Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

7/12/2016
01:20 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

ICS Mess: US Industrial Systems The Most Exposed

New data shows vulnerable ICS equipment even as vendors are improving security.

Hundreds of thousands of industrial control systems (ICS) worldwide are available on the public Internet via a Shodan search, nearly 60,000 of them in the US, according to a new report published yesterday.

Kaspersky Lab’s report says the around 221,000 exposed ICS devices run on some 188,019 host systems from 133 different vendors across 170 countries, with Tridium (11.1%), Sierra Wireless (8.1%), and Beck IPC (6.7%) as the biggest offenders. The security vendor also compiled data on ICS vulnerabilities that have been reported publicly and found that 189 were reported in 2015, up slightly from 2014, with about half in the critical category and 42% in the medium-severity category. Most of the vulns were in Siemens, Schneider Electric, and Hospira products.

Exploits are available for some 26 of the reported bugs overall; exploits are not necessarily needed to attack many of the devices that were found with default credentials. The nature of the flaws reflect the relative immaturity of secure coding of these systems: 9% are buffer overflows; 7% hard-coded credentials; and 7% cross-site scripting.

But despite the ominous data, the reality is that major ICS/SCADA vendors are actually finally stepping up their security game. Vendors like Siemens issue security updates regularly; whether ICS operators apply those patches, however, depends on whether the risk of an attack via the vulnerable software is higher than the risk of potentially disrupting a plant’s operations.

Kaspersky Lab’s Sergey Gordeychik, who co-authored the Kaspersky report and is a former independent ICS/SCADA researcher, says large ICS vendors such as ABB, GE, Honeywell, and Siemens, now have mature vulnerability management processes in place, as well as secure development lifecycle programs.

Some ICS vendors are starting to employ “'secure by default' configuration,” he says. The new SMA Sunny Solar Webbox for data logging and control of alternative energy systems, for example, doesn’t allow connections from the Internet, he says.

Some 85% of the published flaws have fixes available, with the rest either unpatched or only partially fixed, Kaspersky Lab says. The Sunny Webbox systems found in the Shodan search reflect the lack of patching by ICS operators/owners, the researchers say.

Dale Peterson, president of Digital Bond, an ICS/SCADA consultancy, says the number of ICS bugs that are disclosed publicly doesn’t really reflect the state of ICS product security: it’s the result of just what researchers are testing.

“The number of ICS vulnerabilities publicly disclosed are only a reflection of researcher interest in the issue and the availability of the software/hardware for their testing. It has no reflection of the security state of the ICS software and firmware,” Peterson says.

The total number of ICS vulns could triple within a year, he says, if a few researchers invested the time and money into purchasing and testing more equipment. ICS products today are chock-full of basic and typically exploitable bugs, he notes.

“Look at the numbers another way: the number of vulnerabilities has been flat since 2012. Many researchers have become bored looking at the poor code quality. Others choose to no longer report what they find. The only other data that would be interesting to pull and analyze from the disclosures is related to the researchers. Look at how people move in and out of this field, what countries they come from, etc.,” he says. “My guess is you will find a new person comes in, reports some bugs for about 18 months, and then moves on.”

Meanwhile, Kaspersky’s Gordeychik says the Shodan findings of big names in electricity, aerospace, airports, oil and gas, metallurgy, chemical, automotive, drinks and food, and smart cities, all exposed on the Net was a bit “scary.”

“As usual, we shared this information with the owners/CERTs and hope this will help them to improve security,” he says.

Related Content:

 

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Lbein
50%
50%
Lbein,
User Rank: Apprentice
7/13/2016 | 1:15:49 AM
To boldly go..
This area is the hackers new frontier... Time to develop thoughtful contingency plans both micro and macro.
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
The Flaw in Vulnerability Management: It's Time to Get Real
Jim Souders, Chief Executive Officer at Adaptiva,  8/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5034
PUBLISHED: 2019-08-20
An exploitable information disclosure vulnerability exists in the Weave Legacy Pairing functionality of Nest Cam IQ Indoor version 4620002. A set of specially crafted weave packets can cause an out of bounds read, resulting in information disclosure. An attacker can send packets to trigger this vuln...
CVE-2019-5035
PUBLISHED: 2019-08-20
An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of specially crafted weave packets can brute force a pairing code, resulting in greater Weave access and potentially full device control. An attacker c...
CVE-2019-5036
PUBLISHED: 2019-08-20
An exploitable denial-of-service vulnerability exists in the Weave error reporting functionality of the Nest Cam IQ Indoor, version 4620002. A specially crafted weave packets can cause an arbitrary Weave Exchange Session to close, resulting in a denial of service. An attacker can send a specially cr...
CVE-2019-8103
PUBLISHED: 2019-08-20
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation ...
CVE-2019-8104
PUBLISHED: 2019-08-20
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation ...