The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor · Mar 13, 2018

OSIsoft PI Data Archive

Original release date: March 13, 2018
MITIGATION

OSIsoft recommends that customers upgrade to PI Data Archive 2017 R2. Obtain the update from OSIsoft.

OSIsoft has released the following advisory:
Click to expand...

ronjor · Mar 13, 2018

OSIsoft PI Vision

Original release date: March 13, 2018
MITIGATION

OSIsoft recommends that users upgrade to PI Vision 2017 R2 Update 1. Obtain the update from OSIsoft.

OSIsoft has released the following alert:
Click to expand...

ronjor · Mar 13, 2018

OSIsoft PI Web API

Original release date: March 13, 2018
MITIGATION

OSIsoft recommends that users upgrade to PI Vision 2017 R2 Update 1 or PI AF Services 2017 R2 Update 1, which both address the PI Web API vulnerabilities. OBtain the updates from OSIsoft.
Click to expand...

ronjor · Mar 13, 2018

GE Medical Devices Vulnerability

Original release date: March 13, 2018
OVERVIEW
This advisory was originally posted to the HSIN ICS-CERT library on February 6, 2018, and is being released to the NCCIC/ICS-CERT website.
Independent researcher Scott Erven submitted information regarding the potential use of default or hard-coded credentials in multiple GE Healthcare products. Following the researcher’s report, GE performed a self-assessment and validated that multiple GE Healthcare products use default or hard-coded credentials. GE has reviewed capability to change passwords identified by the researcher within the product documentation, and users are advised to contact GE Service for assistance in changing passwords.

Vulnerability information about the affected products is publicly available.
Click to expand...

ronjor · Mar 15, 2018

Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors

Original release date: March 15, 2018
Systems Affected

Domain Controllers
File Servers
Email Servers

Overview

This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). This alert provides information on Russian government actions targeting U.S. Government entities as well as organizations in the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors. It also contains indicators of compromise (IOCs) and technical details on the tactics, techniques, and procedures (TTPs) used by Russian government cyber actors on compromised victim networks. DHS and FBI produced this alert to educate network defenders to enhance their ability to identify and reduce exposure to malicious activity.

DHS and FBI characterize this activity as a multi-stage intrusion campaign by Russian government cyber actors who targeted small commercial facilities’ networks where they staged malware, conducted spear phishing, and gained remote access into energy sector networks. After obtaining access, the Russian government cyber actors conducted network reconnaissance, moved laterally, and collected information pertaining to Industrial Control Systems (ICS).

For a downloadable copy of IOC packages and associated files, see:
Click to expand...

ronjor · Mar 20, 2018

Geutebruck IP Cameras

Original release date: March 20, 2018
MITIGATION
Geutebrück recommends G-Cam/EFD-2250 users download and update to the newest firmware version, 1.12.0.19, by registering for a new WebClub account, or by logging into an existing account at the following location:
Click to expand...

ronjor · Mar 20, 2018

Siemens SIMATIC, SINUMERIK, and PROFINET IO

Original release date: March 20, 2018
MITIGATION
Siemens has provided the following updates for mitigations:
Click to expand...

ronjor · Mar 20, 2018

Siemens SIMATIC Industrial PCs (Update A)

Original release date: February 27, 2018 | Last revised: March 20, 2018
UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-18-058-01 Siemens SIMATIC Industrial PCs that was published February 27, 2018, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Mar 20, 2018

Siemens SIPROTEC 4 and SIPROTEC Compact (Update F)

Original release date: July 06, 2017 | Last revised: March 20, 2018
UPDATE INFORMATION
This updated advisory is a follow-up to the updated advisory titled ICSA-17-187-03E Siemens SIPROTEC 4 and SIPROTEC Compact that was published January 4, 2018, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Mar 20, 2018

AutomationDirect CLICK, C-More, C-More Micro, Do-more Designer, GS Drives, SL-Soft SOLO (Update A)

Original release date: November 09, 2017 | Last revised: March 20, 2018
UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-17-313-01 AutomationDirect CLICK, C-More, C-More Micro, GS Drives, and SL-Soft SOLO that was published November 9, 2017, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Mar 22, 2018

Siemens SIMATIC WinCC OA UI Mobile App

Original release date: March 22, 2018
MITIGATION
Siemens has provided the following updates for mitigation:
Click to expand...

ronjor · Mar 22, 2018

Beckhoff TwinCAT

Original release date: March 22, 2018
MITIGATION
Beckhoff recommends users update to the newest version and recompile Matlab modules after updating.
Please see Beckhoff Security Advisory 2018-001 at the following location for more information:
Click to expand...

