Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/21/2017
05:15 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

WannaCry Forces Honda to Take Production Plant Offline

Work on over 1,000 vehicles affected at automaker's Sayama plant in Japan while systems were restored.

In an example of just how persistent modern cyberthreats can be, automaker Honda Motors had to temporarily stop production at its Sayama plant in Japan this week after being hit by WannaCry, a malware threat the company thought it had mitigated just one month ago.

The nearly 48-hour shutdown impacted production of about 1,000 vehicles at the facility, which does engine production and assembly for a line of vehicles including the Odyssey minivan and the Accord.

A statement from Honda North America said the interruption at the Sayama Auto Plant was caused by the shutdown of several older production-line computers infected with the WannaCry virus.

Systems at multiple Honda plants in Asia, North America, Europe, and China were found similarly infected with WannaCry, according to a different Honda statement quoted by Reuters and other outlets.

WannaCry infected hundreds of thousands of computers worldwide last month using a Windows exploit dubbed EternalBlue that the US National Security Agency (NSA) originally developed for use against adversaries. Threat group Shadow Brokers publicly leaked the exploit earlier this year.

Honda has not said if the infection only impacted its industrial control system (ICS) network or its IT network as well, or both. Neither has the automaker so far explained why it decided to shut down operations only in Sayama and not at any of the other locations where WannaCry was reportedly spotted.

Honda first discovered the outbreak Sunday and began recovery work immediately. But it wasn't until Tuesday morning that the company resumed production at Sayama. The infection occured despite Honda's implementation of new measures to mitigate WannaCry when news of the malware first broke. But Honda's efforts apparently were insufficient for several older computers installed at the Sayama Honda plant, some media outlets have quoted the company as saying.

The incident highlights how difficult it is for large organizations to secure every system on their network, especially against self-propagating malware such as WannaCry, says Paul Norris, senior systems engineer at Tripwire.

"Organizations will generally secure the systems they know about," he says. "But most will have assets that are not managed or secured and are old legacy systems that haven’t been decommissioned," and remain vulnerable, Norris says.  

"It's harder for larger organizations to secure every asset within their environment, due to the size and complexity of corporate networks," he says.

The challenges are exacerbated in an industrial control system environment where IT and cybersecurity organizations often have little visibility into all the assets that might be in place.

In fact, up to 80% of all cyber assets in a plant can sometimes be invisible to cybersecurity personnel and often there is an incomplete inventory of IT-based assets as well, making them hard to protect, says David Zahn, general manager at ICS security vendor PAS. "If you can't see it, you can't protect it," he says.

It is possible also that Honda may have known about the underlying vulnerabilities to WannaCry in its plant floor environment but decided not to patch right away because it did not want to disrupt operations. "Risk mitigation within an industrial process facility moves at industry pace – not hacker speed," Zahn says.

Hopefully, incidents such as this will prompt organizations into answering basic cybersecurity questions for plant environments, he notes. "What are my cyber assets, where are my vulnerabilities, did an unauthorized change occur, and can I recover quickly if the worst case scenario happens."

More details are needed to know how Honda got breached. But the incident shows the need for organizations to pay more attention to securing plant floors against cybersecurity threats, adds John Bambenek, threat intelligence manager at Fidelis Cybersecurity.

"Large organizations have devices in low security environments that are necessary for their operations and in many cases, rely on factory employees not take actions that undermine the security of those environments," Bambanek says. That is a mistake, he adds.

"These attacks can cause real impact and a factory not producing parts for a day has a large monetary impact to the organization."

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

 

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
TammyMinger
50%
50%
TammyMinger,
User Rank: Apprentice
10/17/2017 | 9:23:12 PM
Re: A new form of war
Technology is a double-edged sword.  Advancements provide solutions to great problems, however, new problems are also formed with the advancement of technology.  My concern is will there ever be a time when the new problems outweigh the solutions created?   I fear one-day cyber attacks will become so common that they will begin attacking individuals.

 

~Tammy

 
Joe69400
50%
50%
Joe69400,
User Rank: Apprentice
6/22/2017 | 4:31:41 AM
A new form of war
Cyber attacks are a new form of war. It will be interesting to see how companies and countries will manage to counter them and how they will respond to these digital attacks.
AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4147
PUBLISHED: 2019-09-16
IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 158413.
CVE-2019-5481
PUBLISHED: 2019-09-16
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
CVE-2019-5482
PUBLISHED: 2019-09-16
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
CVE-2019-15741
PUBLISHED: 2019-09-16
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. An unsafe interaction with logrotate could result in a privilege escalation
CVE-2019-16370
PUBLISHED: 2019-09-16
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.