Short Takes – 11-21-24

Ukraine says Russia launched an intercontinental missile in an attack for the first time in the war. APNews.com article. Pull quote: “While the range of an ICBM would seem excessive for use against Ukraine, such missiles are designed to carry nuclear warheads, and the use of one would serve as a chilling reminder of Russia’s nuclear capability and a powerful message of potential escalation.”

CISA Director Jen Easterly to depart on Inauguration Day. NextGov.com article. Pull quote: “Ohio Secretary of State Frank LaRose is being considered to lead the agency after Easterly leaves, Politico reported last week, citing four people who have spoken to those in his orbit.” Also points out that the last-administration’s political-appointees generally leave on inauguration day.

NSA Director Wants Industry to Disclose Details of Telecom Hacks. Bloomberg.com article. Pull quote: “Two cybersecurity experts who requested anonymity to speak freely have privately complained about the lack of information shared that could otherwise help them and others understand, find and tackle the hacks.”

Whooping cough cases have quintupled. These states have it worst. TheHill.com article. Pull quote: “Experts believe the 2024 surge in cases may be in part because of missed vaccinations during the COVID-19 pandemic. Widespread masking in 2020 and 2021 also helped prevent spreading of the bacteria that causes pertussis. Now, the disease is back with a vengeance, and we’re seeing more cases than we did in 2019.”

Scientists identify previously unknown compound in drinking water. TheHill.com article. Pull quote: “The mystery compound is called “chloronitramide anion,” which forms from the decomposition of inorganic chloramines — disinfectants used to safeguard people from diseases like typhoid and cholera, the researchers found in a study, published Thursday in Science.”

Review – 7 Advisories Published – 11-21-24

Today, CISA’s NCCIC-ICS published seven control system security advisories for products from mySCADA, Schneider (4), CODESYS, and Carrier.

Advisories

mySCADA Advisory - This advisory describes five vulnerabilities in the mySCADA myPRO Manager products.

Schneider Advisory #1 - This advisory describes an uncontrolled resource consumption vulnerability in the Schneider PowerLogic PM5300 series energy meters.

Schneider Advisory #2 - This advisory describes a missing authentication vulnerability in the Schneider EcoStruxure IT Gateway.

Schneider Advisory #3 - This advisory describes an improper input validation vulnerability in the Schneider Modicon M340, MC80, and Momentum Unity M1E products.

CODESYS Advisory - This advisory describes an out-of-bounds read vulnerability in the CODESYS OSCAT Basic Library.

Carrier Advisory - This advisory describes two vulnerabilities in the Carrier (Automated Logic subsidiary) WebCTRL Premium Server.

 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/7-advisories-published-11-21-24 - subscription required.

CISA Adds 2 VMware Vulnerabilities to KEV – 11-21-24

Yesterday CISA announced the addition of two vulnerabilities in the VMware vCenter Server to their Known Exploited Vulnerabilities (KEV) catalog. The vulnerabilities were previously reported by Broadcom. The vulnerabilities were demonstrated by zbl & srs of team TZL at this years Matrix Cup cybersecurity competition in China.

The two vulnerabilities are:

• Out-of-bounds write - CVE-2024-38812, and

• Improper check for dropped privileges - CVE-2024-38813

CISA has ordered federal agencies using the vCenter Server to apply “mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.” The deadline for achieving this requirement is December 11^th, 2024. 

Review - CSB Updates Seven Recommendation Statuses – 11-18-24

Yesterday the Chemical Safety Board announced the status updates of seven recommendations made during the publication of earlier investigation reports. The decisions were made by the CSB on November 18^th, 2024. The Board closed out six recommendations with an acceptable status and left one recommendation open with a favorable nod to actions taken to date. This week’s action leaves 137 recommendations (out of 1,000) open.

The seven recommendations updated include:

• Wacker Polysilicon Chemical Release - 2021-01-I-TN-R6 - Wacker Polysilicon,

• Didion Milling Company Explosion and Fire - 2017-07-I-WI-R13 - National Fire Protection Association (NFPA),

• Kuraray Pasadena Release and Fire - 2018-03-I-TX-R3 - Kuraray America, Inc,

• Kuraray Pasadena Release and Fire - 2018-03-I-TX-R4 - Kuraray America, Inc,

• Williams Olefins Plant Explosion and Fire - 2013-3-I-LA-R4 - American Petroleum Institute (API),

• Williams Olefins Plant Explosion and Fire - 2013-3-I-LA-R5 - American Petroleum Institute (API), and

• Caribbean Petroleum Refining Tank Explosion and Fire - 2010-02-I-PR-R7 - American Petroleum Institute (API)

 

For more information on the actions taken, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/csb-updates-seven-recommendation - subscription required.

