Pharmaceuticals Like Johnson & Johnson Are Experiencing Daily Cyber Attacks From Nation State Attackers

As each day passes, so does the increasing amount of security risks with the cybersecurity attack vector. Every organization can easily fall victim to another cyber threat, but recently, the pharmaceutical industry has become a prime target.

The increasing number of attacks on pharmaceutical organizations is due to the ongoing COVID-19 vaccine development and distribution and this has resulted in the pharmaceutical sector becoming the most attractive industry for cybercriminals. A successful vaccine has become one of the most valuable intellectual properties for cyber attackers. Beyond attacking the pharmaceutical formula, its data on testing the drug trials have become a tempting target for nation-state attackers

A recent example of pharmaceutical companies being attacked is when the Wall Street Journal reported that North Korean state attackers have targeted pharmaceutical companies in the U.S., including Johnson & Johnson. This sparked the Chief Information Security Officer at Johnson & Johnson to say in an interview that they are experiencing attacks from nation-state threat actors “every single minute of every single day.”

This tale isn’t new as in late 2010 North Korean threat actors reportedly targeted UK-based vaccine maker AstraZeneca whose vaccine was co-developed with the University of Oxford. The attack method was spear phishing via social media intending to inject malware by way of offering AstraZeneca employees fake job offers.

The attack surface of pharmaceutical organizations will only continue to grow and the need for better cybersecurity will become more of a priority as more pharma companies will fall victim which could result in disastrous consequences.

Pharma A Prime Cyber Attack Target

The pharma industry is no stranger to being targeted by attackers. Pharmaceutical companies suffer more breaches than any other industry as a result of malicious activity with an average breach resulting in a loss of over 5 million dollars according to the 2020 Cost of a Data Breach Report. Nation-state attackers are induced to target pharmaceutical firms for financial profit, which was one of the main goals for the cybercriminal group who launched the reportedly North Korean government-sponsored attacks.

Cyber espionage is now being recognized as another influential reason for state-sponsored attackers attempting to gain technological advantage for their countries’ economies. The pharmaceutical industry’s key components are based on innovation with comprehensive R&D investments, intellectual property, and patented data. Anytime any data or property is affected or exploited by an attack it can result in devastating losses which can erode patient and consumer trust.

The 2019 attack on German drug conglomerate Bayer is an example of cyber espionage by a state-sponsored attack. Bayer fell victim to a cyberattack from the Chinese threat actor group known as Wicked Panda. The attackers used the Winnti malware, which makes it possible to access a system remotely and then pursue further exploits once in the system.

Pharmaceutical Intellectual Property Attacker’s Favorite Target

Sensitive information and data are not the only attractive targets of pharma companies that hackers are looking to exploit and gain access to. Nation-state hackers have their eyes on a different prize, intellectual property. Protecting intellectual property has always been a priority for the pharmaceutical industry.

Pharmaceutical products are typically only protected by patent for seven years in the United States, and this data could help foreign generic drug manufacturers to be more ready for the expiration of the patent. For example, Chinese nation-state hackers are targeting US pharmaceutical companies to gather information and share it with Chinese companies to offer an advantage against their western competitors.

The years of research and development into developing new pharmaceuticals have attracted hackers to exploit intellectual property somewhat enticing. Recent attacks have targeted intellectual property such as information related to the development of a vaccine or other medical mitigation measures.

Another risk that many pharmaceutical companies experience is that the technology used in their manufacturing systems is much older than the internet, which results in systems being extremely insecure. They were originally designed as ‘air-gapped’, or isolated systems and not built to confront any cybersecurity attacks. For pharmaceutical companies, any size attack by an adversary can result in loss of productivity and availability of physical devices. This can lead to safety issues, reputation, financial losses, and even death.

To fight off different attacks, and the possible exploitation of vulnerabilities, organizations and more specifically enterprises need to address the need to secure the crucial intellectual property while understanding which devices and technologies are at risk. This starts with increasing awareness of nation-state attacks and adopting a more proactive approach to cybersecurity.

What Pharmaceutical Firms Can Do

Pharmaceutical firms need to allocate the right amount of attention and resources to understand what they can do to protect the company’s data and system. The first step is understanding the different risks that come with pharmaceutical manufacturers and systems and what steps are needed to ensure better security.

With the increased attention and awareness of state-sponsored attacks over the past few years, pharmaceutical companies now are understanding the importance of implementing the right security practices when it comes to securing their IT and OT systems. As pharmaceutical manufacturers move forward digitally and continue to modernize their processes with more robotics and IoT technologies, this creates new entry points for attackers to exploit and move laterally within an organization’s system and servers.

In the past, most manufacturers were using stand-alone systems, but with the advancement of technology, they are increasing their connections to the internet to allow third-party contractors and vendors to gain access to work with their equipment. This has forced the security teams at pharmaceutical companies to change their approach to securing their product.

While not every pharmaceutical company has changed its security approach, there has been a massive increase in awareness which has led to changes in the industry. Some companies, like Taro and Rafa, have taken a more proactive approach when securing their connected OT environments with a passive network monitoring solution, specifically designed for OT environments. This has allowed them to have full visibility into their network, reduce the risk of operational downtime, improve their network security and comply with demanding industry regulations.

As pharmaceutical organizations continue to be on the radar for cyberattacks, now is the time to take action and detect and mitigate any risks. Having the right approach and strategy in place with the right blend of awareness and technology, pharmaceutical organizations can now implement the right approach to securing their data, servers, and intellectual property against cyber attacks.

