CSB Publishes Bio-Lab Investigation Update – 11-23-24

Yesterday the Chemical Safety Board announced the publication of an investigation update for their ongoing look at the multi-day fire and toxic chemical release at the Bio-Lab facility in Conyers, GA. Initial news reports had indicated that the initiating event was a roof fire, but the announcement paints an entirely different picture, reporting that:

“The CSB’s update outlines the events surrounding the massive blaze. On September 29, 2024, at 5:00 a.m., a Bio-Lab employee on fire watch in the Plant 12 storage warehouse heard what was reported as a popping sound, which they attributed to wet product. There were no visible flames at that time. After an unsuccessful attempt to isolate the reacting product, the employee called the only other Bio-Lab employee on-site.  At approximately 5:10 a.m., the employee called 9-1-1 due to the large hazardous plumes of toxic vapors inside the building. By 6:30 a.m., flames became visible above the area of the chemical reaction and were quickly extinguished in less than two hours.”

The investigation update notes that:

“Bio-Lab leadership informed the CSB that the facility had established a permanent fire watchc two or three months prior to the incident after detecting strong odors from oxidizers in two storage buildings, one of which was Plant 12. This precaution was taken to mitigate any potential product decomposition events. At the time of the initial incident, two Bio-Lab employees were present on-site to carry out fire watch duties. Their responsibilities included identifying and managing hazards, detecting early signs of product decomposition or fire hazards, notifying site leadership of any observed leaks or other water intrusions, and contacting the third-party sprinkler company if a sprinkler head was leaking.”

This would seem to indicate that Bio-Lab had been having water leak problems leading to isolated decomposition reactions. It will be interesting to see how the final report deals with this.

The update concludes with a list of issues that the investigators are still looking at:

• The cause of the material decomposition, off-gassing, and fire

• Storage and handling of oxidizers and their compatibility

• Best practices for responding to emergencies involving bulk solid oxidizer chemical reactions and decompositions

• Regulatory and Industry guidance on fire protection systems for bulk solid oxidizers

Chemical Incident Reporting – Week of 11-16-24

NOTE: See here for series background.

Weslaco, TX – 11-15-24

Local News Report: Here, here, and here.

There was a chlorine dioxide leak at a water treatment facility. No injuries have been reported.

Not CSB reportable.

I reported on a 2015 incident at this facility. Apparently, the facility has changed their chlorine source from sodium hypochlorite to chlorine dioxide.

Review – Public ICS Disclosures – Week of 11-16-24

This week we have 21 vendor disclosures from Dassault Systems, HPE, Palo Alto Networks (2), Philips (2), QNAP (8), Sick, WAGO, Westermo (2), Wireshark (2), and Zyxel. There are also seven vendor updates from FortiGuard, Mitsubishi, Moxa (4), and VMware. We also have three researcher reports for vulnerabilities in products from MC Technologies (2) and Mongoose Web Server Library. Finally, we have three exploits for products from Korenix, Palo Alto Networks, and Siemens.

Advisories

Dassault Systems Advisory - Dassault Systems published an advisory that describes two vulnerabilities in their eDrawings product.

HPE Advisory - HPE published an advisory that describes an improper handling of exceptional conditions vulnerability in their NonStop DISK UTIL.

Palo Alto Networks Advisory #1 - Palo Alto Networks published an advisory that describes an OS command injection vulnerability {listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog} in their PAN-OS products.

Palo Alto Networks Advisory #2 - Palo Alto Networks published an advisory that describes a missing authentication for critical function vulnerability {listed in CISA’s KEV catalog} in their PAN-OS products.

Philips Advisory #1 - Philips published an advisory that discusses an argument injection vulnerability reported by Laravel.

Philips Advisory #2 - Philips published an advisory that discusses an improper authentication vulnerability {listed in CISA’s KEV catalog} reported by Microsoft in their Windows Scheduler.

QNAP Advisory #1 - QNAP published an advisory that describes four vulnerabilities in their Notes Station 3.

QNAP Advisory #2 - QNAP published an advisory that discusses three vulnerabilities in their QTS and QTS Hero products.

QNAP Advisory #3 - QNAP published an advisory that describes four cross-site scripting vulnerabilities in their Photo Station products.

QNAP Advisory #4 - QNAP published an advisory that describes an exposure of sensitive information to unauthorized actor vulnerability in their AI Core product.

QNAP Advisory #5 - QNAP published an advisory that describes a link following vulnerability in their QuLog Center product.

QNAP Advisory #6 - QNAP published an advisory that describes 15 vulnerabilities in their QTS and QuTS hero products.

QNAP Advisory #7 - QNAP published an advisory that describes two OS command injection vulnerabilities in their QuRouter product.

QNAP Advisory #8 - QNAP published an advisory that describes an authorization bypass through user controlled key vulnerability in their Media Streaming Add-on.

Sick Advisory - Sick published an advisory that describes an execution with unnecessary privileges vulnerability in their  Incoming Goods Suite.

WAGO Advisory - CERT-VDE published an advisory that describes eight vulnerabilities in the firmware of multiple WAGO products.

Westermo Advisory #1 - Westermo published an advisory that discusses an out-of-bounds write vulnerability (with publicly available exploit) in their WeOS.

Westermo Advisory #2 - Westermo published an advisory that discusses the Blast-Radius vulnerabilities in their WeOS products

Wireshark Advisory #1 - Wireshark published an advisory that describes an ECMP dissector crash vulnerability.

