Your Weekly ICS / OT Security News Digest – March 10th

Our research team has put together all of the most relevant news topics in the ICS, IT, Ransomware & OT security fields, as well as their impacts and their expert recommendations:

ICS:

1. Title: Access:7 Vulnerabilities Impact SCADA, Medical and IoT Devices
   Description: Seven vulnerabilities, tracked as Access:7, have been found in Parametric Technology Corporation’s (PTC) Axeda agent, used for remote access and management of over 150 connected devices from more than 100 vendors. Three of these flaws can be exploited to achieve remote code execution1.
   Besides healthcare-related technologies, these flaws also affect SCADA systems, asset monitoring technologies, IoT gateways, and more2.
   These are supply chain vulnerabilities, as Access:7 affects a solution sold to device manufacturers that did not develop their remote servicing system.

Attack Parameters: These vulnerabilities can be exploited by command injection, buffer overflow, and directory traversal.
Impact: Up to full compromise (RCE, DoS, sensitive data exposure, configuration modification, and specific services shut down)
SCADAfence Coverage: The SCADAfence Platform detects OS command injection and path traversal.

Recommendations: PTC has released patches for these vulnerabilities3.

2. Title: TLStorm Vulnerabilities Impact APC Smart-UPS
   Description: Three critical vulnerabilities in smart uninterruptible power supply (UPS) devices, dubbed TLStorm, could allow for remote takeover. APC is a subsidiary of Schneider Electric, one of the leading vendors of UPS devices. UPS devices provide emergency backup power for mission-critical assets that require high availability4.

Attack Parameters: These vulnerabilities can be exploited remotely. Two zero-click vulnerabilities are in the implementation of the TLS protocol that connects the devices to the Schneider Electric management cloud.
Impact: Up to full compromise (information theft, configuration modification, RCE).
This could allow attackers to disrupt business services or cause physical damage by taking down critical infrastructure.
Recommendations: Schneider Electric released patches for these vulnerabilities.

Additional mitigations include:

1. Deploying access control lists in which the UPS devices are only allowed to communicate with a small set of management devices and the Schneider Electric Cloud via encrypted communication.
2. Changing the default NMC password and installing a publicly-signed SSL certificate.

IT:

1. Title: Microsoft March Patch Tuesday

Description: Microsoft fixed 71 vulnerabilities, three of these critical, as they allow remote code execution. This Patch Tuesday also included fixes for three zero-day vulnerabilities5.

While these vulnerabilities haven’t been used in attacks, there are public PoC exploits for two of the zero-day vulnerabilities, one of them allowing remote code execution.

The remote code execution flaws which are more likely to be targeted are CVE-2022-23277 (Microsoft Exchange Server), CVE-2022-21990 (Remote Desktop Client), and CVE-2022- 24508 (Windows SMBv3 Client/Server)6.

Attack Parameters: Different for each vulnerability, though many can be exploited remotely. Impact: Up to full compromise (privilege escalation, information disclosure, DoS, RCE) SCADAfence Coverage:

1. The SCADAfence Platform provides the ability to detect anomalous SMB activity.
2. The CVEs mentioned above will be added to the Roadmap upon available POCs.

SCADAfence Recommendations:

1. Microsoft has released patches for these vulnerabilities.
2. RDP and SMB connections can be tracked with User Activity Analyzer.

Ransomware:

1. Title: Conti Ransomware Operation Leaks
   Description: A Ukrainian researcher leaked messages taken from the Conti and Ryuk ransomware gang’s private chat server. The information in these messages included bitcoin addresses, evading law enforcement, how they conduct their attacks, the source code for the administrative panel, the BazarBackdoor API, screenshots of storage servers, and more. A password-protected archive containing the source code for the Conti ransomware encryptor, decryptor, and builder was leaked as well. While the leaker did not share the password, another researcher cracked it, allowing everyone access to the source code7.

Impact: The source code provides insight into how the malware works. However, the availability of the source code could lead to the attempt of other threat actors to launch their own operations using the leaked code.
It is unclear yet how this data breach will affect Conti’s operation.

2. Title: Lapsus$ Extortion Group – NVIDIA and Samsung Breaches
   Description: Over the past two weeks, Lapsus$ extortion gang breached two international companies – NVIDIA and Samsung Electronics.
   Lapsus$ gang broke into NVIDIA’s network, stole information and threated to leak it unless the company removes the LHR limitations in the GeForce RTX 30 Series. The gang stole confidential information, the source code of its Deep Learning technology (DLSS), and more8. Employee credentials were leaked and two expired code signing certificates were stolen. These were used to sign malwares and tools, such as Cobalt Strike and Mimikatz9.
   A week later, the gang hit Samsung Electronics and exfiltrated data, including internal company data, the source code related to its Galaxy devices, the source code for trusted applets installed within TrustZone, algorithms for biometric authentication, and confidential data from its chip supplier Qualcomm10.
   Targets: NVIDIA, Samsung Electronics, Qualcomm
   Impact: Part of NVIDIA’s business was offline for two days. In the case of Samsung, the breach could provide a pathway into Samsung devices, rendering them vulnerable11.