How SCADAfence Discovered Targeted Ransomware In A Pharmaceutical Facility

SCADAfence’s Incident Response team recently assisted a big pharmaceutical company with an industrial cybersecurity emergency. This research has been published with the goal of assist organizations to plan for such events and reduce the impact of targeted industrial ransomware in their networks.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SCADAfence
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.

SCADAfence 2021

Takeaways From The Oldsmar Water Attack & What Security Leaders Can Do About It

Over the last few days, cybersecurity journalists and the ICS security community have been discussing the Oldsmar Florida water system cyber attack, almost ad nauseam. While many people have been talking about this “news” topic, we’ve actually been treating this issue with many of our customers over the past few years. In this post, I will explain what we’ve learned from this cyberattack, but most importantly, I will share how we’ve been busy solving these issues over the last few years with actual examples from our range of industrial cybersecurity products.

The Oldsmar Water Facility Attack

On February 5th, a hacker gained access into the water treatment system of Oldsmar, Florida, and hijacked the plant’s operational controls. He was able to temporarily drive up the sodium hydroxide content in the water to poisonous levels. The Oldsmar facility is the primary source of drinking water for the city’s 15,000 residents. Luckily, a plant operator was able to return the water to normal levels. The incident has nonetheless launched many conversations about the state of security in global critical infrastructure.

But that wasn’t the whole story.

A security advisory released earlier this week by the state of Massachusetts’s Department of Environmental Protection, referred to additional unsafe practices or behaviors at the Oldsmar water treatment plant that significantly increased the risk further. Like many other facilities of its kind, Oldsmar uses a SCADA (Supervisory Control And Data Acquisition) system that allows staff to monitor and control conditions within the facility. At the same time, the staff was using TeamViewer, a fairly common remote access program, which can be used to monitor and control systems within the SCADA network. Sadly, cybersecurity was not a priority for the facility, as is the case occasionally with critical infrastructure. Not only was the Oldsmar facility using Windows 7 – an outdated software that is no longer supported by Microsoft, but all of their employees shared the same password to access TeamViewer. Additionally, the facility was connected directly to the internet without any type of firewall protection installed.

The Current Situation With Water Systems

In the United States alone, there are about 54,000 distinct drinking water systems. The vast majority of those systems serve less than 50,000 residents. They mainly rely on some type of remote access to monitor and/or administer their facilities. Many of their facilities are also unattended, underfunded, and do not have someone watching the IT operations 24/7. Finally, many facilities have not separated their OT (operational technology) networks from their safety systems that are in place in order to detect intrusions or potentially dangerous changes by threat actors.

While the attempt was spotted and taken care of by a plant operator before it could do any damage, it raises questions about how serious a threat this sort of terrorist or nation-state action could be in the future.

Why Don’t We See More Stories Like This On The News?

So, despite how easy it is to find ways to remotely interact with such OT networks, we aren’t seeing more incidents like the one in Oldsmar making the news. One reason may be that these facilities don’t have to disclose such events right when they happen. Additionally, many companies, especially in the public sector want to avoid bad publicity and do what they can to avoid their company name smeared in cyber-attack news headlines. We’ve seen many companies, especially publicly traded companies lose stock value and brand trust after a cyberattack.

But the main reason you don’t see more of these attacks on the news is that SCADAfence protects many of these critical infrastructure facilities.

Over the last seven years, SCADAfence has been working with many critical infrastructure organizations, including water & wastewater facilities to keep their OT networks safe. We do this by providing them with full network visibility, we accurately detect any anomalous behavior and malicious activities – including anomalies that originate in remote access. We were ready for 2020 before remote access security was required (due to the lockdowns) and it’s been paying off dividends.

Here’s How SCADAfence Secures Water Treatment Facilities

Let me show you a few key examples, (with actual screenshots) of how we have prevented identical attacks over the last seven years for our customers.

With the SCADAfence Platform’s continuous network monitoring we have been easily been able to detect any remote access into OT networks, specifically, detailed alerts for TeamViewer connections in OT networks.

We also immediately alert on value level changes, once they pass a certain threshold to prevent unauthorized changes or process manipulation. The platform is also so flexible that users can create specific firewall-like rules for variables such as this one: “Sodium Hydroxide ppm Anomalous Value” alert. This will raise an alert in case the value of Sodium Hydroxide in the water exceeds the max value of (for example) 40 ppm (parts per million) or goes below 1 ppm.

The SCADAfence Platform also provides visual exposure maps that can spot malicious activities – weeks, or even months in advance. At another similar incident (that didn’t hit the news), we monitored a water treatment facility during normal operations. As you can see in the screenshot below, there was no connectivity between the remote access group and the DMZ group.

During an attack on the facility, the security team was immediately able to see new connections forming from the remote access group to the DMZ group and from the DMZ to the operator network group (see below). As soon as that alert was issued, the security team was notified of that change and the remote access connection was disconnected, stopping the attackers immediately.

It’s really easy to set automated rules that will alert in case there is connectivity between specific network groups. In this case, we set an alert if there is a connection from the DMZ to the operator network and a similar rule in case there is a connection from the remote access to the DMZ group.

This incident at Oldsmar, highlights what we’ve been saying for years. Remote access in OT networks provides a big risk. And the thing is, remote access is not going away.

The SCADAfence platform also provides security staff with the correlation between their users and their activities while performing remote work.

In addition to alerts on anomalous or unauthorized actions in the OT network, the SCADAfence Platform provides security teams with the association details – including the user name, the originating workstation, and the application to provide a holistic view into remote access activities, hop-to-hop.