CSB Publishes Investigation Update for Deer Park Refinery Incident – 11-20-24

Yesterday, the Chemical Safety Board announced the publication of an investigation update for the fatal hydrogen sulfide release (discussed here and here) at PEMEX Deer Park Refinery on October 10^th, 2024. The update provides an overview of the facility operation and a timeline for the incident. It also summarizes the areas that the investigators are continuing to look at, including:

• Permit-to-work practices

• Energy isolation procedures

• Contractor management systems

• Emergency preparedness and response systems

• Emergency communication practices

• Hazard analyses and risk assessments

• Maintenance procedures

• Training programs

• Respiratory protection policies and procedures

• Remote isolation capability

It is interesting to note that the update indicates that the hydrogen sulfide release was due to contractors doing permitted-work opened a flange on the wrong piping.

BTW: The CSB is using a cloud platform at Box.com to release this interim report.

Short Takes – 11-20-24

The key moment came 38 minutes after Starship roared off the launch pad. ArsTechnica.com article. Pull quote: “Before going for a full orbital flight, officials needed to confirm Starship could steer itself back into the atmosphere for reentry, ensuring it wouldn't present any risk to the public with an unguided descent over a populated area. After Tuesday, SpaceX can check this off its to-do list.” Lots of interesting program details in the article.

SpaceX Starship Launch Ends With a Dramatic Water Landing. NYTimes.com article. Pull quote: “Though the SpaceX livestream stayed away from political commentary, Mr. Trump’s attendance at the launch signals a growing bond between the president-elect and Mr. Musk.”

Wrangling over whether to punt government funding to Trump heats up. TheHill.com article. Pull quote: ““So, if they’re willing to work on a little bipartisan basis — we know we’re not … the majority. We can get things done, but if they want a partisan bill, then they have to do it on their own, and they’ve shown no ability to do it.””

Every hurricane this season was turbocharged and made more intense than it should have been, study finds. CNN.com article. Pull quote: “Other scientists not involved in the study agreed with the researchers’ overall finding that that human-caused global warming was intensifying storms, but urged caution around the specific increase in wind speeds, particularly with projecting the influence of global warming on future storms.”

Risk Management Under the Toxic Substances Control Act: Certain Per- and Polyfluoroalkyl Substances; Extension of Comment Period. Federal Register EPA comment extension. Summary: “The Environmental Protection Agency (EPA) is extending the comment period for the notice that published in the Federal Register on September 30, 2024, seeking public comment on the manufacture of certain per- and polyfluoroalkyl substances (PFAS), including perfluorooctanoic acid (PFOA), perfluorononanoic acid (PFNA), and perfluorodecanoic acid (PFDA), during the fluorination of high-density polyethylene (HDPE) and other plastic containers to inform regulations as appropriate under the Toxic Substances Control Act (TSCA). That notice established a public comment period that is scheduled to end on November 29, 2024. This document extends that comment period for 31 days to December 30, 2024. EPA received a request to extend the comment period from an interested stakeholder who requested additional time to collect information relating to EPA's notice and develop thoughtful responses to the issues raised in EPA's notice. EPA believes it is appropriate to extend the comment period in order to give stakeholders including the requester additional time to identify and gather information related to the issues identified in EPA's notice and to prepare comprehensive comments.”

300 Drinking Water Systems in US Exposed to Disruptive, Damaging Hacker Attacks. SecurityWeek.com article. Pull quote: ““Moreover, we were unable to find documented policies and procedures related to the EPA’s coordination with the Cybersecurity and Infrastructure Security Agency and other federal and state authorities involved in sector-specific emergency response, security plans, metrics, and mitigation strategies,” OIG notes.”

Review – Public ICS Disclosures – Week of 11-9-24 – Part 3

A delayed completion of my review of last weeks control system cybersecurity disclosures. For Part 3 we have 28 vendor updates from Broadcom (4), FortiGuard (2), HPE (6), Palo Alto Networks, Schneider (2), and Siemens (13).

