Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1142PUBLISHED: 2023-03-27In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass authentication resulting in privilege escalation.
CVE-2023-1143PUBLISHED: 2023-03-27In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arbitrary code.
CVE-2023-1144PUBLISHED: 2023-03-27Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Gateway service and bypass authorization, which could result in privilege escalation.
CVE-2023-1145PUBLISHED: 2023-03-27Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
CVE-2023-1655PUBLISHED: 2023-03-27Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.
User Rank: Ninja
6/20/2019 | 5:53:13 PM
-> Blocking overseas addresses at the ISP layer
-> Create a security dashboard where threat intelligence is shared amoung energy companies, this prescriptive procedure allows organizations who are on the grid to keep ahead of the game especially when actors attack a specific site and they can view the remedy on how to thwart the attack
-> Utilize IPv6 as a way to communicate over the web using IPSec AES256 ESP/AH tunnels
-> Work with IBM and Deep Learning to identify the vulnerabilities in real-time (machine learning at the highest level)
-> Take the best of all Hardened linux machines and create a parallel processing OS that uses docker containers for application level processing where changes are made within a specific time period
-> Simultaneous authorization - Keys are unclocked by two people (similar to nuclear authorization)
-> Distributed NMS network is used to monitor traffic and external communication, anything not on the grid, it gets blocked
-> IP address range limited to devices that are allowed on the network (IPv6 only), only external power companies are able to communicate with the grid and their location is verified by GPS tracking system, if the object moves (routers/switches/firewalls, then someone is notified).
-> Cloud is used as a backup and/or DR resource if the onsite system is compromised, the command and control of the ICS environment can be moved to the cloud (direct connect to multiple CSP - Cloud Service Providers).
-> System recovery should be done in minutes instead of hours
By the way, Schneider Electric was the company who reported on it, AIM Triton overflow was affected
A Windows resolution to address it would be to run the following (complete analysis - https://bit.ly/2XeECIS)
Block Triton ICS Port 39929
-------------------------------
Triton-ICS-Attack-Port-UDP-39929 exists - ok
Linux Perspective:
iptables -I INPUT 1 -p UDP -m multiport -d 192.168.0.0/16 -s 0.0.0.0/0 --dport 39929 --sport 1502 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j DROP
or
ufw deny in proto udp from 0.0.0.0/0 port 1502 to 192.168.0.0/16 port 39929 comment "Triton Attack UDP 1502 and 39929" (this is an ex., the default network could on the 172.16 or 10. Network)
Todd