Over the last few days, cybersecurity journalists and the ICS security community have been discussing the Oldsmar Florida water system cyber attack, almost ad nauseam. While many people have been talking about this “news” topic, we’ve actually been treating this issue with many of our customers over the past few years. In this post, I will explain what we’ve learned from this cyberattack, but most importantly, I will share how we’ve been busy solving these issues over the last few years with actual examples from our range of industrial cybersecurity products.

The Oldsmar Water Facility Attack

On February 5th, a hacker gained access into the water treatment system of Oldsmar, Florida, and hijacked the plant’s operational controls. He was able to temporarily drive up the sodium hydroxide content in the water to poisonous levels. The Oldsmar facility is the primary source of drinking water for the city’s 15,000 residents. Luckily, a plant operator was able to return the water to normal levels. The incident has nonetheless launched many conversations about the state of security in global critical infrastructure.

But that wasn’t the whole story.

A security advisory released earlier this week by the state of Massachusetts’s Department of Environmental Protection, referred to additional unsafe practices or behaviors at the Oldsmar water treatment plant that significantly increased the risk further. Like many other facilities of its kind, Oldsmar uses a SCADA (Supervisory Control And Data Acquisition) system that allows staff to monitor and control conditions within the facility. At the same time, the staff was using TeamViewer, a fairly common remote access program, which can be used to monitor and control systems within the SCADA network. Sadly, cybersecurity was not a priority for the facility, as is the case occasionally with critical infrastructure. Not only was the Oldsmar facility using Windows 7 – an outdated software that is no longer supported by Microsoft, but all of their employees shared the same password to access TeamViewer. Additionally, the facility was connected directly to the internet without any type of firewall protection installed.

The Current Situation With Water Systems

In the United States alone, there are about 54,000 distinct drinking water systems. The vast majority of those systems serve less than 50,000 residents. They mainly rely on some type of remote access to monitor and/or administer their facilities. Many of their facilities are also unattended, underfunded, and do not have someone watching the IT operations 24/7. Finally, many facilities have not separated their OT (operational technology) networks from their safety systems that are in place in order to detect intrusions or potentially dangerous changes by threat actors.

While the attempt was spotted and taken care of by a plant operator before it could do any damage, it raises questions about how serious a threat this sort of terrorist or nation-state action could be in the future.

Why Don’t We See More Stories Like This On The News?

So, despite how easy it is to find ways to remotely interact with such OT networks, we aren’t seeing more incidents like the one in Oldsmar making the news. One reason may be that these facilities don’t have to disclose such events right when they happen. Additionally, many companies, especially in the public sector want to avoid bad publicity and do what they can to avoid their company name smeared in cyber-attack news headlines. We’ve seen many companies, especially publicly traded companies lose stock value and brand trust after a cyberattack.

But the main reason you don’t see more of these attacks on the news is that SCADAfence protects many of these critical infrastructure facilities. 

Over the last seven years, SCADAfence has been working with many critical infrastructure organizations, including water & wastewater facilities to keep their OT networks safe. We do this by providing them with full network visibility, we accurately detect any anomalous behavior and malicious activities – including anomalies that originate in remote access. We were ready for 2020 before remote access security was required (due to the lockdowns) and it’s been paying off dividends.

Here’s How SCADAfence Secures Water Treatment Facilities  

Let me show you a few key examples, (with actual screenshots) of how we have prevented identical attacks over the last seven years for our customers.

1. With the SCADAfence Platform’s continuous network monitoring we have been easily been able to detect any remote access into OT networks, specifically, detailed alerts for TeamViewer connections in OT networks.

2. We also immediately alert on value level changes, once they pass a certain threshold to prevent unauthorized changes or process manipulation. The platform is also so flexible that users can create specific firewall-like rules for variables such as this one: “Sodium Hydroxide ppm Anomalous Value” alert. This will raise an alert in case the value of Sodium Hydroxide in the water exceeds the max value of (for example) 40 ppm (parts per million) or goes below 1 ppm.

3. The SCADAfence Platform also provides visual exposure maps that can spot malicious activities – weeks, or even months in advance. At another similar incident (that didn’t hit the news), we monitored a water treatment facility during normal operations. As you can see in the screenshot below, there was no connectivity between the remote access group and the DMZ group.

