The latest research from Forescout’s Vedere Labs explores the state of risk management in operational technology through the lens of 56 insecure-by-design vulnerabilities.
Background
On June 20, Forescout’s Vedere Labs published their latest research findings into operational technology (OT) vulnerabilities titled OT:ICEFALL. This group has been examining vulnerabilities affecting OT security for a few years now and has produced notable findings including: NUCLEUS:13, NAME:WRECK, NUMBER:JACK and AMNESIA:33.
OT:ICEFALL sought to analyze and understand the prevalence and impact of insecure-by-design vulnerabilities in OT products. The researchers took a systemic look at OT risk management. The research notes that many factors complicate OT risk management including the certification of vulnerable products, lack of CVE assignment and supply chains propagating vulnerabilities. In the course of this research, Forescout also disclosed 56 vulnerabilities across nine vendor’s products. A tenth vendor is also affected by four vulnerabilities, but they are still going through the disclosure process.
Analysis
The 56 vulnerabilities are all tied to “insecure-by-design” flaws common in the OT space within the following products:
| Vendor | Impacted Products |
|---|---|
| Bently Nevada | 3700 TDI equipment |
| Emerson | DeltaV Ovation OpenBSI ControlWave BB 33xx ROC Fanuc PACsystems |
| Honeywell | Trend IQ Safety Manager FSC Experion LX ControlEdge Saia Burgess PCD |
| JTEKT | Toyopuc |
| Motorola | MOSCAD ACE IP gateway MDLC ACE1000 MOSCAD Toolbox STS |
| Omron | SYSMAC Cx series Nx series |
| Phoenix Contact | ProConOS |
| Siemens | WinCC OA |
| Yokogawa | STARDOM |
These vulnerabilities can be grouped into four categories:
- Insecure engineering protocols
- Weak cryptography or broken authentication schemes
- Insecure firmware updates
- Remote code execution via native functionality
In a worst case scenario, an attacker with network access to a vulnerable device could exploit some of these flaws to “remotely execute code, change the logic, files or firmware of OT devices, bypass authentication, compromise credentials, cause denials of service or have a variety of operational impacts.” According to Forescout, 35% of the 56 vulnerabilities disclosed could allow for firmware manipulation or remote code execution.
This research harkens back to past industrial attacks, like Industroyer and TRITON, that relied on similar insecure-by-design flaws in their targeted OT environments. It also traces its history to Project Basecamp, an effort by Digital Bonds in 2017 to “highlight and demonstrate the fragility and insecurity of most [supervisory control and data acquisition] SCADA and [distributed control system] DCS field devices.”
Proof of concept
There are no proofs-of-concept available for any of the 56 vulnerabilities disclosed. Because “many of [these vulnerabilities] will remain unpatched in production environments for a significant amount of time,” Forescout did not release any technical details of the individual vulnerabilities discovered through the course of its research.
Vendor response
Forescout does not provide specific details on whether or when any of the vendors will be patching these vulnerabilities. Organizations should monitor for vendor advisories from all of their OT providers.
The Cybersecurity and Information Security Agency has also published an advisory for OT:ICEFALL, along with five Industrial Controls Systems Advisories for some of the affected products. Yokogawa has also issued an advisory for the vulnerabilities in its STARDOM product.
Solution
The best defense for these vulnerabilities at this time is to ensure OT best practices are being followed.
- Assess systems for vulnerable devices
- Segment vulnerable devices, particularly from the internet
- Use secure methods for remote access when that access is necessary to operations
- Keep up to date on patches from vendors and establish remediation practices
- Develop network monitoring rules to block or alert for anomalous traffic
Identifying affected systems
Tenable Research has developed plugins to identify devices that may be vulnerable to the OT:ICEFALL related flaws:
- 500655 - Saia Burgess OT:ICEFALL Multiple Potential Vulnerabilities
- 500656 - Honeywell OT:ICEFALL Multiple Potential Vulnerabilities
- 500657 - Omron OT:ICEFALL Multiple Potential Vulnerabilities
- 500658 - Emerson OT:ICEFALL Multiple Potential Vulnerabilities
Get more information
- Full OT:ICEFALL Report
- CISA Releases Security Advisories Related to OT:ICEFALL (Insecure by Design) Report
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.