Updates

Broadcom Update #1 - Broadcom published an update for their Brocade Fabric OS advisory that was originally published on September 26^th, 2024.

Broadcom Update #2 - Broadcom published an update for their Brocade SANnav advisory that was originally published on October 14^th, 2024.

Broadcom Update #3 - Broadcom published an update for their Oracle Critical Patch advisory that was originally published on November 2^nd, 2024.

Broadcom Update #4 - Broadcom published an update for their Azul Zulu Java advisory that was originally published on November 2^nd, 2024.

FortiGuard Update #1 - FortiGuard published an advisory for their regreSSHion vulnerability advisory that was originally published on July 9^th, 2024, and most recently updated on October 16^th, 2024.

FortiGuard Update #2 - FortiGuard published an advisory for their missing authentication in fgfmsd advisory that was originally published on October 23^rd, 2024, and most recently updated on November 7^th, 2024.

HPE Update #1 - HPE published an update for their ProLiant DL/ML/XL, Alletra, Synergy, and Edgeline Servers advisory that was originally published on September 12^th, 2024.

HPE Update #2 - HPE published an update for their ProLiant DL/ML/XL, Alletra, Synergy, and Edgeline Servers advisory that was originally published on September 12^th, 2024.

HPE Update #3 - HPE published an update for their StoreEasy Servers advisory that was originally published on September 19^th, 2024.

HPE Update #4 - HPE published an update for their StoreEasy Servers advisory that was originally published on September 13^th, 2024.

HPE Update #5 - HPE published an update for their StoreEasy Servers advisory that was originally published on September 13^th, 2024.

HPE Updated #6 - HPE published an update for their ProLiant DL/ML/XL, Alletra, Edgeline, MicroServer and Synergy Servers advisory that was originally published on September 16^th, 2024, and most recently updated on September 25^th, 2024.

Palo Alto Networks Advisory - Palo Alto Networks published an update for their Management Web Interface advisory that was originally published on November 8^th, 2024, and most recently updated on November 10^th, 2024.

Schneider Update #1 - Schneider published an update for their PowerLogic PM5500 advisory that was originally published on June 8^th, 2021.

Schneider Update #2 - Schneider published an update for their BadAlloc advisory that was originally published on November 9^th, 2021, and most recently updated on September 10^th, 2024.

Siemens Update #1 - Siemens published an update for their Industrial Products advisory that was originally published on May 14^th, 2024, and most recently updated on October 8^th, 2024.

Siemens Update #2 - Siemens published an update for their n SIMATIC WinCC advisory that was originally published on July 9^th, 2024, and most recently updated on September 10^th, 2024.

Siemens Update #3 - Siemens published an update for their SIMATIC S7-1500 advisory that was originally published on October 8^th, 2024.

Siemens Update #4 - Siemens published an update for their RADIUS Protocol advisory that was originally published on July 9^th, 2024, and most recently updated on July 22^nd, 2024.

Siemens Update #5 - Siemens published an update for their Socket.IO advisory that was originally published on September 10^th, 2024.

Siemens Update #6 - Siemens published an update for their SIMATIC SCADA advisory that was originally published on September 10^th, 2024, and most recently updated on October 8^th, 2024.

Siemens Update #7 - Siemens published an update for their Profinet Devices advisory that was originally published on July 13^th, 2021, and most recently updated on June 11^th, 2024.

Siemens Update #8 - Siemens published an update for their l GNU/Linux subsystem advisory that was originally published on December 12^th, 2023, and most recently updated on October 8^th, 2024.

Siemens Update #9 - Siemens published an update for their Palo Alto Networks advisory that was originally published on July 9^th, 2024, and most recently updated on October 8^th, 2024.

Siemens Update #10 - Siemens published an update for their GNU/Linux subsystem advisory that was originally published on April 9^th, 2024, and most recently updated on July 9^th, 2024.

Siemens Update #11 - Siemens published an update for their Mendix Runtime advisory that was originally published on September 10^th, 2024, and most recently updated on October 10^th, 2024.

Siemens Update #12 - Siemens published an update for their SIMATIC S7-1500 CPUs advisory that was originally published on October 8^th, 2024.

Siemens Update #13 - Siemens published an update for their User Management Component advisory that was originally published on September 10^th, 2024, and most recently updated on October 8^th, 2024.

 

For more information on these updates, including brief description of the recent changes, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-db2 - subscription required.