuard FortiSIEM product.

Libigl Report - Talos Intelligence published six reports describing vulnerabilities in the libigl library.

Nokia Report - IOActive published a report that describes two vulnerabilities in the Nokia FRRO501a  Industrial Fieldrouter.

Exploits

Siemens Exploit - SEC Consult published an exploit for an exposed serial shells vulnerability in the Siemens CP-XXXX Series PLCs.

For more information on these disclosures, including links to 3rd party advisories and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-5-cd7 - subscription required.