One thing that's been established so far in 2021 is that industrial control system (ICS) and operational technology (OT) cybersecurity has gone mainstream. High-profile attacks such as the Oldsmar, Fla., water treatment facility and Colonial Pipeline made sure of that; not only were there the obvious impacts to system availability and service delivery, but the state of resilience among industrial enterprises was exposed, and the U.S. government has taken notice.
This is the context under which Claroty's Team82 today publishes its latest Biannual ICS Risk & Vulnerability Report. Available now, the report covers ICS and OT vulnerabilities disclosed during the first half of the year. It also identifies a number of trends to watch that have emerged in the wake of relentless extortion-style attacks and increased attention to ICS and OT vulnerabilities from researchers and threat actors alike.
This report continues to be one of the most important resources available to CISOs and IT and OT network managers, providing those decision makers with a comprehensive analysis of software and firmware vulnerabilities affecting industrial products. Leaders are urged to use this report to frame discussions around vulnerability management and resource prioritization as companies move forward converging IT and OT environments, bringing cloud to ICS and OT, and preparing for impending U.S. cyber legislation specific to critical infrastructure.
The report also demonstrates the work being done by Team82, the research leader among industrial cybersecurity companies. Team82 disclosed 70 vulnerabilities affecting 20 automation and technology vendors, surpassing 150 vulnerabilities disclosed since its inception.
While many of the numbers in the report are eye-opening and impressive, they do illustrate an ongoing trend since Claroty began publishing these twice-a-year snapshots: the quantity of vulnerabilities being disclosed—and patched or mitigated—continues on an upward trajectory. There are numerous factors behind that growth, starting with the fact that more researchers than ever are looking for bugs in ICS products and OT protocols (42 new researchers disclosed vulnerabilities in 1H 2021, and 20 vendors had public vulnerability disclosures for the first time). Also, organizations that have integrated OT management under IT or brought the cloud to OT are not only enjoying improved business efficiencies and analytics, but are expanding attack surfaces and exposing devices to the internet that were never meant to be connected.
Most importantly, we took a deep dive into patching and other remediations, including vendor-provided mitigations. It's no surprise that software vulnerabilities are being patched at a much higher rate than firmware bugs, but it's a truism among ICS and OT security circles that patching and product updates require downtime that's intolerable in many arenas. Therefore, mitigations carry significant weight for defenders. We measured the mitigations most recommended by vendors and industry CERTs, and network segmentation and secure remote access were far-and-away the top mitigation steps in 1H 2021.
As air-gapped OT networks become relics of the past, network segmentation takes on a prominent profile among mitigations. Techniques such as virtual zoning—zone-specific policies tailored to engineering or other process-oriented functions—will also ascend along segmentation as an indispensable mitigation.
Secure remote access, meanwhile, was a close second to segmentation as a top mitigation step. Proper access controls and privilege management can go a long way toward shutting down the next Oldsmar-type incident, and more importantly, keep profit-oriented actors from moving laterally through IT and OT networks, stealing data, and dropping malware such as ransomware.
Alarmingly, firmware fixes (either partial or no update at all) were scarce. Almost 62% of flaws in firmware had no fix or a partial remediation recommended, and most of those bugs were in products deployed at Level 1 of the Purdue Model, the Basic Control level.
Better news lies on the software side of the house, where almost 60% of vulnerabilities were remediated. This is no real surprise given the comparative ease in applying a software patch versus a firmware update in any environment.
And while we're on the Purdue Model, 23.55% of the vulnerabilities disclosed in 1H 2021 were found in products at Level 3, Operations Management, which includes Historian databases, OPC servers, and other critical machines. The next most affected Purdue Model level was Level 1, Basic Control where 15.23% of the vulnerabilities disclosed in 1H 2021 were found, followed by Level 2, Supervisory Control. This zone includes HMIs, SCADA systems, engineering workstations, and other machines that communicate directly with PLCs, RTUs, and controllers at Level 1.
Meanwhile, here's a sample of some other interesting data points from the report that paint the best picture of the ICS risk and vulnerability landscape in 1H 2021:
637: The number of ICS vulnerabilities disclosed in 1H 2021, almost 200 more than in our previous report covering 2H 2020
61.4%: The percentage of remotely exploitable ICS vulnerabilities
31.6%: The percentage of locally exploitable ICS vulnerabilities
26%: The percentage of ICS vulnerabilities that went unpatched, or for which only a partial remediation was suggested
65%: The percentage of ICS vulnerabilities likely to lead to total loss of availability
70: The number of vulnerabilities disclosed by Claroty's Team82 in 1H 2021; Claroty has surpassed 150 vulnerabilities disclosed since Team82's inception.
Download the report and spend some time looking at the trends and numbers. We'd love to hear your thoughts on the data and conclusions.
CWE-547 USE OF HARD-CODED, SECURITY-RELEVANT CONSTANTS:
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to an attacker impersonating the web application service and mislead victim clients.
Optigo Networks recommends users to upgrade to the following:
CVSS v3: 7.5
CWE-288 AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL:
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products.
Optigo Networks recommends users to upgrade to the following:
CVSS v3: 9.8
CWE-547 USE OF HARD-CODED, SECURITY-RELEVANT CONSTANTS:
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT (JSON Web Token) sessions.
Optigo Networks recommends users to upgrade to the following:
CVSS v3: 7.5
CWE-912 HIDDEN FUNCTIONALITY:
The "update" binary in the firmware of the affected product sends attempts to mount to a hard-coded, routable IP address, bypassing existing device network settings to do so. The function triggers if the 'C' button is pressed at a specific time during the boot process. If an attacker is able to control or impersonate this IP address, they could upload and overwrite files on the device.
Per FDA recommendation, CISA recommends users remove any Contec CMS8000 devices from their networks.
If asset owners cannot remove the devices from their networks, users should block 202.114.4.0/24 from their networks, or block 202.114.4.119 and 202.114.4.120.
Please note that this device may be re-labeled and sold by resellers.
Read more here: Do the CONTEC CMS8000 Patient Monitors Contain a Chinese Backdoor? The Reality is More Complicated….
CVSS v3: 7.5
CWE-295 IMPROPER CERTIFICATE VALIDATION:
The affected product is vulnerable due to failure of the update mechanism to verify the update server's certificate which could allow an attacker to alter network traffic and carry out a machine-in-the-middle attack (MITM). An attacker could modify the server's response and deliver a malicious update to the user.
Medixant recommends users download the v2025.1 or later version of their software.
CVSS v3: 5.7