This also ties into the issue of compliance with industrial standards. SCADAfence offers a governance portal that enables operators to define compliance enforcement policies, and continuously monitor compliance enforcement status for most ICS standards, frameworks, and regulations.

Don’t Be Scared, Be Prepared

Many water & wastewater utilities are already using continuous network monitoring and remote access technologies to get visibility into their OT networks and keep their critical infrastructure networks secure.

With this holistic approach, of network monitoring, anomaly detection, remote access visibility, and compliance, many water & wastewater are already reducing 95% of their risk level of future attacks.

The best part is that these solutions are all agentless, are not intrusive, and can perform superhuman tasks at a fraction of the cost of one human worker.

If your organization is looking into securing their industrial networks, the experts at SCADAfence are seasoned veterans in this space and can show you how it’s done.

To learn more about these products and see short product demos, click here: https://l.scadafence.com/demo

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SCADAfence
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.

SCADAfence 2021

How You Should Prevent Ransomware Attacks On Your Industrial Networks

This Week, Ransomware Slams Westrock & Other industrial Organizations

Earlier this week, the operations at $17 billion packaging firm WestRock were disrupted by a ransomware attack that impacted both its IT and OT (operational technology) networks. Two days later, a massive $27 billion chain operator Dairy Farm Group was also attacked by ransomware, with the attackers demanding a $30 million ransom. Those are just a sample of successful ransomware attacks from this week alone.

Since the outbreaks of Wannacry & NotPetya ransomware attacks in 2017, we’ve been witnessing daily occurrences of attacks affecting OT networks that originated in the IT side. The U.S. National Security Agency (NSA) also highlighted this issue for this very simple reason. It works.

Ransomware Works

That’s the simplest way to explain why incidents of ransomware attacks have sharply increased over the last year — with no end in sight. The number of ransomware attacks has jumped by 350 percent since 2018, the average ransom payment increased by more than 100 percent this year, downtime is up by 200 percent and the average cost per incident is on the rise, according to a recent report from PurpleSec.

Threat actor groups with names such as Ryuk, Egregor, Conti, Ragnar Locker, and many others are ruthless, well-funded and are willing to target anyone; from COVID-19 vaccine manufacturers, automotive manufacturers, critical infrastructure, governments and hospitals to get their payday. In fact, the first ransomware related death happened this past September, when a German hospital was infected with ransomware and couldn’t treat patients during the Covid-19 outbreak.

As part of SCADAfence’s mission to protect the lives and safety of civilians, we’ve put together this guide to help you prevent ransomware in your industrial organization.

The Ransomware Encryption Process

Let’s go back to the beginning, and discuss how these attacks encrypt systems in the first place.

From the previous ransomware attacks we’ve researched, we learned that from the minute the attackers get initial access, they can encrypt the entire network in a matter of hours. In other cases attackers would spend more time in assessing which assets they want to encrypt and they’d make sure they get to key servers such as storage and application servers.

Most of the recent ransomware attacks you’re reading about in the news try to terminate antivirus processes to make sure that their encryption process will go uninterrupted. Recent ransomware variants such as SNAKE, DoppelPaymer and LockerGoga even went further by terminating OT related processes like Siemens SIMATIC WinCC, Beckhoff TwinCAT, Kepware KEPServerEX, and the OPC communications protocol. This made sure the industrial process was interrupted, and this increased the chances that the victims paid the ransom. These types of ransomware attacks were seen in the recent attacks of Honda and ExecuPharm.

Diagram #1 – An OT Security Challenge: Industrial Components Exposed to Encryption

From what we’ve seen, ransomware generally encrypts Windows and Linux machines. We still haven’t seen any PLCs being encrypted. However, many industrial services are run on Windows / Linux machines – such as Historians, HMIs, Storage, Application Servers, Management Portals and OPC Client/Servers.

In many cases, ransomware operations would not stop in the IT network, and will also attack OT segments. More encrypted devices means a higher monetary ransom demand from the attackers.

Organizations must be able to monitor & detect threats across the IT/OT boundary in order to effectively identify risks before reaching process-critical end-points.

Diagram #2 – Ransomware Prevention: How You Can Prevent Ransomware Attacks On Your Industrial Networks

Some of the tools and techniques that ransomware operators are using are on the same level that nation-state threat actors are using on targeted espionage campaigns.

Diagram #3 – Tactics, Techniques & Procedures most commonly used in Ransomware Attacks

We recommend that organizations practice these common security procedures to minimize their risk of ransomware infection on each step of the kill chain:

Initial Access:

RDP
1. If possible, replace RDP with a remote access solution that requires two-factor authentication, many VPNs now support that. This will require attackers to be verified by, for example, a code sent via SMS.
2. If you choose to still use RDP, make sure its Windows Update is enabled and is working.
Email Phishing
1. Educate the organization’s employees about phishing attacks. Employees should be suspicious of emails that don’t seem right and not click on suspicious links.
2. Install an Anti-Phishing solution.
Software vulnerabilities of internet-facing servers
1. Scan your organization’s IP range from outside the network. Verify that all exposed IP/ports are what you expect them to be.
2. Make sure that automatic security updates are enabled for your exposed services. If one of your services (such as web servers, for example) does not have that feature, consider changing it to a similar one that has this feature.

Lateral Movement:

Firewalls & Windows Update – Enable firewalls on all of your workstations and servers.
Make sure that Windows Update is enabled. This will ensure that your machines will be patched for the latest vulnerabilities and will also be less prone to lateral movement techniques. Microsoft constantly updates their security policies and their firewall rules.
One good example is that they disabled the remote creation of processes using the Task Scheduler ‘at’ command.
Endpoint Protection

Endpoint protection works. Beyond blocking classic hackers’ techniques, some also have defenses against ransomware and will protect your assets from encryption.

