Latest Vulnerabilities Found by Claroty's Team82 Highlight Rise of ICS in the Cloud
NEW YORK – July 21, 2021 – Claroty, the industrial cybersecurity company, today launched Team82, its new research arm that provides indispensable vulnerability and threat research to Claroty customers and defenders of industrial networks worldwide. Additionally, Team82 released a new report on critical vulnerabilities found in cloud-based management platforms for industrial control systems (ICS), highlighting the rise of ICS in the cloud and the growing need to secure cloud implementations in industrial environments.
Team82, formerly known as The Claroty Research Team, is a multi-award-winning group known for its rapid development of industrial threat signatures, proprietary protocol analysis, and discovery of ICS vulnerabilities. The team is the market leader in ICS vulnerability research, with a total of 146 vulnerability discoveries and disclosures to date, and was the first to develop and release signatures for the notorious Ripple20 and Wibu-Systems CodeMeter vulnerabilities and the threat actors that target them. Equipped with the industry's most extensive ICS testing lab, the team works closely with leading industrial automation vendors to evaluate the security of their products.
In its latest report, "Top-Down and Bottom-Up: Exploiting Vulnerabilities In the OT Cloud Era," Team82 researched the exploitability of cloud-based management platforms responsible for monitoring ICS, and developed techniques to exploit vulnerabilities in automation vendor CODESYS' Automation Server and vulnerabilities in the WAGO PLC platform. Team82's research mimics the top-down and bottom-up paths an attacker would take to either control a Level 1 device in order to eventually compromise the cloud-based management console, or the reverse, commandeer the cloud in order to manipulate all networked field devices.
"Team82's latest research was motivated by the reality that organizations in the Industry 4.0 era are incorporating cloud technology into their OT and IIoT for simplified management, better business continuity, and improved performance analytics," said Amir Preminger, VP research at Claroty. "In order to fully reap these rewards, organizations must implement stringent security measures to secure data in transit and at rest, and lock down permissions. We thank the CODESYS and WAGO teams for their swift response, updates, and mitigations that benefit their customers and the ICS domain."
The new Team82 Research Hub includes the team's latest research reports, a vulnerability dashboard for tracking the latest disclosures, its coordinated disclosure policy for working with affected vendors, its public PGP Key for securely and safely exchanging vulnerability and research information, and other resources.
To access the Team82 Research Hub, visit: claroty.com/team82.
About Claroty
Claroty is the industrial cybersecurity company. Trusted by the world's largest enterprises, Claroty helps customers reveal, protect, and manage their OT, IoT, and IIoT assets. The company's comprehensive platform connects seamlessly with customers' existing infrastructure and programs while providing a full range of industrial cybersecurity controls for visibility, threat detection, risk and vulnerability management, and secure remote access—all with a significantly reduced total cost of ownership. Claroty is backed and adopted by leading industrial automation vendors, with an expansive partner ecosystem and award-winning research team. The company is headquartered in New York City and has a presence in Europe, Asia-Pacific, and Latin America, and deployments on all seven continents.
