Vulnerabilities in industrial protocol

June 2018 News, Cyber Security

Kaspersky Lab ICS CERT has analysed the OPC UA (Object Linking and Embedding for Process Control Unified Automation) protocol, which is designed to secure data transfer between servers and clients in industrial systems, including critical infrastructure.

Kaspersky Lab ICS CERT experts analysed OPC UA architecture and its products. They examined its open-source code (available on GitHub), including a sample server, and discovered that current implementations of the protocol had code design and writing errors. These errors should not exist in such widespread critical infrastructure software. Overall, 17 zero-day vulnerabilities in the OPC Foundation’s products were identified and reported to the developers, who fixed them accordingly. All were fixed by the end of March 2018.

OPC UA is an industrial protocol, which was developed and released by the OPC Foundation in 2006 for reliable and secure data transmission between various systems on an industrial network. This protocol is widely used by major vendors in modern industrial facilities, in the manufacturing, oil and gas, pharmaceuticals industries and others. Its gateways are installed by a growing number of industrial enterprises, for communication in automated process control and telemetry, and monitoring and telecontrol systems, allowing these enterprises to unify their management processes. The protocol is also used in IoT and smart city components, which are increasingly attracting hacker attention.

In addition, Kaspersky Lab ICS CERT analysed third-party software based on this industrial protocol, including solutions by leading ­industry vendors. In most cases, they discovered flaws were caused by the developers not using some of the protocol implementation ­functions properly. In other cases, vulnerabilities were the result of incorrect modifications applied to the protocol’s infrastructure. Thus, experts discovered the insecure implementation of functions in a commercial product, despite the fact that the original OPC Foundation implementation did not include errors. As a result, such modifications in the protocol’s logic, made by vendors for unknown reasons, was leading to risky functionality.

All the vulnerabilities found in the OPC UA protocol implementations could result in heavy damage to industry. On the one hand, there was the risk of denial-of-service (DoS) issues, which could pose serious threats to industrial systems by disrupting or shutting down industrial processes. On the other hand, remote code execution was made possible, allowing attackers to send any kind of server commands to control industrial processes, or continue their intrusion into the network.

“Very often software developers put too much trust in industrial protocols, and implement the technology in their solutions without putting the product code through security checks. Thus, vulnerabilities in the example used can affect complete product lines, so it’s highly important that vendors pay close attention to such widely available technologies. Moreover, they should not be deceived by the idea that they can design their own piece of software. Many think this could be more efficient and secure than existing software, but even a brand new piece of software may still contain numerous vulnerabilities,” said Sergey Temnikov, senior security researcher at Kaspersky lab ICS CERT.





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Prevention-first approach to cybersecurity
News Cyber Security
Check Point CEO, Gil Shwed, highlights the increasing importance of artificial intelligence in defending evolving networks and protecting against cyber threats at annual CPX 360 customer and partner event.

Read more...
Three new portable power stations to ease load shedding
News Security Services & Risk Management Products
EcoFlow has launched three portable power stations that provide sufficient power for consumers wherever they are; the DELTA 2 and RIVER 2 Series are feature-filled power solutions to the volatile electricity supply.

Read more...
UJ and Schneider Electric launch 4IR Experience Room
News
Schneider Electric and the University of Johannesburg (UJ) Faculty of Engineering and Built Environment (FEBE) have officially unveiled the 4IR Experience Room, a first for UJ and situated at the university’s Auckland Park Campus.

Read more...
SafeCity Guarding rolls out across 14 suburbs in Johannesburg
News Security Services & Risk Management
In a major drive to provide communities across Johannesburg with additional safety, Vumacam, in partnership with Fidelity ADT and other security providers across the region, rolled out the innovative SafeCity Guarding initiative in 14 suburbs.

Read more...
Eleven steps to an effective ransomware response checklist
Editor's Choice Cyber Security
Anyone is a viable target for ransomware attacks and should have a plan in place to deal with a worst-case scenario. Fortinet offers this ransomware attack response checklist to effectively deal with an active ransomware attack.

Read more...
Providing an interactive branding platform
Securex South Africa News Conferences & Events
Now in its 30th year of providing security technology and services providers with a platform for increasing their brand exposure, Securex South Africa will be held at the Gallagher Convention Centre in Midrand, from the 6th to 8th June 2023.

Read more...
ALX sponsored learning programmes for 2023
Training & Education News
With a mission to harness Africa's abundant human capital by developing two million ethical and entrepreneurial young leaders from the continent by 2030, ALX has launched four fully sponsored (at no cost) tech programmes for 2023.

Read more...
LockBit ransomware gang most apt to leak stolen victim data
News
Trellix has released The Threat Report: February 2023 from its Advanced Research Centre, combining telemetry collected from the world’s largest network of endpoint protection installs and its complete XDR product line with data gathered from open- and closed-source intelligence reports.

Read more...
Schneider Electric is looking for your bold idea
News
Schneider Electric has launched this year’s Schneider Go Green, an annual competition that invites university students from across the globe to share their ideas for innovations that can help make the world cleaner, more inclusive, and more sustainable.

Read more...
Paxton Introduces new rewards programme to South African installers
Paxton News
Paxton has launched Paxton Rewards, offering the first opportunity for installers in South Africa to earn rewards by participating in training, installing Paxton solutions, and completing activities or achievements. The programme is available via the Paxton Installer app.

Read more...