Network Segmentation
Ideally, you would want to minimize the risk of your industrial network being impacted when suffering a ransomware attack.
1. To the possible extent, separate the IT network from the OT network segment. Monitor and limit the access between the segments.
2. Use different management servers to the OT and IT networks (Windows Domains, etc). By doing so, compromising the IT domain will not compromise the OT domain.
Constant Network Monitoring
A constant network monitoring platform (we happen to know a really good one), will help you identify threats while analyzing network traffic and will help you see the bigger picture of what’s happening in your network.
Data Exfiltration
Monitor your network for unusual outbound traffic. Everyday user activity should not generate uplink activity higher than about 200MB/daily per user.

How SCADAfence Helps You

We provide a comprehensive solution – The SCADAfence’s platform which was built to protect industrial organizations like yours from industrial cyber attacks (including ransomware). It also helps you implement better security practices amongst its built in features. Some of these include:

Asset Management
Network Maps
Traffic Analyzers

These tools will help your organization to implement better network segmentation, to make sure that your firewalls are functioning properly, and that every device in the OT network is communicating only with the ones that they should be communicating with. You will also be able to spot assets that are not where they’re supposed to be, for example, forgotten assets in the DMZ.

The platform, which is also the highest rated OT & IoT security platform, also monitors the network traffic for any threats, including ones that are found in typical ransomware attacks; such as:

Security exploits being sent across the network.
Lateral movements attempts using latest techniques.
Network scanning and network reconnaissance.

In an event of a security breach, SCADAfence’s detailed alerts will help you to contain these threats as quickly as possible. Ultimately, we built this tool to help industrial organizations to understand their attack surface, to implement effective segmentation and constant network monitoring for any malicious or anomalous activity.

Video: The Anatomy of a Targeted Ransomware Attack:

We’d like to share with you a true story of a recent incident response to an industrial ransomware cyberattack. SCADAfence’s incident response team assists companies in cyber security emergencies. In this video, we will review a recent incident response activity in which we took part. This research has been published with the goal of assisting organizations to plan for such events and reduce the impact of targeted industrial ransomware in their networks.

For more detailed information on this story, we prepared a full whitepaper here: https://www.scadafence.com/resource/anatomy-of-a-targeted-ransomware-attack/

Additional credits: Yossi Reuven and Michael Yehoshua have also contributed to this comprehensive guide.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SCADAfence
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.

SCADAfence 2021

SCADAfence Researchers Discover a DoS Vulnerability in all of ABB’s AC500 V2 products

Our Researchers Discover Another Vulnerability

As part of our mission to secure the world’s OT, IoT and Cyber Physical infrastructures, we invest resources into offensive research of vulnerabilities and attack techniques.

CVE-2020-24685 is a CVSS 8.6 (CVSS v3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) remote CPU DoS vulnerability in all of ABB’s AC500 V2 products with onboard ethernet are affected by this vulnerability (with latest firmware v2.5.4) that has been discovered by SCADAfence researcher Yossi Reuven.

ABB is one of the world’s leading electronics and electrical equipment manufacturing companies (holding an overall share in the world DCS market of 19.2%), and is in use by many of our customers.

About The Vulnerability – CVE-2020-24685

AC500 V2 Series is one of ABB’s PLC offerings – designed as a compact entry-level PLCs for small applications. AC500 V2’s communication with Automation Builder (Engineering software package) is done via ABB proprietary wrapper protocol encapsulation of CoDeSys SDE protocol (which works on both TCP and UDP).

A single specially crafted packet sent by an attacker over the ABB protocol on port 1200 will cause a denial-of-service (DoS) vulnerability. The PLC’s CPU will get into fault mode, causing a hardware failure. The PLC then becomes unresponsive and requires a manual (physical) restart to recover. In addition, the buffer overflow condition may allow remote code execution.

What SCADAfence Recommends Asset Owners To Do

Perform an Industrial Vulnerability Management Process

Please refer to our guide on this topic: https://www.scadafence.com/public-preview-a-comprehensive-guide-to-industrial-device-patching/

Monitor for Unauthorized Network Activity and Exploitation

Some devices will always remain unpatched. Monitoring is an early warning system that allows you to act before attackers have gained full control over your network.

Upgrade to the Latest Firmware

ABB has developed a new firmware version 2.8.5 fixing this vulnerability. This firmware version is released for the following affected PLC types:
* PM573-ETH
* PM583-ETH

Currently no firmware update is available to other products in the AC500 V2 line. When ABB makes such a patch available, we recommend asset owners to consider upgrading.

Prevent Unauthorized and Untrusted Access

– Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.

– Use within a LAN and block access from untrusted networks and hosts through firewalls.

Special Thanks & Recognition

The SCADAfence Research team would like to thank the ABB team for the collaboration.

ABB has published the advisory and released a firmware update to part of the product line.

SCADAfence is committed to continued research of offensive technologies and development of new defensive technologies.

Exploit PoC

We wrote a Python POC (GPLv3) script of the exploit in action.

Currently, there’s no patch available. As a result, we limit the access to the exploit to vetted individuals only. The exploit is only available for educational and legal research purposes.

Warning: The script will crash the PLC’s CPU – do not use it in production.

To get this free python exploit, please send an email to research@scadafence.com, identify yourself and explain how you’re going to use the exploit. We reserve the right to refuse any request.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SCADAfence
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.

SCADAfence 2021

Thank You 2020 – It’s Been Quite A Ride!

