The Claroty Research Team found and disclosed vulnerabilities affecting Ovarro's TBox remote terminal units (RTUs) and its TWinSoft engineering software that left these devices exposed to the internet and unprotected from threat actors, regardless of their capabilities.
Ovarro has patched all of the vulnerabilities privately disclosed by Claroty in TBox firmware version 1.46 and TWinSOft version 12.4. All users are urged to update immediately. All TBox models are affected, as are all versions prior to TWinSoft 12.4.
ICS-CERT has published an advisory with technical details for all affected products, as well as mitigation advice.
TBox RTUs have a web interface that is used for remote automation and monitoring of assets in a number of critical infrastructure sectors.
Claroty researchers found vulnerabilities in implementations of Ovarro's proprietary version of the Modbus protocol, allowing them to modify ipk update packages with malicious code
Claroty also discovered denial-of-service, memory corruption, and security bypass vulnerabilities in TBox.
These vulnerabilities demonstrate the risks of connecting critical infrastructure to the internet, and the need to securely configure authentication for devices, and promptly address software and firmware vulnerabilities.
Connecting unprotected critical infrastructure components to the internet carries with it unacceptable risks that industrial enterprises must make themselves aware of.
That may sound like an obvious statement, but it's becoming increasingly clear that many organizations aren't heeding the warnings from researchers about exposing misconfigured web-based interfaces online and mitigating control system software and firmware vulnerabilities in a timely fashion.
Relatively simple configuration mistakes such as not setting a password—or leaving default passwords in place—for devices can put infrastructure that monitors critical systems within reach of script kiddies as well as advanced attackers. Online tools, such as the Shodan internet search engine, can quickly enumerate specific types of machines connected to the internet, and in an instant, eradicate an organization's belief that a device's specific IP address won't be found among tens of millions of others. It will.
Claroty's latest research into Ovarro's TBox remote terminal units (RTUs) exposed several vulnerabilities that fit into this scenario. We also found other vulnerabilities that an advanced attacker could use to bypass existing protections in order to access devices and either disrupt them or execute code.
The risks associated with these flaws threaten not only the integrity of automation processes, but also, in some cases public safety. Using these security shortcomings, we were able to find web-based interfaces, similar to HMIs, that monitor process levels and other industrial activity. We've seen in the past what could go wrong when such an interface is exposed to the internet without security; the fact such interfaces are exposed online removes many barriers to entry for adversaries of all types.
As we said, these devices may be exploited by opportunistic attackers, as well as those that are more skilled and resourced. Claroty noted in its Biannual ICS Risk & Vulnerability Report: 2H 2020 that new researchers are emerging with a focus on ICS vulnerabilities; we found 50 new research groups that published vulnerabilities in the second half of 2020 that had not published in the previous two years. We've already seen some indications that attackers, such as in the case of the Israel Water Authority attacks of 2020 and Oldsmar, are making their way onto networks as a demonstration of capabilities. In each case, the vulnerabilities they're exploiting could be addressed through improved security architecture and basic security hygiene around access controls and system configurations.
This was probably best illustrated through a May 2020 incident when Palestinian hackers who call themselves the Jerusalem Electronic Army published a handful of social media posts claiming access to control systems within Israel's water infrastructure. The posts included screenshots of web-based HMIs that showed the group had access to control systems monitoring thermal water processes. Israel's CERT and Claroty researchers determined that these systems were not password-protected and were easy pickings for any attention-seeking or advanced adversary.
Claroty's research into the ubiquitous TBox remote terminal units (RTUs) is important work in closing off exposures of this type. RTUs are increasingly connected industrial assets that exchange telemetry with SCADA systems or distributed control systems. Ovarro is a leader in this space, and its TBox RTUs are prevalent in critical infrastructure, specifically in the water, power, oil & gas, transportation, and process industries, enabling remote control and monitoring of applications and processes.
According to Ovarro, TBox is a secure and powerful RTU solution for remote automation and monitoring of critical assets. In other words, it allows users to control and monitor remote processes via a dedicated web interface similarly to how a HMI controls a PLC, in one packed platform.
The Claroty Research Team early last year took a comprehensive look at the security of TBox RTUs, and found critical vulnerabilities that, if exploited, allow attackers to crash these devices or remotely execute code. All of the issues have been patched by Ovarro, which along with ICS-CERT, have published advisories with technical details and mitigation information.
We used open source intelligence sources such as Shodan to compile some statistics on the availability of these devices online. Of all the internet-connected TBox RTUs we found online, only 37% had some sort of authentication protecting the device. Most of the devices were found in Canada, Germany, Thailand, and the United States.
The following graph describes the Internet-facing HTTP service running on TBox devices that are directly accessible via the Internet. These HTTP services run the HMI web interface. As we can see, 62.5% don't require authentication and therefore can enable any visitor to this service to control the RTU in hand or read data presented in the custom HMI panel configured on the device.
The next graph describes the distribution of internet-facing devices that have either MODBUS or HTTP services accessible via standard internet connection broken down by region.
Claroty conducted its analysis of TBox on the LT2-530, version 1.44 build 485, and TWinSoft engineering software version 12.2.1, build 1545. The TBox RTU uses a default proprietary Modbus protocol for communication; SSH may be enabled for uploading files to the RTU and for firmware updates.
In its research, the Claroty Research Team was able to bypass and exploit vulnerabilities in each of these communication channels, eventually executing code remotely on the RTU regardless of any security mechanisms enabled.
