printer friendly version

Addressing the SCADA in the room

The industrial and manufacturing spaces are critical to the global economy. They produce the goods and services we rely on every day, from food and clothing to cars and electronics. Disruptions to this space can have far-reaching effects as proven by recent COVID effects on the supply chain. Much like other sectors, they are targeted by cybercriminals for monetary or destructive purposes. However, few other spaces command the breadth of purpose-built and custom devices necessary to function, as the industrial and manufacturing industries. These unique devices create an uncommon risk that must be assessed and understood to fully protect against incoming attacks.

Such attacks can have massive implications, as seen during the Khuzestan Steel Co. attack in June 2022. Khuzestan Steel Co. and two other manufacturers were targeted to disrupt steel production, crippling services across Iran. The attackers who took credit for this attack go by Gonjeshke Darande or Predatory Sparrow. They did so by comprising the Industrial Control System (ICS) Siemens PCS7 Process Control System, manipulating the hydrogen gas density causing structural integrity and massive fires.

Their ability to disrupt steel production is only half the story though. Notice this attack was enabled in part through compromising an ICS system, systems that are easily overlooked in a typical threat assessment. Most OS have routine patching cycles such as ‘Patch Tuesday’, and many major software packages have easy or automated patching mechanisms. On the other hand, ICS are typically not front-and-centre like desktop software but are mounted somewhere within the facility – making them much more troublesome to update and patch regularly. This attack is just one example showing how the impact of ignoring such ICS systems can be catastrophic.

Assessing the current threat landscape

In order to understand what risks are unique to industry and manufacturing, our team curated 120 different publicly disclosed vulnerabilities in the Supervisory Control and Data Acquisition (SCADA) or ICS space. We specifically looked at those that were disclosed since the beginning of 2023, enabling us to narrow the focus on current systems that are in production or in planning for implementation. Some systems may in fact be older, but generally the approach had the intended effect.

There are two great sources of vulnerability information that the team used as primary sources:

• National Vulnerability Database (NVD, https://nvd.nist.gov/).

• CS Advisories from CISA (https://www.cisa.gov).

We first used NVD for its simple-to-use search functionality. To ensure that we only had information relevant to industry and manufacturing, we filtered our results to only include instances of SCADA and then ICS.

This filter is only a text matching filter, so the team then manually reviewed each result so that only the desired results remained. CISA Advisories have similar value, albeit more tailored. Again, not all ICS systems are typically found within the industry and manufacturing space, so we manually reviewed each advisory to keep the results relevant. There is a lot of overlap between NVD and CISA Advisories; duplicates were removed leaving the examined vulnerabilities.

Results

Since there are a variety of different solutions within the space, we organised the results into five main categories:

1. Communication.

2. Device management and monitoring.

3. Facility management.

4. Software.

5. Other.

By and large, at 38%, the software category takes up the largest percentage of disclosed CVEs. These CVEs are specifically comprised of software-only based solutions that do not lend themselves to other categories. The most prevalent technology within this category is asset tracking software used to manage goods, equipment, and/or personnel across the facility.

HMI or Human-Machine Interface is also among the top contributors, representing the software used for a human to interact with a device, or to design such user interfaces. From a research perspective, it is easy to understand why software solutions have the most CVEs disclosed. They are typically easier for an attacker to understand and interact with – which makes them more straightforward targets for cybercriminals.

Device management and monitoring follows significantly behind at 23% of disclosed CVEs. The majority of these are device management solutions, with 15 CVEs disclosed from a single vendor. The remaining CVEs are scattered among management of different devices such as industrial robots, PLCs, and automotive factory devices. One potential reason for so many disclosed CVEs in this category is that device management and monitoring solutions inherently communicate to other devices. Exploiting communications leads to lateral movement making them a higher priority target.