During an attack on the facility, the security team was immediately able to see new connections forming from the remote access group to the DMZ group and from the DMZ to the operator network group (see below). As soon as that alert was issued, the security team was notified of that change and the remote access connection was disconnected, stopping the attackers immediately.

4. It’s really easy to set automated rules that will alert in case there is connectivity between specific network groups. In this case, we set an alert if there is a connection from the DMZ to the operator network and a similar rule in case there is a connection from the remote access to the DMZ group.

5. This incident at Oldsmar, highlights what we’ve been saying for years. Remote access in OT networks provides a big risk. And the thing is, remote access is not going away.

The SCADAfence platform also provides security staff with the correlation between their users and their activities while performing remote work.

In addition to alerts on anomalous or unauthorized actions in the OT network, the SCADAfence Platform provides security teams with the association details – including the user name, the originating workstation, and the application to provide a holistic view into remote access activities, hop-to-hop.

6. This also ties into the issue of compliance with industrial standards. SCADAfence offers a governance portal that enables operators to define compliance enforcement policies, and continuously monitor compliance enforcement status for most ICS standards, frameworks, and regulations.

Don’t Be Scared, Be Prepared

Many water & wastewater utilities are already using continuous network monitoring and remote access technologies to get visibility into their OT networks and keep their critical infrastructure networks secure.

With this holistic approach, of network monitoring, anomaly detection, remote access visibility, and compliance, many water & wastewater are already reducing 95% of their risk level of future attacks.

The best part is that these solutions are all agentless, are not intrusive, and can perform superhuman tasks at a fraction of the cost of one human worker.

If your organization is looking into securing their industrial networks, the experts at SCADAfence are seasoned veterans in this space and can show you how it’s done.

To learn more about these products and see short product demos, click here: https://l.scadafence.com/demo

This Week, Ransomware Slams Westrock & Other Industrial Organizations

Earlier this week, the operations at $17 billion packaging firm WestRock were disrupted by a ransomware attack that impacted both its IT and OT (operational technology) networks. Two days later, a massive $27 billion chain operator Dairy Farm Group was also attacked by ransomware, with the attackers demanding a $30 million ransom. Those are just a sample of successful ransomware attacks from this week alone. 

Our Researchers Discover Another Vulnerability 

As part of our mission to secure the world’s OT, IoT and Cyber Physical infrastructures, we invest resources into offensive research of vulnerabilities and attack techniques.

CVE-2020-24685 is a CVSS 8.6 (CVSS v3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) remote CPU DoS vulnerability in all of ABB’s AC500 V2 products with onboard ethernet are affected by this vulnerability (with latest firmware v2.5.4) that has been discovered by SCADAfence researcher Yossi Reuven.

ABB is one of the world’s leading electronics and electrical equipment manufacturing companies (holding an overall share in the world DCS market of 19.2%), and is in use by many of our customers. 

About The Vulnerability – CVE-2020-24685

AC500 V2 Series is one of ABB’s PLC offerings – designed as a compact entry-level PLCs for small applications. AC500 V2’s communication with Automation Builder (Engineering software package) is done via ABB proprietary wrapper protocol encapsulation of CoDeSys SDE protocol (which works on both TCP and UDP). 

A single specially crafted packet sent by an attacker over the ABB protocol on port 1200 will cause a denial-of-service (DoS) vulnerability. The PLC’s CPU will get into fault mode, causing a hardware failure. The PLC then becomes unresponsive and requires a manual (physical) restart to recover. In addition, the buffer overflow condition may allow remote code execution.

What SCADAfence Recommends Asset Owners To Do

Perform an Industrial Vulnerability Management Process

Please refer to our guide on this topic: https://www.scadafence.com/public-preview-a-comprehensive-guide-to-industrial-device-patching/

Monitor for Unauthorized Network Activity and Exploitation

Some devices will always remain unpatched. Monitoring is an early warning system that allows you to act before attackers have gained full control over your network.

Upgrade to the Latest Firmware

ABB has developed a new firmware version 2.8.5 fixing this vulnerability. This firmware version is released for the following affected PLC types:
* PM573-ETH
* PM583-ETH

Currently no firmware update is available to other products in the AC500 V2 line. When ABB makes such a patch available, we recommend asset owners to consider upgrading.

Prevent Unauthorized and Untrusted Access

– Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.

– Use within a LAN and block access from untrusted networks and hosts through firewalls.

Special Thanks & Recognition

The SCADAfence Research team would like to thank the ABB team for the collaboration.

SCADAfence is committed to continued research of offensive technologies and development of new defensive technologies.

Exploit PoC

We wrote a Python POC (GPLv3) script of the exploit in action.

Currently, there’s no patch available. As a result, we limit the access to the exploit to vetted individuals only. The exploit is only available for educational and legal research purposes.

Warning: The script will crash the PLC’s CPU – do not use it in production.

To get this free python exploit, please send an email to research@scadafence.com, identify yourself and explain how you’re going to use the exploit. We reserve the right to refuse any request.

What a year.

What a year this has been to humanity, an epidemic has fundamentally changed the way we interact with one another, social distancing, lockdowns and restrictions in virtually everything we do. Covid-19 has changed the way we conduct business and shifted the way we secure our businesses.

Adversaries’ activities are at an all-time high, be it nation state actors or financially driven attackers. The ever-changing threat landscape is evolving faster than ever and OT networks and IoT devices are a core target for such malicious activities. Repeated attacks from threat actors sponsored by nation-states, such as the recent SolarWinds attack on Microsoft, FireEye, the US government, and around 18,000 other organizations, have prompted fears not only of significant physical damage and economic disruption but also of the increased possibility of all-out cyber warfare. You could describe the situation as an all-out war, only with no guns involved and not a single bullet shot.

In the midst of all of this, we felt that it is imperative to support the broader community and so with the outbreak of Coronavirus earlier this year, we offered all of our products for free for an initial term. And today, we are honored to protect some of the world’s largest organizations in manufacturing and critical infrastructure. In fact, the Japanese government publicly praised SCADAfence’s efforts to secure multiple Japanese organizations, completely free of charge.

Despite the Covid-19 pandemic and possibly because of the recent spike in attacks, our team at SCADAfence has managed to sustain our exponential growth and the continued scaling of our global footprint with rapid expansion in new markets, such as LATAM and APAC.

This rapid expansion can also be attributed to our technological advancements and innovation. Launching new features based on customers’ real needs, such as our User Activity Tracking, a feature that was built specifically for the new, work from home norm; and the SCADAfence Governance portal, which centrally monitors the adherence to industry standard and regulations.

One of the things we’ve always taken pride in is putting our customer’s needs as our top priority. To that end, SCADAfence has won 11 industry awards in 2020, more than all companies in the OT security industry combined – but that all pales in comparison to having the highest customer satisfaction rating on Gartner’s Peer Insights. Not to mention the feedback we’ve been receiving from our customers, here’s just one example:

 “SCADAfence has well exceeded all of our expectations in both service level and product quality. Their team has been extremely knowledgeable, customer-focused, and timely in all aspects of our interactions.”

Process Controls Engineer at a Fortune 100, O&G company.

There’s no doubt that 2020 has been a challenging year but also a year full of growth, dedication and grit. I’d like to thank our entire team for all their hard work, efforts and creativity. A big thank you to all of our partners and of course, our customers for choosing to work with us, it’s not a given and never will be.

If you’ve made it this far and even if you did not, I’d like wish you a great 2021!

Enjoy the holiday season and stay safe.

Happy new year!

SunBurst – The Cyber Attack on SolarWinds

SunBurst is a cyber espionage campaign that leveraged a supply chain attack on SolarWinds, a leading supplier of network management software. Between March and May 2020, the attackers gained access to SolarWinds’ build system, added a malicious DLL (library) file, and distributed it to 18,000 SolarWinds Orion customers.

The malicious file allowed remote control of the target host, while leveraging advanced evasive tactics. Using this access point, the attackers were able to hack into organizations with well-established security practices such as Cisco and Microsoft. These organizations failed to detect the attack before FireEye (who was also attacked) made it public.

A targeted attack at this scale doesn’t happen very often. It’s a rare event that should shake both enterprises and the security community. The fact that this campaign went undetected for such a long period of time (6+ months), proves that something is fundamentally wrong with the way that computer networks are protected.

