Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/21/2014
10:17 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Power Utility Substations At Risk

'Project Robus' so far has exposed dozens of security flaws in software using popular ICS/SCADA network protocol, but several vendors still have not patched

Nearly 30 security vulnerabilities so far have been found in products using a popular ICS/SCADA communications protocol, prompting about half of the affected vendors to patch their products, and at least one vendor to pull its affected software from the market and urge its customers to instead install another one of its products.

The findings by researchers Adam Crain and Chris Sistrunk of potentially dangerous bugs in ICS/SCADA products running the so-called DNP3 protocol -- used for "master" host systems to communicate with equipment at power plant substations -- could be easily exploited by an attacker to disrupt parts of the power grid by crashing the master system so it can no longer monitor and control the SCADA network at a substation or substations. The attacks would entail sending malformed DNP3 response packets back to the master host system by exploiting flaws in the way software using DNP3 is written and deployed.

Cooper Power Systems, which was notified by the researchers of an improper input validation flaw in its Cybectec DNP3 Master OPC Server software, discontinued the server product rather than patch it, and is urging its customers to use its SMP Gateway product -- which doesn't carry the flaw -- as a replacement. The bug could allow an attacker to crash the system and, ultimately, disrupt the process it was running.

Last week at the S4x14 conference in Miami, Crain and Sistrunk disclosed new details on the so-called Project Robus research that they quietly began in April 2013. The researchers have been using Crain's homegrown fuzzing tool for DNP3 implementations, and so far have reported some 28 flaws, resulting in 16 security advisories from the ICS-CERT and related vendor patches. Only two products that the researchers tested have not had DNP3 flaws, and the researchers are awaiting word on nearly a dozen additional bugs that they have reported.

Some 75 percent of North American power facilities run DNP3, which was developed in 1993. The protocol is used for "master" servers to communicate with remote terminal units in electric substations, gas pumping plants for gas pipelines, and water utilities, for instance. That includes monitoring voltage or water levels, for instance.

Sistrunk, an engineer with an electric utility, a few months ago decided to try out Crain's open-source DNP3 fuzzer in his lab. "I tested it on a few things I have access to that had DNP3, and they broke. So I said, 'Time out -- we need to have a pow-wow and talk about what we're going to do because this is pretty big,'" says Sistrunk, who conducted the DNP3 research independently of his utility company, which he ask not be named.

An attacker could exploit these bugs and take down a remote site such that the utility would have no visibility or control over it anymore, says Dale Peterson, founder and CEO of Digital Bond, an ICS/SCADA consultancy that hosts the S4 Conference. "What it really means is that someone can go to an unmanned facility and take out the visibility of the entire SCADA system ... There's no need to go to the control center. They can pick [a power substation] in the middle of nowhere, go and break in, hook something up, and the whole thing goes down," Peterson says.

Sistrunk and Crain said that they also have found 90 or so DNP3 devices exposed on the public Internet. "The majority are misconfigured ... this is the [tip] of the iceberg. How many are on the Net that don't say anything?" said Crain, who is CEO of Automatak and the principal author of the Open DNP3 stack.

The exposed equipment is yet another example of the millions of public Internet-facing equipment found vulnerable and wide open to attack. Project SHINE, which has been gathering data on SCADA/ICS devices from SHODAN for a year-and-a-half, has identified more than 1 million unique IP addresses to date, and 2,000 to 8,000 new devices each day. According to Bob Radvanovsky, one of the Project SHINE researchers, the devices contain buffer overflows, misconfigurations, and cross-site scripting flaws, among other vulnerabilities.

[A global Internet-scanning project focused on finding SCADA/ICS equipment and systems accessible via the public Internet is discovering some 2,000 to 8,000 new exposed devices each day. See Project SHINE' Illuminates Sad State Of SCADA/ICS Security On The Net .]

The good news is that patching DNP3-based systems doesn't come with the baggage and risk of patching a PLC or other plant-floor system, where patching comes with risk of shutting down critical systems if a newly patched system goes awry. "It wouldn't be that much of a headache. I think that's an important point: We're not talking about the systems in the substations. We're talking about the master servers," says Ralph Langner, founder of Langner Communications, an ICS/SCADA consultancy. "It's like average IT equipment running a Microsoft OS."

And it's a relatively small number of "master" systems that are set up with redundant systems so that taking one down doesn't take down an entire plant, notes Digital Bond's Peterson. "I would expect to see something like this being patched. There's no excuse not to ... I expect over the next year or two a large percentage will apply the patches."

Next Page: Patch Missteps

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-24285
PUBLISHED: 2021-04-12
INTELBRAS TELEFONE IP TIP200 version 60.61.75.22 allows an attacker to obtain sensitive information through /cgi-bin/cgiServer.exx.
CVE-2021-29379
PUBLISHED: 2021-04-12
** UNSUPPORTED WHEN ASSIGNED ** An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover pa...
CVE-2015-20001
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory ...
CVE-2020-36317
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the sam...
CVE-2020-36318
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.