The next category coming closely behind at 20% of disclosed CVEs was facilities management, which also included ‘plant management’ for lack of a better grouping. The largest representative sub-category is access control with 11 CVEs, while plant automation only included five CVEs. Other more traditional sub-categories include HVAC management, energy management, access control, and remote management. Facility management has gained interest among researchers in recent years, including Trellix with our access control research in 2022 (www.securitysa.com/*trellix1).

The communication category covers devices that are purpose-built for communicating, with disclosed CVEs sitting at 13% of the total. These are nearly exclusively routers. The few exceptions are relays and a wireless communication framework. The wireless communication framework CVEs also happen to have public proof-of-concept code available, which was rare among other CVEs. In fact, we only discovered three other proof-of-concepts among the others. We did expect a higher representation from this category as network devices tend to get a lot of scrutiny from both researchers and cyber criminals. It will be interesting to see if the remainder of the year sees similar results.

The other category, composed of generic SCADA solutions for services like geolocations or telemetry that did not easily fit into another category, only accounts for 6% of disclosed CVEs.

Surprisingly however, the breadth of vulnerability types was quite large. We’ve based these categories on the standard Common Weakness Enumeration (CWE) but grouped similar ones for brevity. Not many could be grouped together easily. The remaining breadth is so large in fact that the second largest category of vulnerability, out-of-bound read, only took up 8% of the population. The largest, at 34%, was authentication. This included lack of authentication, clear text storage of passwords, improper permissions, hard coded credentials, and similar issues. We’ve seen similar issues with authentication vulnerabilities in other spaces such as the medical industry. The differing vulnerability types often diverged into smaller groups of one or two representing less than 1% each. This is why the other category is so large at 45% of the overall population.

A reasonable question is why are authentication issues so common in our findings? This is a difficult question to answer but we believe there are two major factors. The most straight forward factor is a there is a lack of priority for security and/or training among the developers of these devices. The developers are tasked with getting devices to communicate together, manage machinery, or other industrial tasks. If security is not prioritised appropriately, then even simple security measures can be overlooked. Another factor is that we see more authentication issues because it happens to be the first line of defence. When these systems get tested for vulnerabilities, authentication is usually the first defence to be challenged and therefore the most discovered.

Is the industry and manufacturing space at risk?

The short answer is yes, these systems are under threat and actively attacked. There have been some major attacks in the last few years indicating so. A prime example is the Khuzestan Steel Co. attack mentioned before, which used ICS systems as part of its attack chain; this is strikingly similar to a 2014 attack against an unnamed German steel company also targeting ICS systems. Both examples resulted in physical damage to the facilities. Some groups opt for more traditional attacks such as with ransomware as was the case in the Colonial Pipeline attack of 2021. Manufacturing accounted for 12% of Ransomware campaigns publicly reported in 2022 from the Trellix Advance Research Centre’s 2023 Threat Report. We also found that the Industrial Goods & Services accounted for 32% of the ‘leaks’ resulting from ransomware extortion. (www.securitysa.com/*trellix2).

An insecure conclusion

So, what can you take from these findings? First and foremost, software-based solutions are the low-hanging fruit for vulnerability discovery. Fortunately, they are also easier to keep up to date in terms of versioning and patching. Ensure the business is using automated patching if possible.

Device management and monitoring systems should be the next priority. Things can get rather difficult if these are purpose-built devices without robust central management. For anyone running these systems, it’s paramount to keep them up to date, if possible, and within vendor support. That may prove difficult or impossible for ICS systems if they don’t come with some form of user update method – in which case the documentation from each vendor can provide more information.

Proper network segregation and monitoring is important to provide some protection while security teams work out how to properly update and patch these systems. It’s certainly easier to focus on traditional attack vectors such as OS and web server vulnerabilities. But these findings make it clear that ignoring the potential impact of more domain specific solutions such as SCADA and ICS is not an option. It’s important that security teams work with their vendors and partners to ensure that each device is securely implemented, and the patching process works in a sustainable way for their business.

Share this article:

Further reading: