Majority of ICS Vulnerabilities Can Be Exploited Remotely

guest · Aug 20, 2020

Majority of ICS Vulnerabilities Can Be Exploited Remotely
August 19, 2020
https://www.infosecurity-magazine.com/news/ics-vulnerabilities-can-be/

New research has found that more than 70% of industrial control system (ICS) vulnerabilities disclosed in the first half of 2020 can be exploited remotely.
The discovery was unveiled in the inaugural "Biannual ICS Risk & Vulnerability Report," released today by Claroty, a global leader in operational technology (OT) security.

The report details the assessment of 365 ICS vulnerabilities published by the National Vulnerability Database (NVD) and 139 ICS advisories issued by the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) during the first half of 2020, affecting a total of 53 vendors.
Click to expand...

Claroty's research team found that ICS vulnerabilities published by the NVD in 2020 increased by 10.3% from the 331 published last year.
Alarmingly, more than 75% of vulnerabilities published in the first half of 2020 were assigned high or critical Common Vulnerability Scoring System (CVSS) scores.

“There is a heightened awareness of the risks posed by ICS vulnerabilities and a sharpened focus among researchers and vendors to identify and remediate these vulnerabilities as effectively and efficiently as possible,” said Amir Preminger, vice president of research at Claroty.
Click to expand...

Claroty: Claroty Biannual ICS Risk & Vulnerability Report: 1H 2020

This report details The Claroty Research Team’s assessment of all industrial control system (ICS) vulnerabilities disclosed during the first half of the year (1H 2020), the challenges they pose to security practitioners, and what conclusions can be drawn from publicly available data.
Click to expand...

guest · Sep 9, 2020

Vulnerabilities in CodeMeter Licensing Product Expose ICS to Remote Attacks
September 8, 2020
https://www.securityweek.com/vulnerabilities-codemeter-licensing-product-expose-ics-remote-attacks

CodeMeter is designed to protect software against piracy and reverse engineering, it offers licensing management capabilities, and it includes security features that provide protection against tampering and other attacks.

Researchers at Claroty have discovered six vulnerabilities in CodeMeter, some of which could be exploited to launch attacks against industrial control systems (ICS), including to shut down devices or processes, deliver ransomware or other malware, or to execute further exploits.
Two of the security holes have been classified as critical, while the rest are considered high severity.

They showed how some of the vulnerabilities can be exploited remotely without authentication to launch denial-of-service (DoS) attacks or achieve arbitrary code execution.
Click to expand...

In a different attack scenario, the experts achieved remote code execution by creating their own CodeMeter API and client, which enabled them to send commands to any device running CodeMeter.

Security advisories for the CodeMeter vulnerabilities found by Claroty have also been published by Wibu-Systems and the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
Siemens and Rockwell Automation have also released advisories describing the impact of these vulnerabilities on their products.
Click to expand...

Claroty has created an online tool that allows users to check if they are running a vulnerable version of CodeMeter. The company has also set up a GitHub page for this project.
Click to expand...

Claroty: License to Kill: Leveraging License Management to Attack ICS Networks

guest · Nov 29, 2020

A critical flaw in industrial automation systems opens to remote hack
November 29, 2020
https://securityaffairs.co/wordpress/111646/ics-scada/automation-systems-opens-flaw.html

Tracked as CVE-2020-25159, the flaw is rated 9.8 out of 10 in severity by the industry-standard Common Vulnerability Scoring System (CVSS) and impacts all versions of EtherNet/IP Adapter Source Code Stack prior to 2.28, which was released on November 21, 2012.

Security researchers from security company Claroty have discovered a critical flaw in Real-Time Automation’s (RTA) 499ES EtherNet/IP (ENIP) stack that could be exploited by a remote attacker to hack the industrial control systems.

“Claroty has privately disclosed details to Real Time Automation (RTA), informing the vendor of a critical vulnerability in its proprietary 499ES EtherNet/IP (ENIP) stack. The vulnerability could cause a denial-of-service situation, and depending on other conditions, could expose a device running older versions of the protocol to remote code execution.” reads the security advisory published by Claroty.
Click to expand...

Claroty: Lingering RTA ENIP Stack Vulnerability Poses Risk to ICS Devices

RTA has identified that this vulnerability was indeed removed in a 2012 code update. However, since many times vendors make a one-time purchase of protocol stacks such as RTA ENIP via an SDK or hardware implementation without buying an additional support package, integrations prior to then may be still vulnerable since they have not been updated.

This does raise some issues that vendors in the ICS and operational technology spaces may need to consider, in particular around the security of third-party software libraries and SDKs.
Click to expand...

Log in or Sign up

Majority of ICS Vulnerabilities Can Be Exploited Remotely

guest Guest

guest Guest

guest Guest

Log in or Sign up

Majority of ICS Vulnerabilities Can Be Exploited Remotely

guest Guest

guest Guest

guest Guest

Useful Searches