Vulnerabilities in industrial protocol

June 2018 News, Cyber Security

Kaspersky Lab ICS CERT has analysed the OPC UA (Object Linking and Embedding for Process Control Unified Automation) protocol, which is designed to secure data transfer between servers and clients in industrial systems, including critical infrastructure.

Kaspersky Lab ICS CERT experts analysed OPC UA architecture and its products. They examined its open-source code (available on GitHub), including a sample server, and discovered that current implementations of the protocol had code design and writing errors. These errors should not exist in such widespread critical infrastructure software. Overall, 17 zero-day vulnerabilities in the OPC Foundation’s products were identified and reported to the developers, who fixed them accordingly. All were fixed by the end of March 2018.

OPC UA is an industrial protocol, which was developed and released by the OPC Foundation in 2006 for reliable and secure data transmission between various systems on an industrial network. This protocol is widely used by major vendors in modern industrial facilities, in the manufacturing, oil and gas, pharmaceuticals industries and others. Its gateways are installed by a growing number of industrial enterprises, for communication in automated process control and telemetry, and monitoring and telecontrol systems, allowing these enterprises to unify their management processes. The protocol is also used in IoT and smart city components, which are increasingly attracting hacker attention.

In addition, Kaspersky Lab ICS CERT analysed third-party software based on this industrial protocol, including solutions by leading ­industry vendors. In most cases, they discovered flaws were caused by the developers not using some of the protocol implementation ­functions properly. In other cases, vulnerabilities were the result of incorrect modifications applied to the protocol’s infrastructure. Thus, experts discovered the insecure implementation of functions in a commercial product, despite the fact that the original OPC Foundation implementation did not include errors. As a result, such modifications in the protocol’s logic, made by vendors for unknown reasons, was leading to risky functionality.

All the vulnerabilities found in the OPC UA protocol implementations could result in heavy damage to industry. On the one hand, there was the risk of denial-of-service (DoS) issues, which could pose serious threats to industrial systems by disrupting or shutting down industrial processes. On the other hand, remote code execution was made possible, allowing attackers to send any kind of server commands to control industrial processes, or continue their intrusion into the network.

“Very often software developers put too much trust in industrial protocols, and implement the technology in their solutions without putting the product code through security checks. Thus, vulnerabilities in the example used can affect complete product lines, so it’s highly important that vendors pay close attention to such widely available technologies. Moreover, they should not be deceived by the idea that they can design their own piece of software. Many think this could be more efficient and secure than existing software, but even a brand new piece of software may still contain numerous vulnerabilities,” said Sergey Temnikov, senior security researcher at Kaspersky lab ICS CERT.


Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

TAPA: The role of an effective treasury function in business risk management
June 2019, Technews Publishing , News
Neil Le Roux, the Founder of Diligent Advisors will speak at the TAPA SA (Transported Asset Protection Association) annual conference on 26 July 2019.

Read more...
From the editor's desk: Of sore feet and new websites
June 2019, Technews Publishing , News
I hope everyone has recovered from the hustle and bustle of Securex. This year was once again an exhausting event and now we’re left with following up. For Hi-Tech Security Solutions it was a good show ...

Read more...
Where are your crown jewels?
June 2019, Wolfpack Information Risk , Commercial (Industry), Cyber Security, Security Services & Risk Management
Understanding what data they store and analyse is gaining increasing urgency for organisations that are now accountable to new(ish) privacy regulations such as the GDPR and our PoPIA.

Read more...
Axis 7th generation ARTPEC chip
June 2019, Axis Communications SA , Editor's Choice, CCTV, Surveillance & Remote Monitoring, Cyber Security
Axis has launched its 7th generation ARTPEC chip, optimised for network video, to improve all the signature Axis technologies created to address difficult light conditions.

Read more...
Does green cost more?
June 2019 , News, Commercial (Industry)
GBCA, ASAQS and UP launch the 2019 edition of Green Building in South Africa: Guide to Costs & Trends.

Read more...
Partnership to reduce farm violence and agricultural crime
June 2019, Fidelity ADT Security , News, Security Services & Risk Management, Agriculture (Industry)
Agri SA has partnered with Fidelity ADT, a subsidiary of the Fidelity Services Group, to offer a range of services and products to its members and the rural community.

Read more...
Centurion announces new board of directors
June 2019, Centurion Systems , News, Access Control & Identity Management
After more than 30 years at the helm of access automation manufacturer, Centurion, co-founder Pat Dickens stepped down as the company’s MD at the end of March, with current sales and marketing director Richard Rohman being named as his successor.

Read more...
Password awareness critical
June 2019, Kaspersky Lab , Cyber Security, Security Services & Risk Management
A recent study revealed that digital identity data and information holds significant value to cybercriminals – who craft ways of gaining this data and exploit it on the dark Web for as little as $50.

Read more...
Kaspersky Lab to open office in Kigali, Rwanda
June 2019, Kaspersky Lab , News, Cyber Security
Kaspersky Lab has announced plans to open a new office in Kigali, Rwanda, to support the rapid growth of its business in East Africa.

Read more...
Fully automated cash logistics
June 2019 , News, Security Services & Risk Management
Cash management company, Izicash, announced its adoption of Transtrack, a software solution, supported by a South African company, AllCash, which streamlines the cash logistics process.

Read more...