What a year.

What a year this has been to humanity, an epidemic has fundamentally changed the way we interact with one another, social distancing, lockdowns and restrictions in virtually everything we do. Covid-19 has changed the way we conduct business and shifted the way we secure our businesses.

Adversaries’ activities are at an all-time high, be it nation state actors or financially driven attackers. The ever-changing threat landscape is evolving faster than ever and OT networks and IoT devices are a core target for such malicious activities. Repeated attacks from threat actors sponsored by nation-states, such as the recent SolarWinds attack on Microsoft, FireEye, the US government, and around 18,000 other organizations, have prompted fears not only of significant physical damage and economic disruption but also of the increased possibility of all-out cyber warfare. You could describe the situation as an all-out war, only with no guns involved and not a single bullet shot.

In the midst of all of this, we felt that it is imperative to support the broader community and so with the outbreak of Coronavirus earlier this year, we offered all of our products for free for an initial term. And today, we are honored to protect some of the world’s largest organizations in manufacturing and critical infrastructure. In fact, the Japanese government publicly praised SCADAfence’s efforts to secure multiple Japanese organizations, completely free of charge.

Despite the Covid-19 pandemic and possibly because of the recent spike in attacks, our team at SCADAfence has managed to sustain our exponential growth and the continued scaling of our global footprint with rapid expansion in new markets, such as LATAM and APAC.

This rapid expansion can also be attributed to our technological advancements and innovation. Launching new features based on customers’ real needs, such as our User Activity Tracking, a feature that was built specifically for the new, work from home norm; and the SCADAfence Governance portal, which centrally monitors the adherence to industry standard and regulations.

One of the things we’ve always taken pride in is putting our customer’s needs as our top priority. To that end, SCADAfence has won 11 industry awards in 2020, more than all companies in the OT security industry combined – but that all pales in comparison to having the highest customer satisfaction rating on Gartner’s Peer Insights. Not to mention the feedback we’ve been receiving from our customers, here’s just one example:

“SCADAfence has well exceeded all of our expectations in both service level and product quality. Their team has been extremely knowledgeable, customer-focused, and timely in all aspects of our interactions.”

Process Controls Engineer at a Fortune 100, O&G company.

There’s no doubt that 2020 has been a challenging year but also a year full of growth, dedication and grit. I’d like to thank our entire team for all their hard work, efforts and creativity. A big thank you to all of our partners and of course, our customers for choosing to work with us, it’s not a given and never will be.

If you’ve made it this far and even if you did not, I’d like wish you a great 2021!

Enjoy the holiday season and stay safe.

Happy new year!

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SCADAfence
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.

SCADAfence 2021

SolarWinds / SunBurst – Should Enterprises Adopt Supply Chain Certification?

SunBurst – The Cyber Attack on SolarWinds

SunBurst is a cyber espionage campaign that leveraged a supply chain attack on SolarWinds, a leading supplier of network management software. Between March and May 2020, the attackers gained access to SolarWinds’ build system, added a malicious DLL (library) file, and distributed it to 18,000 SolarWinds Orion customers.

The malicious file allowed remote control of the target host, while leveraging advanced evasive tactics. Using this access point, the attackers were able to hack into organizations with well-established security practices such as Cisco and Microsoft. These organizations failed to detect the attack before FireEye (who was also attacked) made it public.

A targeted attack at this scale doesn’t happen very often. It’s a rare event that should shake both enterprises and the security community. The fact that this campaign went undetected for such a long period of time (6+ months), proves that something is fundamentally wrong with the way that computer networks are protected.

The success of this attack campaign, versus other campaigns, is built upon two factors:

First and foremost, this is not a coincidence. This is a team of highly skilled attackers who made all of it possible. The campaign shows world-class planning, knowledge, experience and attention to detail.
SolarWinds Orion is a network management product. Due to its role, it has a number of advantages as an attack source, vs. other types of attack sources:
1. It’s whitelisted to perform reconnaissance (network monitoring) in many security tools – This tool is designed to perform reconnaissance, so no one will suspect when the tool does what it was designed to do.
2. From SolarWindows Orion’s perspective in the network, the network is usually flat. Regardless of how many network segments are there, the component in Orion that scans the network requires direct network access to the target devices, so enterprises allow this traffic through their firewalls. This allows unique network access from the initial access point.
3. SolarWinds Orion commonly has access to certain admin credentials that make it possible to move laterally.

The Supply Chain Risk

The supply chain risk to both enterprises and government organizations has been discussed in the last few years. The attack on SolarWinds is one of the most powerful examples of the supply chain risk. It joins a list of similar events such as the attack on Target in 2013. Supply chain attacks exploit trusted third-parties to enable access to a large number of attack targets in parallel. By using that trust, such as the trust organizations put on SolarWinds software updates, it’s easier to obtain access rather than attacking each target separately and directly.

Supply Chain Certification

The United States DoD (Department of Defense) is one of the government organizations that took far-reaching steps to reduce the supply chain risk. In October 2016, the DoD first issued a supplement to the DFARS regulation, that introduced cyber security requirements for DoD suppliers. In November 2020, only a month before the supply chain attack on SolarWinds, the DoD made another major addition to DFARS. This addition is called CMMC or the Cybersecurity Maturity Model Certification.

The CMMC includes a few non-linear improvements vs. the original DFARS supplement, in multiple categories:

Third-party certification of suppliers by approved parties (C3PAOs) instead of self-certification.
Certification is mandatory to be able to participate in RFIs and RFPs, meaning that it can affect the supplier’s revenue.
CMMC has a 5-levels maturity model.
There are 154 new requirements out of 171 in CMMC (vs. the original DFARS supplement), and they’re spread across the 5 levels of maturity.
Reporting of compliance status in an online portal. This means that the DoD can monitor compliance of the entire DIB (Defense Industrial Base – the regulated organizations).