The success of this attack campaign, versus other campaigns, is built upon two factors:

1. First and foremost, this is not a coincidence. This is a team of highly skilled attackers who made all of it possible. The campaign shows world-class planning, knowledge, experience and attention to detail.
2. SolarWinds Orion is a network management product. Due to its role, it has a number of advantages as an attack source, vs. other types of attack sources:
   1. It’s whitelisted to perform reconnaissance (network monitoring) in many security tools – This tool is designed to perform reconnaissance, so no one will suspect when the tool does what it was designed to do.
   2. From SolarWindows Orion’s perspective in the network, the network is usually flat. Regardless of how many network segments are there, the component in Orion that scans the network requires direct network access to the target devices, so enterprises allow this traffic through their firewalls. This allows unique network access from the initial access point.
   3. SolarWinds Orion commonly has access to certain admin credentials that make it possible to move laterally.

The Supply Chain Risk

The supply chain risk to both enterprises and government organizations has been discussed in the last few years. The attack on SolarWinds is one of the most powerful examples of the supply chain risk. It joins a list of similar events such as the attack on Target in 2013. Supply chain attacks exploit trusted third-parties to enable access to a large number of attack targets in parallel. By using that trust, such as the trust organizations put on SolarWinds software updates, it’s easier to obtain access rather than attacking each target separately and directly.

Supply Chain Certification

The United States DoD (Department of Defense) is one of the government organizations that took far-reaching steps to reduce the supply chain risk. In October 2016, the DoD first issued a supplement to the DFARS regulation, that introduced cyber security requirements for DoD suppliers. In November 2020, only a month before the supply chain attack on SolarWinds, the DoD made another major addition to DFARS. This addition is called CMMC or the Cybersecurity Maturity Model Certification.

The CMMC includes a few non-linear improvements vs. the original DFARS supplement, in multiple categories:

1. Third-party certification of suppliers by approved parties (C3PAOs) instead of self-certification.
2. Certification is mandatory to be able to participate in RFIs and RFPs, meaning that it can affect the supplier’s revenue.
3. CMMC has a 5-levels maturity model.
4. There are 154 new requirements out of 171 in CMMC (vs. the original DFARS supplement), and they’re spread across the 5 levels of maturity.
5. Reporting of compliance status in an online portal. This means that the DoD can monitor compliance of the entire DIB (Defense Industrial Base – the regulated organizations).

By introducing CMMC, the DoD conveys a clear message to DoD suppliers: We want you to be secure. And if you’re not secure enough, you cannot work on defense projects. Find another niche that’s less critical. If you want to work with the DoD, these are our requirements.

The question is: Should enterprises follow a similar path? Should a supply chain certification model be the standard in enterprise RFIs and RFPs?

The Pros and Cons of Supply Chain Certification

There are a few pros and cons to consider when discussing supply chain certification.

Pros:

• Increased security of the supply chain using financial incentives.
• Competition between suppliers on security maturity levels – Enterprises will start ranking suppliers based on a new metric.
• Transparency in security maturity levels. “Are you a Level 3 Security supplier or a Level 5 Security supplier?”
• Following a cyber attack, the certification might be re-evaluated. If major violations are found, the certification can be voided.

Cons:

• How much is this going to increase the prices of goods and services? And is it worth it?
• The certification can end up being another checkbox, where it has high costs and provides no security value.
• Smaller suppliers might find it difficult or impossible to be certified within their resources, which will create a bias toward larger organizations.
• Do enterprises have a large enough negotiation power, similar to that of the DoD, to pose such requirements on suppliers?

 

Our Predictions

We see a clear path to how supply chain certification becomes mainstream in the next years. With the DoD adopting CMMC, certain suppliers will have a CMMC certifications. They can then use their CMMC certification as a competitive advantage in non-DoD deals.

The DoD kickstarted this program, defined the requirements, and laid out the infrastructure (C3PAOs, RPs, etc). That allows the entire world to adopt CMMC – other government bodies and enterprises can easily adopt it at a low cost.

If the CMMC certification will be perceived as an efficient risk reduction strategy, and that there’s nothing fundamentally wrong about it, this (or a similar) model is going to expand into additional industries.

