The National Rural Electric Cooperative Association (NRECA) announces commercial launch of its OT cybersecurity solution.
The post US Electric Cooperative Association Launches Commercial OT Security Solution appeared first on SecurityWeek.
Palo Alto Networks introduces a new OT security solution for industrial organizations that provides visibility, zero trust and simplified operations.
The post Palo Alto Networks Unveils Zero Trust OT Security Solution appeared first on SecurityWeek.
Join this webinar to gain clear advice on the people, process and technology considerations that must be made at every stage of an OT security program’s lifecycle.
The post Webinar Today: Building Sustainable OT Cybersecurity Programs appeared first on SecurityWeek.
White hat hackers received $180,000 at Pwn2Own Miami 2023 for exploits targeting widely used ICS products.
The post Hackers Earn $180,000 for ICS Exploits at Pwn2Own Miami 2023 appeared first on SecurityWeek.
While the total number of new XIoT vulnerabilities is reducing, the difficulty in securing these devices remains high – especially in OT situations.
The post Published XIoT Vulnerabilities Trend Down, but Vigilance Must Remain High: Report appeared first on SecurityWeek.
Siemens and Schneider Electric address nearly 100 vulnerabilities across several of their products with their February 2023 Patch Tuesday advisories.
The post ICS Patch Tuesday: 100 Vulnerabilities Addressed by Siemens, Schneider Electric appeared first on SecurityWeek.
Cybersecurity firm Forescout shows how various ICS vulnerabilities can be chained for an exploit that allows hackers to cause damage to a bridge.
The post ICS Vulnerabilities Chained for Deep Lateral Movement and Physical Damage appeared first on SecurityWeek.
Dragos ICS/OT Cybersecurity Year in Review 2022 report covers state-sponsored attacks, ransomware, and vulnerabilities.
The post 2022 ICS Attacks: Fewer-Than-Expected on US Energy Sector, But Ransomware Surged appeared first on SecurityWeek.
The number of vulnerabilities discovered in industrial control systems (ICS) continues to increase, and many of them have a ‘critical’ or ‘high’ severity rating, according to a new report from industrial cybersecurity firm SynSaber.
The report compares the number of ICS and ICS medical advisories published by CISA between 2020 and 2022. While the number of advisories was roughly the same in 2021 and 2022, at 350, the number of vulnerabilities discovered last year reached 1,342, compared to 1,191 in the previous year.
The number of vulnerabilities rated ‘critical’ has increased even more significantly, from 186 in 2021 to nearly 300 in 2022. In total, nearly 1,000 vulnerabilities are ‘critical’ or ‘high severity’ based on their CVSS score.
While CVSS scores can be misleading in the case of ICS flaws and they should not be used on their own for patching prioritization, these scores can still be useful for ranking issues that meet an organization’s applicability criteria.
Synsaber’s report shows that Siemens stands out when it comes to ICS vulnerability volume. Not only do many of the security holes discovered in 2022 impact Siemens products, the German industrial giant is also responsible for self-reporting the highest number of vulnerabilities, far more than other vendors.
Siemens’ product security team reported 544 vulnerabilities in 2022, up from 230 in the previous year. The second vendor is Hitachi, with 64 bugs.
“The team at Siemens product security continues to increase its reporting cadence with significant year-over-year growth of nearly 3x. While this does inflate the number of known CVEs that affect Siemens product lines compared to others, this should not be viewed as Siemens products being less secure. On the contrary, a mature and repeatable OEM self-reporting process is something all other OEMs should strive to achieve,” SynSaber noted.
Siemens typically addresses dozens of vulnerabilities every month, but many affect third-party components used by the company’s products.
While the number of vulnerabilities discovered last year is high, nearly one-third require user interaction for successful exploitation and roughly one-quarter require local or physical access to the targeted system. It’s worth noting, however, that the percentage of flaws requiring user interaction and local access has decreased compared to 2021.
Looking at the data for the past three years, one worrying aspect is that the number of ‘forever-day vulnerabilities’ — these are flaws that will likely never get patches — increased to 28% in 2022, up from 14% in 2021.
ICS vulnerabilities can impact software, firmware or protocols. The percentage of issues found in each of these categories has been fairly constant in 2020-2022, with software accounting for 56%, firmware for 36% and protocols for 8%, on average over the three years.
Related: 2023 ICS Patch Tuesday Debuts With 12 Security Advisories From Siemens, Schneider
Related: SynSaber Launches Palm-Sized Threat Sensor for OT Environments
The post Siemens Drives Rise in ICS Vulnerabilities Discovered in 2022: Report appeared first on SecurityWeek.
The Siemens Automation License Manager is affected by two serious vulnerabilities that could be chained to hack industrial control systems (ICS), according to industrial cybersecurity firm Otorio.
On January 10, Siemens released its first round of Patch Tuesday updates for 2023, addressing a total of 20 vulnerabilities affecting the company’s products.
One of the six advisories published at the time describes two high-severity security holes discovered by a researcher from Otorio in the Siemens Automation License Manager (ALM), which is designed for centrally managing license keys for Siemens software.
One of the flaws, tracked as CVE-2022-43513, can allow a remote, unauthenticated attacker to rename and move license files as a System user.
The second issue, CVE-2022-43514, allows a remote, unauthenticated attacker to execute operations on files outside the specified root folder. Chaining the two vulnerabilities can lead to remote code execution, Siemens said.
In a blog post published on Tuesday, Otorio explained that most of Siemens’ software products use the ALM by default for license management. This means the vulnerabilities impact organizations that use one of many Siemens products, including the Simatic PCS 7 historian, the Sicam Device Manager, WinCC, TIA Portal, and the DIGSI engineering tool.
According to Otorio, an attacker who has gained access to the targeted organization’s operational technology (OT) network, even with limited permissions, could exploit the vulnerabilities to fully compromise the OT network.
“For example, the PCS 7 Historian, which is used as a repository for industrial process data, can be used as a ‘bridge’ for an attacker to propagate from the corporate network into the OT network. Once an attacker breaches the Historian server, one can potentially gain access to engineering, control, and monitoring systems,” explained Eran Jacob, research team leader at Otorio.
“An attack could take place not only from the enterprise network. For example, any compromised station with minimal privileges in the network, such as a thin client computer that has access to one of the Siemens servers, could lead to a full compromise of the network,” Jacob added.
Siemens has released an update that should fix the flaws in ALM 6, but the company currently does not plan on releasing a patch for version 5. Workarounds and mitigations are also available.
Related: Cybersecurity Experts Cast Doubt on Hackers’ ICS Ransomware Claims
Related: InHand Industrial Router Vulnerabilities Expose Internal OT Networks to Attacks
Related: Unpatchable Hardware Vulnerability Allows Hacking of Siemens PLCs
The post Siemens License Manager Vulnerabilities Allow ICS Hacking appeared first on SecurityWeek.
Privacy Settings
This website uses cookies to improve your experience while you navigate through the website.