By introducing CMMC, the DoD conveys a clear message to DoD suppliers: We want you to be secure. And if you’re not secure enough, you cannot work on defense projects. Find another niche that’s less critical. If you want to work with the DoD, these are our requirements.

The question is: Should enterprises follow a similar path? Should a supply chain certification model be the standard in enterprise RFIs and RFPs?

The Pros and Cons of Supply Chain Certification

There are a few pros and cons to consider when discussing supply chain certification.

Pros:

Increased security of the supply chain using financial incentives.
Competition between suppliers on security maturity levels – Enterprises will start ranking suppliers based on a new metric.
Transparency in security maturity levels. “Are you a Level 3 Security supplier or a Level 5 Security supplier?”
Following a cyber attack, the certification might be re-evaluated. If major violations are found, the certification can be voided.

Cons:

How much is this going to increase the prices of goods and services? And is it worth it?
The certification can end up being another checkbox, where it has high costs and provides no security value.
Smaller suppliers might find it difficult or impossible to be certified within their resources, which will create a bias toward larger organizations.
Do enterprises have a large enough negotiation power, similar to that of the DoD, to pose such requirements on suppliers?

Our Predictions

We see a clear path to how supply chain certification becomes mainstream in the next years. With the DoD adopting CMMC, certain suppliers will have a CMMC certifications. They can then use their CMMC certification as a competitive advantage in non-DoD deals.

The DoD kickstarted this program, defined the requirements, and laid out the infrastructure (C3PAOs, RPs, etc). That allows the entire world to adopt CMMC – other government bodies and enterprises can easily adopt it at a low cost.

If the CMMC certification will be perceived as an efficient risk reduction strategy, and that there’s nothing fundamentally wrong about it, this (or a similar) model is going to expand into additional industries.

The SCADAfence Governance Portal is a compliance monitoring automation platform from SCADAfence, that automatically monitors your network’s compliance with the major cyber security standards and regulations. If you’re interested in learning more about how to measure and increase your security program maturity, please visit this page for a short demo about this product.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SCADAfence
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.

2020 SCADAfence

How SCADAfence Defended a DoD Supplier from Over 50 Cyber-Attackers

The ’85 Bears of Cyber Physical Security

A few days ago, our elite cybersecurity team of defenders, faced over 50 of the world’s top hackers and security practitioners in the Hack the Building event.

The event was born from a joint partnership between MISI (Maryland Innovation and Security Institute) and USCYBERCOM (the United States Cyber Command), is an unrivaled, hands-on live facilities critical infrastructure cybersecurity challenge.

Hackers, federal labs, building automation companies, academia and government agencies all competed to infiltrate, disrupt or take over a connected smart building and the computing systems and data inside of a government-owned building.

A Real-World Target

The event is built around a specially-designated, real-world target: A live, fully-equipped 150,000 square-foot “smart” office building near Annapolis, Maryland that teams on-site and remote are challenged to attack through its diverse IT, control systems, Internet of Things (IoT), access control, surveillance camera, building automation and other systems.

The Attack Scenarios

The event was split into two parts, two days each. On the first part, 13 pre-planned attack scenarios took place, and on the second part, the network was open to any type of attack, allowing attackers and defenders to play in a more chaotic cyber war zone.

The building was equipped with many types of assets, such as PLCs, BAS controllers, industrial robots, power distribution units (PDU), IoT controllers, IP cameras & NVRs, serial to ethernet converters, and many other devices.

Each scenario targeted different assets and required different methods to reach the targets. For example, in one scenario the attackers broke into the data center’s cooling system, shutting it down, resulting in server shutdown. In another scenario, the fire alarm system has been disabled.

The full list of scenarios is available here.

To simulate a real scenario, many details about the network were unknown to the defensive team. Moreover, some details that were provided were plain wrong, due to outdated network maps. These missing details made the defender’s job more difficult.

Vulnerabilities Discovered by SCADAfence

The network had a number of common security issues:

The network map was inaccurate and had missing information.
The network was protected by firewalls, but many known and unknown connections between segments were possible.
Some network segments had a mix of devices in them, for example a conference room camera and engineering stations resided in the same network.
Some Windows/Linux devices had monitoring/security agents on them, but many devices weren’t covered by monitoring.

The SCADAfence Platform was deployed on a NPB (network packet broker) that was monitoring multiple SPAN ports and network taps. Using the Platform, we were able to monitor the network in real time, and a SOC team was provided by SCADAfence to monitor the Platform and detect attacks.

Over 50 Hackers Attacked the Network at the Same Time

This event is a rare opportunity to stress-test your security product. It’s a lot harder to defend than a normal cyber attack. Over 50 hackers attacked the network at the same time, with each team targeting different assets and arrived from a different place in the network. Some attackers came from the internal network and took over legitimate hosts, then used them to attack other assets. Some came from the company’s VPN, and from other places.

They used a large variety of attack tools and tactics, including physical attacks – hacking an access control system with badge readers.

We were happy to see that the SCADAfence Platform was able to detect the broad spectrum of attacks over the course of these 4 days.

The findings from the SCADAfence Platform were presented to the audience in two live streaming sessions (the full videos will be shared as soon as they become available to us). We were interviewed by Armando Seay, Co-Founder of MISI, and together explained the attack tactics used by the attackers.