ronjor · Mar 22, 2018

Siemens Desigo PXC (Update B)

Original release date: January 25, 2018 | Last revised: March 22, 2018
UPDATE INFORMATION
This updated advisory is a follow-up to the updated advisory titled ICSA-18-025-02A Siemens Desigo PXC that was published February 6, 2018, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Mar 27, 2018

Schneider Electric Modicon Premium, Modicon Quantum, Modicon M340, and Modicon BMXNOR0200

Original release date: March 27, 2018
MITIGATION
Schneider Electric recommends that users follow the instructions outlined in the Modicon Controllers Platform - Cyber Security, Reference Manual (link is external) to install Modicon PLCs securely.
Schneider Electric also recommends that affected users disable FTP services on the device during times when maintenance or configuration activities are not needed.
For more information please see Schneider Electric’s security notification SEVD-2018-081-01 at:
Click to expand...

ronjor · Mar 27, 2018

Philips Alice 6 Vulnerabilities

Original release date: March 27, 2018
OVERVIEW
Philips has identified improper authentication and missing encryption of sensitive data vulnerabilities in the Philips Alice 6 System product. Philips scheduled a new product version release and supporting product documentation in December 2018. For all users of the Alice 6 System product, Version R8.0.2 or prior, Philips will update the devices to R8.0.3. This update introduces encryption of data in transit, encryption of data at rest, and transmission of clear text usernames and passwords.
Click to expand...

ronjor · Mar 29, 2018

Philips iSite/IntelliSpace PACS Vulnerabilities

Original release date: March 29, 2018
OVERVIEW
Philips has confirmed that Philips iSite and IntelliSpace PACS contain security vulnerabilities, predominantly in third-party components. Philips is providing users a number of potential options to remediate these identified vulnerabilities.
Click to expand...

ronjor · Mar 29, 2018

WAGO 750 Series

Original release date: March 29, 2018
MITIGATION
WAGO has released new firmware addressing this vulnerability that can be obtained by contacting WAGO support via email at support@wago.com.
If updating the firmware is not feasible WAGO recommends that users disable the WAGO Service Communication via WBM or limit the access to Ports 6626 and 2455/TCP/IP to trusted devices.
Click to expand...

ronjor · Mar 29, 2018

Siemens TIM 1531 IRC

Original release date: March 29, 2018
MITIGATION
Siemens recommends updating to version 1.1 as soon as possible. The update can be found at the following location on the Siemens website:
Click to expand...

ronjor · Mar 29, 2018

Siemens SIMATIC PCS 7, SIMATIC WinCC, SIMATIC WinCC Runtime Professional, and SIMATIC NET PC Software

Original release date: March 29, 2018
MITIGATION
Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk:
Click to expand...

ronjor · Apr 3, 2018

Siemens Building Technologies Products

Original release date: April 03, 2018
MITIGATIONS
Siemens recommends that users upgrade License Management System (LMS) to version 2.1 SP4 (2.1.681) or newer. To do so, users should contact the local Siemens representative or Siemens customer support.
Click to expand...

ronjor · Apr 5, 2018

LCDS – Leão Consultoria e Desenvolvimento de Sistemas Ltda ME LAquis SCADA

Original release date: April 05, 2018
4. MITIGATIONS

LCDS recommends that users update to version 4.1.0.3774, which can be found at the following location:
Click to expand...

ronjor · Apr 5, 2018

Moxa MXview

Original release date: April 05, 2018
4. MITIGATIONS

Moxa has developed a new version of MXview to mitigate the vulnerability. MXview versions 2.9 can be downloaded from the Moxa Support Website (link is external).
Click to expand...

ronjor · Apr 5, 2018

Rockwell Automation MicroLogix

Original release date: April 05, 2018
4. MITIGATIONS

Rockwell Automation has recommended that users employ the following mitigation strategies where applicable:
Click to expand...

ronjor · Apr 5, 2018

Siemens SCALANCE W1750D, M800, and S615 (Update A)

Original release date: November 28, 2017 | Last revised: April 05, 2018
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-17-332-01 Siemens SIMATIC SCALANCE W1750D, M800, and S615 that was published November 28, 2017, on the NCCIC/ICS-CERT website.
Click to expand...

ronjor · Apr 5, 2018

Siemens Building Technologies Products (Update A)

Original release date: April 03, 2018 | Last revised: April 05, 2018
2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-18-093-01 Siemens Building Technologies Products that was published April 3, 2018, on the NCCIC/ICS-CERT website
Click to expand...

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Useful Searches