Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Rethinking Vulnerability Disclosures In Industrial Control Systems
Oldest First  |  Newest First  |  Threaded View
jcavery
50%
50%
jcavery,
 User Rank: Moderator
1/27/2017 | 3:13:46 PM
Vuln Disclosures
"Disclosing vulnerabilities prior to a patch being released by the vendor only helps the bad guys, and these disclosures significantly decrease the skills required for attackers to be successful."

Any disclosure has this impact even if a patch was released, as most don't implement the patch in time to prevent an attack... I agree we don't need to be publicly disclosing ICS vulnerabilities but we still have alot of thinking to do in how we disclose vulns in regular consumer products too, need to try to keep them a little more private, within the industry, instead of pasting them on the front page for any newbie hacker to cherry-pick.
richalt
50%
50%
richalt,
 User Rank: Apprentice
1/27/2017 | 5:30:46 PM
Re: Vuln Disclosures
Although patches may not be forthcoming, the ICS vendor can certainly get their production site disconnected from the public Internet.  This is a step which should happen immediately.  In other words, workarounds need to be deployed with an assumption of vulnerability.  Don't wait for the attack to prove you are vulnerable.

 
WolfgangK818
50%
50%
WolfgangK818,
 User Rank: Apprentice
1/30/2017 | 3:58:42 AM
Re: Vuln Disclosures
Sometimes bad guys know the vulnerability already before it gets disclosed .e.g. in targeted and state sponsored attacks. This are the biggest threats... I agree we need to keep away vulnerabilities/exploits from "newbie hackers" and script kiddies but we require to find ways to speed up the implementation of compensation controls, either by vendors or manufacturer, or best jointly.
Dr.T
50%
50%
Dr.T,
 User Rank: Ninja
1/30/2017 | 1:29:09 PM
Mechanical things
 

Mechanical things are hard to hack without close proximity however when we start automating most of the things then we make them vulnerable too.
Dr.T
50%
50%
Dr.T,
 User Rank: Ninja
1/30/2017 | 1:32:25 PM
Re: Vuln Disclosures
"most don't implement the patch in time to prevent an attack."

Good point. We do not take action unless we see we are impacted. Especially with ICS environment it would be worse.
Dr.T
50%
50%
Dr.T,
 User Rank: Ninja
1/30/2017 | 1:34:17 PM
Re: Vuln Disclosures
"need to try to keep them a little more private "

This would be a little bit hard to do, if there is vulnerability then most likely there is many others already knowing it.
Dr.T
50%
50%
Dr.T,
 User Rank: Ninja
1/30/2017 | 1:36:05 PM
Re: Vuln Disclosures
"production site disconnected from the public Internet."

Good idea. It may be that some platforms are designed to work with the internet, unless vendors provide this potion it would not be easy to implement.
Dr.T
50%
50%
Dr.T,
 User Rank: Ninja
1/30/2017 | 1:36:25 PM
ICS and IoT
 

I think these go together when it comes to the security, they work and we do not touch them until we face a big security attack on them. Then the game will be completely different.
MarkT563
50%
50%
MarkT563,
 User Rank: Apprentice
2/5/2017 | 5:15:41 PM
ICS System Patching
ICS vendors are becoming better at providing patches for vunerabilities related to operating systems. However, the patches can be delayed as the vendor usually performs regression testing to ensure any patch does not have an adverse affect on the ICS software.

Patching can be further delayed as the client deploying the patch on their ICS will also test the patch on an offline system to ensure there are no adverse effects.
Joe Stanganelli
50%
50%
Joe Stanganelli,
 User Rank: Ninja
2/6/2017 | 4:45:29 PM
Re: ICS and IoT
@Dr.T:  Sure.  ICS is really just an enterprise-grade IoT device/system.  Additionally, there is generally more at stake w/ ICS than with other "run-of-the-mill" IoT devices -- even if are speaking strictly in the enterprise context.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
4 Security Tips as the July 15 Tax-Day Extension Draws Near
Shane Buckley, President & Chief Operating Officer, Gigamon,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internet—and What Your Organization Can Do About It
The Threat from the Internet—and What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...