Adversaries Play Dirty Using Social Engineering

At one point, one of the red team members was able to infiltrate the blue team live discussion channel, and alerted the red team about our actions. He was able to infiltrate the channel using social engineering, by identifying as a member of one of the blue teams.

When we (the blue team) found out we have a mole in our channel, we started a mole hunt and finally figured out who the adversary was. We’re not sure if it was part of the planned surprises in the exercise, but regardless – it was an important drill that can happen in real life.

This has been a wonderful event, and a rare opportunity to showcase our product and exercise attack/defense scenarios on real industrial hardware, running real processes. We want to thank MISI (Armando, Mark, Alexander, Karissa, Joseph) and USCYBERCOM for planning and executing this event.

We want to thank the red team for the creativity and for the interesting challenges and surprises they had for us, and to the blue team (which we were part of) for the collaboration.

To learn more about SCADAfence’s advanced capabilities, you can watch some short product demos here: https://l.scadafence.com/demo

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SCADAfence
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.

2020 SCADAfence

Vulnerability Report CVE-2020-16849

SCADAfence Researchers Discover A Sensitive Information Leak Vulnerability in Canon Printers As part of our mission to secure the world’s OT, IoT and Cyber Physical infrastructures, we invest resources into offensive research of vulnerabilities and attack techniques. CVE-2020-16849 is a remote information disclosure vulnerability in Canon printers that was discovered by SCADAfence researchers Maayan Fishelov, Dan Haim and Ofer Shaked. The vulnerability allows a remote attacker to leak the address book and administrator password, unauthenticated, over the network. Canon is one of the world’s leaders in cameras, photocopiers, printers and broadcasting equipment. SCADAfence has been working with Canon for the last few months in handling this vulnerability, and on October 1st, Canon published an official security advisory reporting this vulnerability and its mitigations. About The CVE-2020-16849 Vulnerability The vulnerability exists inside the printer’s IP protocol stack, which is used by Canon Laser Printers and Small Office Multifunctional Printers. The potential for a third-party attack exists on the devices when they’re connected to a network that allows fragments of the “Address book” or/and “administrator password” to be acquired through an unsecured network. It should be noted that when HTTPS is used for the communication of Remote UI, data is secured by encryption. To date, there have been no confirmed cases of the vulnerability being exploited to cause harm. However, in order to ensure that Canon’s customers can use their products securely, new firmware will be available for affected Canon products.

What SCADAfence Recommends Vendors To Do

Prevent Unauthorized and Untrusted Access – Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required. – Use within a LAN and block access from untrusted networks and hosts through firewalls. Perform an IoT Vulnerability Management Process Tools such as the SCADAfence IoT Security platform can help you identify vulnerable devices. Monitor for Unauthorized Network Activity and Exploitation Some devices will always remain unpatched. Monitoring is an early warning system that allows you to act before attackers have gained full control over your network. Upgrade to the Latest Firmware Canon issued a new firmware that users are able to upgrade to. Special Thanks & Recognition The SCADAfence Research team would like to thank the Canon team for a speedy vulnerability reporting process even during the challenging COVID-19 times. SCADAfence is committed to continued research of offensive technologies and development of new defensive technologies. Exploit PoC We wrote a Python POC (GPLv3) script of the exploit in action. The exploit is only available for educational and legal research purposes. Warning: The script might crash the printer – do not use it in production. To get this python exploit, please send an email to research@scadafence.com, identify yourself and explain how you’re going to use the exploit. We reserve the right to refuse any request.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SCADAfence
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.

2020 SCADAfence

First Israeli Hi-Tech Delegation Takes Off for the Emirates

The first Israeli high-tech delegation to the Emirates departed this morning (Sunday), led by Jerusalem Venture Partners Fund and entrepreneur Erel Margalit. Over the next four days, the delegation is set to hold high-level meetings with senior officials as well as innovation and investment counterparts in Dubai and Abu Dhabi, to build cooperation between Israeli and Emirati hi-tech, and deepen the newly found relationship between the two countries.

Erel Margalit, CEO and founder of the Jerusalem Venture Partners (JVP), February 18, 2019. / Hadas Parush/Flash90

On Tuesday, participants will join first of their kind ’round table’ meetings between entrepreneurs from the two countries– both of which are renowned internationally as leaders in the field. Ahead of the visit, the delegation was honored to have received the warm welcome of the UAE Government and was looking forward to the opportunity to meet senior ministers during the visit.

“Hi-tech is the locomotive engine that leads the Israeli economy, so we have a key role in leading relations and cooperation with the Emirates, with an emphasis on partnership,” commented JVP founder and chairman of Margalit Startup City Erel Margalit.

He added, “I am proud to lead the first Israeli hi-tech delegation to the Emirates. Our companies have been in business contact with the Emirates for a number of years, and now an opportunity has arisen to expand this network of relationships, deepen the ties significantly, and allow more and more Israeli companies and entrepreneurs to be part of this connection and success.”

Margalit stressed, “This is not just a business opportunity, but a political opportunity for a new page between the Israeli hi-tech community and the entire Middle East. With us in the delegation, are the CEOs of emerging Israeli hi-tech companies from every field, and I am sure we will create real partnerships here that will contribute to building successful Israeli companies that will propel the Israeli economy forward, precisely during this period, and create more and more new jobs.”

The delegation was invited to the Emirates by the DIFC (Dubai International Financial Center), the body that manages the free trade area in the financial heart of Dubai – which is one of the global financial centers. Members of the delegation will also receive a comprehensive tour of the financial center.