Wireshark Advisory #2 - Wireshark published an advisory that describes an FiveCo RAP dissector infinite loop vulnerability.

Zyxel Advisory - Zyxel published an advisory that discusses recent attempts by threat actors to target Zyxel firewalls through previously disclosed vulnerabilities.

Updates

FortiGuard Update #1 - FortiGuard published an update for their CONTINUATION Frames advisory that was originally published on May 14^th, 2024.

FortiGuard Update #2 - FortiGuard published an update for their regreSSHion advisory that was originally published on July 9^th, 2024, and most recently updated on November 15^th, 2024.

Mitsubishi Update - Mitsubishi published an update for their Ethernet port advisory that was originally published on November 30^th, 2021, and most recently updated on November 9^th, 2023.

Moxa Update #1 - Moxa published an update for their Ethernet Switches advisory that was originally published on November 1^st, 2024.

Moxa Update #2 - Moxa published an update for their MDS-G4028-L3 Series advisory that was originally published on November 4^th, 2024.

Moxa Update #3 - Moxa published an update for their Cellular Routers advisory that was originally published on October 14^th, 2024, and most recently updated on October 25^th, 2024.

Moxa Update #4 - Moxa published an update for their SSLv2 Vulnerabilities advisory that was originally published on March 31^st, 2016.

VMware Update - VMware published an update for their vCenter Server advisory that was originally published on September 17^th, 2024, and most recently updated on October 21^st, 2024.

Researcher Reports

MC Technologies Reports - Cisco Talos published two reports covering four OS command injection vulnerabilities in the MC Technologies MC LR Router web interface.

Mongoose Web Server Report - Nozomi Networks published a report describing ten vulnerabilities in the Mongoose Web Server Library.

Exploits

Korenix Exploit - St. Pölten UAS published an exploit for a path traversal vulnerability in the Korenix JetPort 5601.

Palo Alto Networks Exploit - Sachinart published an exploit for a missing authentication for critical function vulnerability in the Palo Alto Networks PAN-OS product.

Siemens Energy Exploit - SEC Consult published an exploit for four vulnerabilities in the Siemens Energy Omnivise T3000.

 

For more information on these disclosures, including links to 3rd party advisories, researcher reports, and exploits, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/public-ics-disclosures-week-of-11-3cc - subscription required.

Review - Siemens Publishes Out-of-Zone Advisory – 11-22-24

Today Siemens published a control system security advisory outside of their normal Cyber Tuesday (November 12^th this month) tranche of advisories. This is the third out-of-zone advisory this month.

Siemens Advisory - Siemens published an advisory that discusses four vulnerabilities (two listed in CISA’s KEV catalog) in the Palo Alto Networks Virtual NGFW on Siemens RUGGEDCOM APE1808 Devices.

 

For more information on this advisory, including links to PAN advisories and a DTRH look at a similar Siemens advisory – see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/siemens-publishes-out-of-zone-advisory-e12 - subscription required. 

Transportation Chemical Incidents – Week of 10-19-24

Reporting Background

See this post for explanation, with the most recent update here (removed from paywall).

Data from PHMSA’s online database of transportation related chemical incidents that have been reported to the agency.

Incidents Summary

• Number of incidents – 455 (416 highway, 33 air, 6 rail, 0 water)

• Serious incidents – 2 (2 Bulk release, 0 evacuation, 0 injury, 0 death, 0 major artery closed, 1 fire/explosion, 42 no release)

• Largest container involved – 33,630-gal DOT 112J340W Railcar {Petroleum Gases, Liquefied Or Liquefied Petroleum Gas} A-end liquid valve opened, and secondary closure plug not tool tight.

• Largest amount spilled – 200-gal Plastic IBC { Flammable Liquids, N.O.S.} Load shift.

NOTE: Links above are to Form 5800.1 for the described incidents.

Most Interesting Chemical: Acetic Acid, Glacial - A clear colorless liquid with a strong odor of vinegar. Flash point 104°F. Density 8.8 lb / gal. Corrosive to metals and tissue. Used to make other chemicals, as a food additive, and in petroleum production. Water soluble. (Source: CameoChemicals.NOAA.gov).

 

CG Sends Maritime Cybersecurity Final Rule to OMB

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a final rule from the Coast Guard on “Cybersecurity in the Marine Transportation System”. The notice of proposed rulemaking (NPRM) was published [removed from paywall] on February 22^nd, 2024.

According to the 2024 Spring Unified Agenda entry for this rulemaking:

“The Coast Guard has published a proposed rule to update its maritime security regulations by adding regulations specifically focused on establishing minimum cybersecurity requirements for U.S.-flagged vessels, Outer Continental Shelf facilities, and U.S. facilities subject to the Maritime Transportation Security Act of 2002 regulations.  This proposed rulemaking is part of an ongoing effort to address emerging cybersecurity risks and threats to maritime security by including additional security requirements to safeguard the marine transportation system.”

Bills Introduced – 11-21-24

 

Yesterday, with both the House and Senate in lame duck session, there were 68 bills introduced. One of those bills will (if time remaining in session permits) receive additional coverage in this blog:

HR 10209 To amend the Cybersecurity Enhancement Act of 2014 to make improvements to the Federal Cyber Scholarship for Service Program, and for other purposes. Connolly, Gerald E. [Rep.-D-VA-11]