SCADAfence Coverage: The SCADAfence Platform detects the use of Cobalt Strike and Mimikatz. Further investigation is pending the publication of additional technical information. Recommendations: Following are additional best practices recommendations:

1. Make sure secure offline backups of critical systems are available and up-to-date.
2. Apply the latest security patches on the assets in the network.
3. Use unique passwords and multi-factor authentication on authentication paths to OT assets.
4. Encrypt sensitive data when possible.
5. Educate staff about the risks and methods of ransomware attacks and how to avoid infection.

3. Title: RagnarLocker Ransomware
   Description: Ragnar Locker ransomware gang has breached the networks of at least 52 organizations from multiple US critical infrastructure sectors12.
   Targets: Entities in the critical manufacturing, energy, financial services, government, and information technology sectors.

Attack Parameters: RagnarLocker frequently change obfuscation techniques to avoid detection and prevention. IOCs associated with RagnarLocker activity include information on attack infrastructure, Bitcoin addresses used to collect ransom demands, and email addresses used by the gang’s operators, were released.
Impact: Unknown due to limited information published.

SCADAfence Coverage: The SCADAfence Platform detects the use of CMD to execute commands and the attempt to stop services, both techniques used by the gang.
Recommendations: The FBI advised against paying a ransom, and encouraged businesses to report any ransomware attacks to help prevent future incidents. An advisory was published providing IOCs that can be used to detect and defend against this ransomware.
Following are additional best practices recommendations:

1. Make sure secure offline backups of critical systems are available and up-to-date.
2. Apply the latest security patches on the assets in the network.
3. Use unique passwords and multi-factor authentication on authentication paths to OT assets.
4. Encrypt sensitive data when possible.
5. Educate staff about the risks and methods of ransomware attacks and how to avoid infection.

4. Title: Toyota Production Affected by Cyberattack
   Description: A system failure at one of Toyota’s suppliers of vital parts, Kojima Industries, caused Toyota to suspend the operation of 28 production lines in 14 plants in Japan13. Although Kojima has not published any official information, the company’s website was offline and Japanese news outlets claimed that the disruption is a result of a cyberattack. This attack could be linked to Japan’s sanctions on Moscow, though there is no confirmation of a Russian connection.
   Attack Parameters: Unknown due to limited information published.

Impact: The expected impact is a 5% drop in Toyota’s monthly production in Japan, which translates to roughly 13,000 units.
Recommendations: Unknown due to limited information published.

Additional Resources:

1 https://www.bleepingcomputer.com/news/security/access-7-vulnerabilities-impact-medical-and-iot-devices/, https://www.ptc.com/en/support/article/CS363561

2 https://www.darkreading.com/vulnerabilities-threats/medical-and-iot-devices-from-more-than-100-vendors-vulnerable-to-attack

3 https://www.forescout.com/resources/access-7-supply-chain-vulnerabilities-can-allow-unwelcomed-access-to-your-medical-and-iot-devices/

4 https://threatpost.com/zero-click-flaws-ups-critical-infratructure/178810/, https://info.armis.com/rs/645-PDC-047/images/Armis-TLStorm-WP%20%281%29.pdf

5 https://www.bleepingcomputer.com/news/microsoft/microsoft-march-2022-patch-tuesday-fixes-71-flaws-3-zero-days/, https://threatpost.com/microsoft- zero-days-critical-bugsmarch-patch-tuesday/178817/

6 https://www.darkreading.com/vulnerabilities-threats/microsoft-patches-critical-exchange-server-flaw

7 https://www.bleepingcomputer.com/news/security/conti-ransomware-source-code-leaked-by-ukrainian-researcher/

8 https://thehackernews.com/2022/03/hackers-who-broke-into-nvidias-network.html, https://www.bleepingcomputer.com/news/security/hackers-to-nvidia- remove-mining-cap-or-we-leak-hardware-data/,

9 https://www.securityweek.com/credentials-71000-nvidia-employees-leaked-following-cyberattack, https://www.bleepingcomputer.com/news/security/malware-now-using-nvidias-stolen-code-signing-certificates/

10 https://thehackernews.com/2022/03/samsung-confirms-data-breach-after.html , https://www.bleepingcomputer.com/news/security/samsung-confirms-hackers-stole-galaxy-devices-source-code/

11 https://threatpost.com/samsung-lapsus-ransomware-source-code/178791/

12 https://www.bleepingcomputer.com/news/security/fbi-ransomware-gang-breached-52-us-critical-infrastructure-orgs/

13 https://www.bleepingcomputer.com/news/security/toyota-halts-production-after-reported-cyberattack-on-supplier/ , https://threatpost.com/toyota-to-close-japan-plants-after-suspected-cyberattack/178686/