Attacks against the TBox RTU required targeting Modbus and eventually using update packages for code execution. TBox's custom Modbus protocol implements updates using ipk packages, which are uploaded to a temporary file before an update command with the ipk file name is sent to the RTU where it is extracted to a directory. Claroty was able to modify the update package file before it's sent to the RTU, writing any file to any location on the RTU including malicious executables that would launch when TBox restarts.
The proprietary Modbus protocol handles a number of file operations, including read, write, and remove. The main RTU software, running as root, handles file access. We were able to override the RTU main configuration file, and either change or delete it, making it unstable until a root access user restores the configuration.
Prior to patching, TBox software running on the RTU would assume any Modbus frames it receives are valid. A specially crafted Modbus packet crashes the main program.
Researchers were also able to bypass Global/Enhanced protection features in TBox, which is intended to limit file access; to do so we were able to decrypt passwords from communication between the RTU and engineering software, as well as bypass protections using a configuration read.
[embed width="600" height="456"]https://youtu.be/MbEkfhZItgo[/embed]
This video shows three vulnerabilities (CVE-2021-22648, CVE-2021-22644, and CVE-2021-22646) chained together to allow for code execution on a protected TBox RTU. First, the configuration file is read from the device using the MODBUS protocol. Next, the encrypted passwords are extracted and decrypted using a hardcoded key. After obtaining the plain-text credentials, a malicious update package containing an executable file in /etc/exec_test is downloaded to the RTU.
TBoxLT2 (all models)
TBox MS-CPU32
TBox MS-CPU32-S2
TBox MS-RM2 (all models)
TBox TG2 (all models)
All versions prior to TWinSoft 12.4 and prior to TBox Firmware 1.46
TWinSoft version 12.4 and TBox firmware version 1.46 mitigate these vulnerabilities.
CISA also recommends minimizing the exposure of these devices to the internet, isolating control system networks and devices from business networks, and using VPNs for remote access.
CVE-2021-22646 CWE-94 Improper Control of Generation of Code (Code Injection) CVSS v3 Score: 8.8This vulnerability and CVE-2021-22648 were the most severe among the vulnerabilities uncovered by Claroty researchers. With CVE-2021-22646, an attacker can exploit an ipk package update generated in TwinSoft engineering software to run malicious code in TBox.
CVE-2021-22648 CWE-732 Incorrect Permission Assignment for Critical Resource CVSS v3 Score: 8.8This vulnerability was found in the TBox proprietary Modbus file access functions that allow an attacker to read, alter, or delete a configuration file.
CVE-2021-22642 Uncontrolled Resource Consumption CWE-400 CVSS v3 Score: 7.5A specially crafted Modbus frame can be used to crash a TBox system.
CVE-2021-22640 Insufficiently Protected Credentials CWE-522 CVSS v3 Score: 7.5An attacker can decrypt the login password by communication capture and brute force attacks.
CVE-2021-22644 Use of Hard-Coded Cryptographic Key CWE-321 CVSS v3 Score: 7.5TWinSoft uses a custom hardcoded user and cryptographic hardcoded key.
VisibleRisk, a cybersecurity ratings company funded by Moody's and Team8, provided information that contributed to this research. We would like to thank Shahar Bahat and Oran Moyal, members of the research team at VisibleRisk, for their assistance with OSINT research.
CWE-1390 WEAK AUTHENTICATION:
The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenticating without a password.
Optigo Networks recommends users always use a unique management VLAN for the port on the ONS-S8 that is used to connect to OneView.
Optigo Networks also recommends users implement at least one of the following additional mitigations:
Use a dedicated NIC on the BMS computer and exclusively this computer for connecting to OneView to manage your OT network configuration.
Set up a router firewall with a white list for the devices permitted to access OneView.
Connect to OneView via secure VPN.
CVSS v3: 9.1
CWE-98: IMPROPER CONTROL OF FILENAME FOR INCLUDE/REQUIRE STATEMENT IN PHP PROGRAM ('PHP REMOTE FILE INCLUSION')
The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse directories, bypass authentication, and execute remote code. ONS-S8 - Spectra Aggregation Switch: 1.3.7 and prior are affected.
Optigo Networks recommends users always use a unique management VLAN for the port on the ONS-S8 that is used to connect to OneView.
Optigo Networks also recommends users implement at least one of the following additional mitigations:
Use a dedicated NIC on the BMS computer and exclusively this computer for connecting to OneView to manage your OT network configuration.
Set up a router firewall with a white list for the devices permitted to access OneView.
Connect to OneView via secure VPN.
CVSS v3: 9.8
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition:
This vulnerability occurs when an attacker exploits a race condition between the time a file is checked and the time it is used (TOCTOU). By exploiting this race condition, an attacker can write arbitrary files to the system. This could allow the attacker to execute malicious code and potentially cause file losses.
CVSS v3: 5.3
CWE-24: Path Traversal:
The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system. This could lead to the disclosure of sensitive information, such as configuration files and JWT signing secrets.
CVSS v3: 6.5
CWE-313: CLEARTEXT STORAGE IN A FILE OR ON DISK
The configuration file stores credentials in cleartext. An attacker with local access rights can read or modify the configuration file, potentially resulting in the service being abused because of sensitive information exposure.
Moxa recommends the following to address the vulnerabilities:
CVSS v3: 5.5