Among the companies participating in the delegation: Earnix, one of the world’s leading companies in insurtech and personalization of insurance and banking, an area with great interest in the Emirates, which is considered a powerhouse in the field of insurance in the Middle East; Up Control, an emerging Israeli company leading a revolution in the management of remote work networks; Morphisec, from Beer Sheva, which is a leader in innovative technology for protecting endpoints in organizations, which is a particularly relevant development for the protection of banks and infrastructure; and Secret Double Octopus, also from Beer Sheva, which provides a leading biometric solution for passwords.

Also of significant interest to the Emirati Government, companies, and investors is the field of foodtech. Among the delegation in the field is InnovoPro, a company that produces a protein substitute from chickpeas with high nutritional values. One of the most interesting companies in the world in the field, it is already a major player in dairy products in some of Europe’s leading chains, with products from ice-cream to mayonnaise. The company is now preparing for a breakthrough in the Middle East. Another company participating in the delegation is Agrint, which has developed technology to identify diseases in trees before they cause damage. One of the most serious infections in the world is the palm bacteria that destroys entire palm groves. Agrint’s solution for this has significant potential for agriculture in the Middle East.

Members of the delegation included: Entrepreneur, and former senior official in the Mossad, David Meidan; Udi Ziv, CEO of Earnix; FrankZvi, CEO of Copilot; Elad Ben-Meir,-CEO of SCADAfence; Dror Liwer – Co-Founder& Chief Security Officer of Coronet; Asaf Ganot, CEO of Control Up; Omri Kohl, CEO of Pyramid Analytics; Gal Rimon, CEO of Centrical; Ronen Yehoshua, CEO of Morphisec; Raz Refaeli, CEO of Secret Double Octopus; Mark Gazit, CEO of Thetaray; Yaron Ravkaie, CEO of Teridion; Tali Nehushtan, CEO of InnovoPro; Yehonatan Ben Hamozeg, CEO of Agrint; they were joined by JVP partners Yoav Tzruya, Fiona Darmon, Gadi Porat, Michal Drayman, and Rinat Remler, senior VPs Shimrit Kenig, Guy Pross, Pnina Ben Ami, and communications director Omri Sheinfeld.

Source from: https://www.jewishpress.com/news/business-economy/first-israeli-hi-tech-delegation-takes-off-for-the-emirates/2020/10/25/

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SCADAfence
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.

2020 SCADAfence

CVSS 8.6 DoS Vulnerability in Mitsubishi Electric MELSEC iQ-R Series CPU

Our Researchers Discover Another Vulnerability

As part of our mission to secure the world’s OT, IoT and Cyber Physical infrastructures, we invest resources into offensive research of vulnerabilities and attack techniques.

CVE-2020-16850 (US ICS-CERT) is a CVSS 8.6 remote CPU DoS vulnerability in Mitsubishi Electric iQ-R Series that has been discovered by SCADAfence researcher Yossi Reuven.

Mitsubishi Electric is one of the world’s leading electronics and electrical equipment manufacturing companies, and is in use by many of our customers. We have been working with Mitsubishi Electric for the last few months in handling multiple vulnerabilities, and on October 8th, Mitsubishi Electric published an official security advisory reporting this vulnerability and its mitigations.

About The Vulnerability – CVE-2020-16850

MELSEC iQ-R Series is Mitsubishi Electric flagship product line – designed for high productivity automation systems. iQ-R CPUs’ communication with GX Works 3 (Engineering software package) is done via Mitsubishi Electric proprietary protocol MELSOFT (which works on both TCP and UDP).

A single specially crafted packet sent by an attacker over the MELSOFT UDP protocol on port 5006 will cause a denial-of-service (DoS) vulnerability due to uncontrolled resource consumption (CWE-400). The PLC’s CPU will get into fault mode, causing a hardware failure (error code: 0x3C00 – hardware failure). The PLC then becomes unresponsive and requires a manual restart to recover.

What SCADAfence Recommends Vendors To Do

Perform an Industrial Vulnerability Management Process

Please refer to our guide on this topic: https://www.scadafence.com/public-preview-a-comprehensive-guide-to-industrial-device-patching/

Monitor for Unauthorized Network Activity and Exploitation

Some devices will always remain unpatched. Monitoring is an early warning system that allows you to act before attackers have gained full control over your network.

Upgrade to the Latest Firmware (When Available)

Currently no firmware update is available (will be released soon by Mitsubishi Electric)

Prevent Unauthorized and Untrusted Access

– Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.

– Use within a LAN and block access from untrusted networks and hosts through firewalls.

Block UDP Port 5006 and Use MELSOFT TCP

MELSOFT is an engineering software for Mitsubishi PLCs and gives users the option to use either the (connectionless) UDP and (connection-oriented) TCP protocols for programming and configuring the devices. SCADAfence recommends to block Block UDP port 5006 since the cyberattack leverages the connectionless UDP protocol and can cause the PLCs to stop functioning and cause a denial of service. Instead, users should use the TCP protocol for communicating with devices in the shop floor or the control network.

Special Thanks & Recognition

The SCADAfence Research team would like to thank the Mitsubishi Electric team for a speedy vulnerability reporting process even during the challenging COVID-19 times.

SCADAfence is committed to continued research of offensive technologies and development of new defensive technologies.

Exploit PoC

We wrote a Python POC (GPLv3) script of the exploit in action.

Currently, there’s no patch available. As a result, we limit the access to the exploit to vetted individuals only. The exploit is only available for educational and legal research purposes.

Warning: The script will crash the PLC’s CPU – do not use it in production.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SCADAfence
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.

2020 SCADAfence