The SCADAfence Governance Portal is a compliance monitoring automation platform from SCADAfence, that automatically monitors your network’s compliance with the major cyber security standards and regulations. If you’re interested in learning more about how to measure and increase your security program maturity, please visit this page for a short demo about this product.

SCADAfence Researchers Discover A Sensitive Information Leak Vulnerability in Canon Printers As part of our mission to secure the world’s OT, IoT and Cyber Physical infrastructures, we invest resources into offensive research of vulnerabilities and attack techniques. CVE-2020-16849 is a remote information disclosure vulnerability in Canon printers that was discovered by SCADAfence researchers Maayan Fishelov, Dan Haim and Ofer Shaked. The vulnerability allows a remote attacker to leak the address book and administrator password, unauthenticated, over the network. Canon is one of the world’s leaders in cameras, photocopiers, printers and broadcasting equipment. SCADAfence has been working with Canon for the last few months in handling this vulnerability, and on October 1st, Canon published an official security advisory reporting this vulnerability and its mitigations. About The CVE-2020-16849 Vulnerability The vulnerability exists inside the printer’s IP protocol stack, which is used by Canon Laser Printers and Small Office Multifunctional Printers. The potential for a third-party attack exists on the devices when they’re connected to a network that allows fragments of the “Address book” or/and “administrator password” to be acquired through an unsecured network. It should be noted that when HTTPS is used for the communication of Remote UI, data is secured by encryption. To date, there have been no confirmed cases of the vulnerability being exploited to cause harm. However, in order to ensure that Canon’s customers can use their products securely, new firmware will be available for affected Canon products.

What SCADAfence Recommends Vendors To Do

Prevent Unauthorized and Untrusted Access – Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required. – Use within a LAN and block access from untrusted networks and hosts through firewalls.   Perform an IoT Vulnerability Management Process Tools such as the SCADAfence IoT Security platform can help you identify vulnerable devices. Monitor for Unauthorized Network Activity and Exploitation Some devices will always remain unpatched. Monitoring is an early warning system that allows you to act before attackers have gained full control over your network. Upgrade to the Latest Firmware Canon issued a new firmware that users are able to upgrade to.   Special Thanks & Recognition The SCADAfence Research team would like to thank the Canon team for a speedy vulnerability reporting process even during the challenging COVID-19 times. SCADAfence is committed to continued research of offensive technologies and development of new defensive technologies.   Exploit PoC We wrote a Python POC (GPLv3) script of the exploit in action. The exploit is only available for educational and legal research purposes. Warning: The script might crash the printer – do not use it in production. To get this python exploit, please send an email to research@scadafence.com, identify yourself and explain how you’re going to use the exploit. We reserve the right to refuse any request.

The first Israeli high-tech delegation to the Emirates departed this morning (Sunday), led by Jerusalem Venture Partners Fund and entrepreneur Erel Margalit. Over the next four days, the delegation is set to hold high-level meetings with senior officials as well as innovation and investment counterparts in Dubai and Abu Dhabi, to build cooperation between Israeli and Emirati hi-tech, and deepen the newly found relationship between the two countries.

Erel Margalit, CEO and founder of the Jerusalem Venture Partners (JVP), February 18, 2019. / Hadas Parush/Flash90

On Tuesday, participants will join first of their kind ’round table’ meetings between entrepreneurs from the two countries– both of which are renowned internationally as leaders in the field. Ahead of the visit, the delegation was honored to have received the warm welcome of the UAE Government and was looking forward to the opportunity to meet senior ministers during the visit.

“Hi-tech is the locomotive engine that leads the Israeli economy, so we have a key role in leading relations and cooperation with the Emirates, with an emphasis on partnership,” commented JVP founder and chairman of Margalit Startup City Erel Margalit.

He added, “I am proud to lead the first Israeli hi-tech delegation to the Emirates. Our companies have been in business contact with the Emirates for a number of years, and now an opportunity has arisen to expand this network of relationships, deepen the ties significantly, and allow more and more Israeli companies and entrepreneurs to be part of this connection and success.”

