Vulnerabilities in Protocol Gateways Can Facilitate Attacks on Industrial Systems

guest · Aug 6, 2020

Vulnerabilities in Protocol Gateways Can Facilitate Attacks on Industrial Systems
August 5, 2020
https://www.securityweek.com/vulner...ays-can-facilitate-attacks-industrial-systems

Protocol gateways are small devices designed to ensure that various types of IT and OT devices can communicate with each other even if they use different protocols. For instance, they can translate traffic sent on the same protocol but on two different physical layers (e.g. TCP to RTU), translate traffic on the same physical layer but different protocols (e.g. Modbus RTU to Profibus), or translate traffic on different physical layers and protocols (e.g. Modbus TCP to Profibus).

Threat actors could target protocol gateways for several reasons.
For instance, they can cause serious disruption if the device fails to properly translate traffic. Secondly, protocol gateways are less likely to be monitored by security products, making it less likely that the attack will be detected. And since translation issues are not easy to diagnose, an attack can be very stealthy.
Click to expand...

Trend Micro researchers showed that the Nexcom device’s failure to handle the malformed packets — the packets should have been dropped or fixed before being translated — can be exploited by an attacker to bypass firewalls and send malicious requests to the devices connected to the protocol gateway.

The researchers have found vulnerabilities in the Moxa device that an attacker could exploit to gain access to the I/O mapping table, manipulate processes, and cause disruption

“By themselves, protocol gateways are likely not directly involved in the product or the output of a facility. However, they are a crucial link in the flow of information between different sensors, interfaces, devices, and machinery within a facility,” Trend Micro said.
Click to expand...

Trend Micro: Lost in Translation: When Industrial Protocol Translation goes Wrong

In our research, we wanted to see if a small flaw in the protocol translation’s design could result in critical issues for the whole production network. We found that subtle attacks could potentially result in significant impact without being noticed. This issue highlights that in an industrial facility, security coverage should also include these often overlooked devices.

For more on protocol translation device vulnerabilities and threat scenarios, as well as detailed security recommendations for protecting protocol gateways, read the research paper [...]
Click to expand...

Log in or Sign up

Vulnerabilities in Protocol Gateways Can Facilitate Attacks on Industrial Systems

guest Guest

Log in or Sign up

Vulnerabilities in Protocol Gateways Can Facilitate Attacks on Industrial Systems

guest Guest

Useful Searches