Researchers Reveal 56 OT Bugs in “Icefall” Report

Security scientists have disclosed 56 new vulnerabilities in 10 operational technology (OT) vendors’ items that they say show significant “insecure-by-design” procedures.

Forescout issued the OT:Icefall report right now, revealing the impacted producers as Bently Nevada, Emerson, Honeywell, JTEKT, Motorola, Omron, Phoenix Make contact with, Siemens and Yokogawa.

It stated the vulnerabilities them selves broadly in shape into four classes:

• Insecure engineering protocols
• Weak cryptography or damaged authentication techniques
• Insecure firmware updates
• Remote code execution (RCE) by means of indigenous operation

The most frequent vulnerability kind permits attackers to compromise credentials (38%). Next comes firmware manipulation (21%), RCE (14%) and configuration manipulation (8%). A compact variety of DoS, authentication bypass, file manipulation and logic manipulation bugs are also outlined.

“With OT:ICEFALL, we needed to disclose and supply a quantitative overview of OT insecure-by-layout vulnerabilities fairly than depend on the periodic bursts of CVEs for a one products or a smaller set of general public serious-entire world incidents that are generally brushed off as a specific seller or asset operator staying at fault,” Forescout stated in a blog put up.

“These issues array from persistent insecure-by-design and style tactics in security-licensed products to subpar makes an attempt to go absent from them. The objective is to illustrate how the opaque and proprietary mother nature of these systems, the suboptimal vulnerability management encompassing them, and the often-bogus sense of security supplied by certifications considerably complicate OT risk management endeavours.”

Forescout unveiled that 74% of the product households affected by OT:Icefall have some kind of security certification and argued that most of the issues it unveiled should really have been found comparatively quickly and conveniently if companies had executed in-depth vulnerability discovery.

The security seller added that opacity in the market is harming efforts to strengthen the security of OT merchandise. Lots of insecure-by-style and design challenges are not assigned CVEs, so they typically continue to be “less obvious and actionable,” it argued.

“The speedy growth of the danger landscape is well documented at this stage. By connecting OT to IoT and IT devices, vulnerabilities that when were being witnessed as insignificant because of to their lack of connectivity are now significant targets for poor actors,” warned Daniel dos Santos, head of security analysis at Forescout Vedere Labs.

Some areas of this posting are sourced from:
www.infosecurity-magazine.com