Margalit stressed, “This is not just a business opportunity, but a political opportunity for a new page between the Israeli hi-tech community and the entire Middle East. With us in the delegation, are the CEOs of emerging Israeli hi-tech companies from every field, and I am sure we will create real partnerships here that will contribute to building successful Israeli companies that will propel the Israeli economy forward, precisely during this period, and create more and more new jobs.”

The delegation was invited to the Emirates by the DIFC (Dubai International Financial Center), the body that manages the free trade area in the financial heart of Dubai – which is one of the global financial centers. Members of the delegation will also receive a comprehensive tour of the financial center.

Among the companies participating in the delegation: Earnix, one of the world’s leading companies in insurtech and personalization of insurance and banking, an area with great interest in the Emirates, which is considered a powerhouse in the field of insurance in the Middle East; Up Control, an emerging Israeli company leading a revolution in the management of remote work networks; Morphisec, from Beer Sheva, which is a leader in innovative technology for protecting endpoints in organizations, which is a particularly relevant development for the protection of banks and infrastructure; and Secret Double Octopus, also from Beer Sheva, which provides a leading biometric solution for passwords.

Also of significant interest to the Emirati Government, companies, and investors is the field of foodtech. Among the delegation in the field is InnovoPro, a company that produces a protein substitute from chickpeas with high nutritional values. One of the most interesting companies in the world in the field, it is already a major player in dairy products in some of Europe’s leading chains, with products from ice-cream to mayonnaise. The company is now preparing for a breakthrough in the Middle East. Another company participating in the delegation is Agrint, which has developed technology to identify diseases in trees before they cause damage. One of the most serious infections in the world is the palm bacteria that destroys entire palm groves. Agrint’s solution for this has significant potential for agriculture in the Middle East.

Members of the delegation included: Entrepreneur, and former senior official in the Mossad, David Meidan; Udi Ziv, CEO of Earnix; FrankZvi, CEO of Copilot; Elad Ben-Meir,-CEO of SCADAfence; Dror Liwer – Co-Founder& Chief Security Officer of Coronet; Asaf Ganot, CEO of Control Up; Omri Kohl, CEO of Pyramid Analytics; Gal Rimon, CEO of Centrical; Ronen Yehoshua, CEO of Morphisec; Raz Refaeli, CEO of Secret Double Octopus; Mark Gazit, CEO of Thetaray; Yaron Ravkaie, CEO of Teridion; Tali Nehushtan, CEO of InnovoPro; Yehonatan Ben Hamozeg, CEO of Agrint; they were joined by JVP partners Yoav Tzruya, Fiona Darmon, Gadi Porat, Michal Drayman, and Rinat Remler, senior VPs Shimrit Kenig, Guy Pross, Pnina Ben Ami, and communications director Omri Sheinfeld.

Source from: https://www.jewishpress.com/news/business-economy/first-israeli-hi-tech-delegation-takes-off-for-the-emirates/2020/10/25/

Our Researchers Discover Another Vulnerability 

As part of our mission to secure the world’s OT, IoT and Cyber Physical infrastructures, we invest resources into offensive research of vulnerabilities and attack techniques.

CVE-2020-16850 (US ICS-CERT) is a CVSS 8.6 remote CPU DoS vulnerability in Mitsubishi Electric iQ-R Series that has been discovered by SCADAfence researcher Yossi Reuven.

Mitsubishi Electric is one of the world’s leading electronics and electrical equipment manufacturing companies, and is in use by many of our customers. We have been working with Mitsubishi Electric for the last few months in handling multiple vulnerabilities, and on October 8th, Mitsubishi Electric published an official security advisory reporting this vulnerability and its mitigations.

About The Vulnerability – CVE-2020-16850

MELSEC iQ-R Series is Mitsubishi Electric flagship product line – designed for high productivity automation systems. iQ-R CPUs’ communication with GX Works 3 (Engineering software package) is done via Mitsubishi Electric proprietary protocol MELSOFT (which works on both TCP and UDP).

A single specially crafted packet sent by an attacker over the MELSOFT UDP protocol on port 5006 will cause a denial-of-service (DoS) vulnerability due to uncontrolled resource consumption (CWE-400). The PLC’s CPU will get into fault mode, causing a hardware failure (error code: 0x3C00 – hardware failure). The PLC then becomes unresponsive and requires a manual restart to recover.

