Threats posed by using RATs in ICS

While conducting audits, penetration tests and incident investigations, we have often come across legitimate remote administration tools RAT for PCs installed on operational technology OT networks of industrial enterprises. In a number of incidents that we have investigated, threat actors had use...

The vulnerability of Emerson DeltaV DCS industrial control stations, related to errors in checking the path to the catalog, allows a intruder to replace the executable files.

The vulnerability of Emerson DeltaV DCS industrial control systems lies in errors during the verification of the catalog path. Exploiting this vulnerability allows a malicious actor to replace the executable files...

ThreatList: Attacks on Industrial Control Systems on the Rise

The systems that power the manufacturing, power and water plants, the oil and gas industry, and many other sectors are increasingly in the crosshairs of cyber-attackers: A full 41.2 percent of industrial control system ICS were attacked by malicious software at least once in the first half of 201...

Wind River VxWorks Vulnerabilities

Overview A security researcher has identified two vulnerabilities affecting the Wind River Systems’ VxWorks platform. The vulnerabilities are a debug service enabled by default VU362332 and a weak hashing algorithm used in authentication VU840249. ICS-CERT has been coordinating with CERT/CC in...

Threat Landscape for Industrial Automation Systems in H1 2018

For many years, Kaspersky Lab experts have been uncovering and researching cyberthreats that target a variety of information systems – those of commercial and government organizations, banks, telecoms operators, industrial enterprises, and individual users. In this report, Kaspersky Lab Industria...

Cisco ASA and FWSM Security Advisories

Overview On October 9, 2013, Cisco released two security advisorieshttp://www.us-cert.gov/ncas/current-activity/2013/10/10/Cisco-Releases-Security-Advisories concerning multiple vulnerabilities within software for the following components: Cisco Adaptive Security Appliance ASA...

Federal Aviation Administration GPS Testing

Overview The US Federal Aviation Administration FAA has issued two flight advisories identifying planned Global Positioning System GPS temporary outages and the affected areas, due Department of Defense testing. During testing, the GPS signal may be unreliable or unavailable. ICS-CERT is issuing...

Philips PageWriter TC10, TC20, TC30, TC50, and TC70 Cardiographs (Update A)

1. EXECUTIVE SUMMARY CVSS v3 6.1 ATTENTION: Low skill level to exploit Vendor: Philips Equipment: PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs Vulnerabilities: Improper Input Validation, Use of Hard Coded Credentials 2. UPDATE INFORMATION This updated advisory is a follow-up to the...

[SECURITY] Fedora 28 Update: myrepos-1.20180726-1.fc28

The mr command can checkout, update, or perform other actions on a set of repositories as if they were one combined repository. It supports any combination of subversion, git, cvs, mecurial, bzr and darcs repositories, and support for other revision control systems can easily be added...

Podcast: The Industrial World is Facing a Security Crisis

As more industrial systems become connected, so follows increased awareness of security issues surrounding industrial control systems, programmable logic controllers and SCADA. These once rare worlds of operational technology OT and IoT have now become part of the mainstream cybersecurity...

Why VPNFilter is like a Moonlight Maze

On May 25, the FBI issued a public service announcement asking every Internet ready American to reboot their routers. The PSA specifically warned small and home office owners that they are particularly vulnerable to “foreign cyber actors” A.K.A. spies that are using malware called VPNFilter to...

Multiple Yokogawa Product Security Bypass Vulnerabilities

Yokogawa FCJ and others are Yokogawa's controllers for network control systems. A security bypass vulnerability exists in multiple Yokogawa products. A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service in the context of an affected device...

This Week in Security News: Hacker Reports and Router Reboots

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, hackers warn Congress that internet security across software and computer networks are insecure. Also, a malware, dubbed VPNFilter, infected...

BeaconMedaes TotalAlert Scroll Medical Air Systems

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: BeaconMedaes Equipment: TotalAlert Scroll Medical Air Systems web application Vulnerabilities: Improper Access Control, Insufficiently Protected Credentials, Unprotected Storage of Credentials 2...

Input Validation Error Vulnerability in Various GE PACSystems Products

PACSystems RX3i CPE305/310,RX3i CPE330,RX3i CPE 400 are programmable automation controller products of GE. An input validation error vulnerability exists in various GE PACSystems products. The vulnerability stems from the device failing to properly validate inputs, allowing a remote attacker to...

The Risks of Bio-IoT

Bio-IoT: Internet of Things applied to biological systems, such as pharmaceutical delivery systems, implanted medical devices, intelligent prosthetics, surgical assistants, and remote patient monitoring. IoT 2.0, with ample processing resources and OSI-conformant networking, promises vast...

Schneider Electric InduSoft Web Studio and InTouch Machine Edition

1. EXECUTIVE SUMMARY CVSS v3 9.8 Attention : Exploitable remotely/low skill level to exploit. Vendor : Schneider Electric Software, LLC Equipment : InduSoft Web Studio, InTouch Machine Edition Vulnerability : Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this...

DCCE MAC1100 PLC suffers from an information disclosure vulnerability (CNVD-2018-08782)

MAC1100 PLC programmable logic controller PLC is a product in the programmable logic controller PLC series of Dalian Computer Control DCCE. The product is widely used in intelligent buildings, power data monitoring, heat control system, enterprise management system and other important industrial...

Programs Controlling ICS Robotics Are ‘Wide Open’ to Vulnerabilities

Most manufacturers have connected their operational technology – including industrial control systems and robotic equipment –to the internet, yet the lack of basic security protocols leave these companies open to cyberattacks. Industrial security company Malcrawler pinpointed these dangers at...

FireEye’s Marina Krotofil On Triton and ICS Threats

At the Security Analyst Summit this year in Cancun, FireEye’s Marina Krotofil talks about the Triton malware, first disclosed in December 2017, that targets industrial control systems. Krotofil discusses with Threatpost’s Lindsey O’Donnell about the implications of this malware for the...