Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-40134PUBLISHED: 2023-01-30An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory.
CVE-2022-40135PUBLISHED: 2023-01-30An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory.
CVE-2022-40136PUBLISHED: 2023-01-30An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory.
CVE-2022-40137PUBLISHED: 2023-01-30A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arbitrary code.
CVE-2022-48006PUBLISHED: 2023-01-30An arbitrary file upload vulnerability in taocms v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is exploited via manipulation of the upext variable at /include/Model/Upload.php.
User Rank: Ninja
6/20/2019 | 5:53:13 PM
-> Blocking overseas addresses at the ISP layer
-> Create a security dashboard where threat intelligence is shared amoung energy companies, this prescriptive procedure allows organizations who are on the grid to keep ahead of the game especially when actors attack a specific site and they can view the remedy on how to thwart the attack
-> Utilize IPv6 as a way to communicate over the web using IPSec AES256 ESP/AH tunnels
-> Work with IBM and Deep Learning to identify the vulnerabilities in real-time (machine learning at the highest level)
-> Take the best of all Hardened linux machines and create a parallel processing OS that uses docker containers for application level processing where changes are made within a specific time period
-> Simultaneous authorization - Keys are unclocked by two people (similar to nuclear authorization)
-> Distributed NMS network is used to monitor traffic and external communication, anything not on the grid, it gets blocked
-> IP address range limited to devices that are allowed on the network (IPv6 only), only external power companies are able to communicate with the grid and their location is verified by GPS tracking system, if the object moves (routers/switches/firewalls, then someone is notified).
-> Cloud is used as a backup and/or DR resource if the onsite system is compromised, the command and control of the ICS environment can be moved to the cloud (direct connect to multiple CSP - Cloud Service Providers).
-> System recovery should be done in minutes instead of hours
By the way, Schneider Electric was the company who reported on it, AIM Triton overflow was affected
A Windows resolution to address it would be to run the following (complete analysis - https://bit.ly/2XeECIS)
Block Triton ICS Port 39929
-------------------------------
Triton-ICS-Attack-Port-UDP-39929 exists - ok
Linux Perspective:
iptables -I INPUT 1 -p UDP -m multiport -d 192.168.0.0/16 -s 0.0.0.0/0 --dport 39929 --sport 1502 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j DROP
or
ufw deny in proto udp from 0.0.0.0/0 port 1502 to 192.168.0.0/16 port 39929 comment "Triton Attack UDP 1502 and 39929" (this is an ex., the default network could on the 172.16 or 10. Network)
Todd