What SCADAfence Recommends Vendors To Do

Perform an Industrial Vulnerability Management Process

Please refer to our guide on this topic: https://www.scadafence.com/public-preview-a-comprehensive-guide-to-industrial-device-patching/

Monitor for Unauthorized Network Activity and Exploitation

Some devices will always remain unpatched. Monitoring is an early warning system that allows you to act before attackers have gained full control over your network.

Upgrade to the Latest Firmware (When Available)

Currently no firmware update is available (will be released soon by Mitsubishi Electric)

Prevent Unauthorized and Untrusted Access

– Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.

– Use within a LAN and block access from untrusted networks and hosts through firewalls.

Block UDP Port 5006 and Use MELSOFT TCP

MELSOFT is an engineering software for Mitsubishi PLCs and gives users the option to use either the (connectionless) UDP and (connection-oriented) TCP protocols for programming and configuring the devices. SCADAfence recommends to block Block UDP port 5006 since the cyberattack leverages the connectionless UDP protocol and can cause the PLCs to stop functioning and cause a denial of service. Instead, users should use the TCP protocol for communicating with devices in the shop floor or the control network.

Special Thanks & Recognition

The SCADAfence Research team would like to thank the Mitsubishi Electric team for a speedy vulnerability reporting process even during the challenging COVID-19 times.

SCADAfence is committed to continued research of offensive technologies and development of new defensive technologies.

Exploit PoC

We wrote a Python POC (GPLv3) script of the exploit in action.

Currently, there’s no patch available. As a result, we limit the access to the exploit to vetted individuals only. The exploit is only available for educational and legal research purposes.

Warning: The script will crash the PLC’s CPU – do not use it in production.

Our Researchers Discover Another Vulnerability 

As part of our mission to secure the world’s OT, IoT and Cyber Physical infrastructures, we invest resources into offensive research of vulnerabilities and attack techniques.

CVE-2020-16850 (US ICS-CERT) is a CVSS 8.6 remote CPU DoS vulnerability in Mitsubishi Electric iQ-R Series that has been discovered by SCADAfence researcher Yossi Reuven.

Mitsubishi Electric is one of the world’s leading electronics and electrical equipment manufacturing companies, and is in use by many of our customers. We have been working with Mitsubishi Electric for the last few months in handling multiple vulnerabilities, and on October 8th, Mitsubishi Electric published an official security advisory reporting this vulnerability and its mitigations.

About The Vulnerability – CVE-2020-16850

MELSEC iQ-R Series is Mitsubishi Electric flagship product line – designed for high productivity automation systems. iQ-R CPUs’ communication with GX Works 3 (Engineering software package) is done via Mitsubishi Electric proprietary protocol MELSOFT (which works on both TCP and UDP).

A single specially crafted packet sent by an attacker over the MELSOFT UDP protocol on port 5006 will cause a denial-of-service (DoS) vulnerability due to uncontrolled resource consumption (CWE-400). The PLC’s CPU will get into fault mode, causing a hardware failure (error code: 0x3C00 – hardware failure). The PLC then becomes unresponsive and requires a manual restart to recover.

What SCADAfence Recommends Vendors To Do

Perform an Industrial Vulnerability Management Process

Please refer to our guide on this topic: https://www.scadafence.com/public-preview-a-comprehensive-guide-to-industrial-device-patching/

Monitor for Unauthorized Network Activity and Exploitation

Some devices will always remain unpatched. Monitoring is an early warning system that allows you to act before attackers have gained full control over your network.

Upgrade to the Latest Firmware (When Available)

Currently no firmware update is available (will be released soon by Mitsubishi Electric)

Prevent Unauthorized and Untrusted Access

– Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.

– Use within a LAN and block access from untrusted networks and hosts through firewalls.

Block UDP Port 5006 and Use MELSOFT TCP

MELSOFT is an engineering software for Mitsubishi PLCs and gives users the option to use either the (connectionless) UDP and (connection-oriented) TCP protocols for programming and configuring the devices. SCADAfence recommends to block Block UDP port 5006 since the cyberattack leverages the connectionless UDP protocol and can cause the PLCs to stop functioning and cause a denial of service. Instead, users should use the TCP protocol for communicating with devices in the shop floor or the control network.

Special Thanks & Recognition

The SCADAfence Research team would like to thank the Mitsubishi Electric team for a speedy vulnerability reporting process even during the challenging COVID-19 times.

SCADAfence is committed to continued research of offensive technologies and development of new defensive technologies.

Exploit PoC

We wrote a Python POC (GPLv3) script of the exploit in action.

Currently, there’s no patch available. As a result, we limit the access to the exploit to vetted individuals only. The exploit is only available for educational and legal research purposes.

Warning: The script will crash the PLC’s CPU – do not use it in production.

Hey, I’m SCADAGirl.

I’m a cybersecurity superhero that ensures that OT & IoT networks are safe.

Here is my commentary on the latest headlines in OT & IoT security.

ICS Advisory (ICSA-20-240-01) Red Lion N-Tron 702-W, 702M12-W

 SCADAfence Research – ICS Ethernet Switches used in Industrial Networks by manufacturer Red Lion are exposed to Remote Command Injection. The switches types are 702-W and 702M12-W. Read More 

---

Critical Vulnerabilities Expose MoFi Routers to Remote Attacks

 SCADAfence Research  – IOT Routers made by MoFi network are vulnerable to Remote Code Execution vulnerabilities. The series affected is MOFI4500, which includes several routers which includes WIFI and 4g capabilities. Companies utilizing such routers for mobile or remote connectivity should check their devices for updates. Read More

---

BLURtooth Vulnerability Lets Attackers Defeat Bluetooth Encryption

SCADAfence Research – IOT BLURtooth vulnerability exposes new generations of bluetooth-enabled devices to MITM attacks. Academic researchers have discovered that certain implementations of Bluetooth 4.0 to 5.0 suffer from weak key generation and thus allow MITM to take place. Read More

---

Netwalker Ransomware Hits Pakistan’s Largest Private Power Utility

SCADAfence Research – Netwalker Ransomware hits the largest private power company in Pakistan. The ransomware caused disruption in billing and online services. Read More 

---

Windows Zerologon PoC Exploits Allow Domain Takeover. Patch This Now!

SCADAfence Research – A PoC was released for the Zerologon vulnerability, which allows attackers to gain Domain Admin privileges and take over windows domain environments. The vulnerability CVE-2020-1472 was patched by Microsoft in the last August update. The vulnerability occurs when an attempt to login as a domain administrator is made, and a spoofed response is sent to the client telling the login succeeded. The vulnerability relies on the fact that it is possible to fallback to unencrypted RPC, and after that, using a security flaw found in Netlogon AES-CFB8 cryptographic negotiation. Please read more for the full article & the POC code. Read More 

---

Ransomware Attack at German Hospital Leads to Death of Patient

 SCADAfence Research – Ransomware attack at a German hospital leads to the death of a patient. The ransomware attack lead to the situation where emergency care could not occur at the hospital, and a patient in a life-threatening condition died after being forced to go to a more distant hospital. Read More

---

ICS Advisory (ICSA-13-011-01)

 SCADAfence Research – Devices running CoDeSys are vulnerable to read/write any files on devices running it. Also devices running CoDeSys require no authentication by default, making attackers able to change the device configuration. Read More

---

The Windows XP Source Code Was Allegedly Leaked Online

 SCADAfence Research – Windows XP Source code was leaked online, and can be downloaded by a torrent. The leaked source code may help attackers find new, yet unknown, vulnerabilities in, even new, Windows operating systems. Read More 

---

Ransomware Hits US-Based Arthur J. Gallagher Insurance Giant

 SCADAfence Research – US-based Arthur J. Gallagher (AJG) global insurance brokerage and risk management firm confirmed a ransomware attack that hit its systems. Read More 

---

UHS Hospitals Hit by Reported Country-Wide Ryuk Ransomware Attack

 SCADAfence Research – UHS hospitals hit by reported country-wide Ryuk ransomware attack, shutting down a few of its hospitals.

“After 1min or so of this the computers logged out and shutdown. When you try to power back on the computers they automatically just shutdown. “We have no access to anything computer based including old labs, ekg’s, or radiology studies. We have no access to our PACS radiology system.” Read More