Vulnerabilities discovered in automation and control systems

Applied Risk has discovered several weaknesses in various WirelessHART products, which are widely used to support manufacturing plants across the globe. The vulnerabilities at highest risk of exploitation may allow threat actors, such as nation states, insiders and hacktivists to manipulate instruments and jeopardise process data integrity. The sophistication of such an attack, similar to that of Stuxnet, means that the physical processes will appear to be operating within acceptable parameters, while they will have in fact been altered with nefarious intention.

WirelessHART technology provides various functions for monitoring and control across multiple industries, including the measurement of temperature, flow, pressure and humidity among others. One such attack, a manipulation of view or control, will pass undetected in the absence of active monitoring at this level. Without the extensive testing of these environments, this type of attack could be launched with consequences ranging from production shutdown to loss of life.

The threat originates from Level 1 field devices, such as sensors and valves responsible for sensing and monitoring the physical process. Applied Risk is using its research on the newly detected vulnerabilities to develop the first WirelessHART Fuzzer in the industry, designed to test these devices for potential flaws. This technology will assess robustness and identify security flaws in devices during the early stage of product development – a key requirement for manufacturers and asset owners looking to enhance security of their assets and adhere to IEC 62443 standards.

Jalal Bouhdada, Founder and Principal Security Consultant for Applied Risk, states, “Our research team was concerned to find a number of vulnerabilities in various WirelessHART components used across the globe, by some of the biggest players in industry. The majority of plants are unaware of the risks as security assessments at this level have often been overlooked.”

“The risks this flaw pose reach far beyond financial loss. The loss of production is a significant issue for manufacturers, as are fines from customers if products aren’t delivered on time,” said Bouhdada. “The most serious risk, however, is the loss of life in the case of explosions, especially in hazardous environments. Alongside the potential impact to the environment, an attack could lead to significant reputational damage. End users and ICS suppliers must take a more proactive and thorough approach to testing – and implementing security measures to effectively tackle these threats.”

Applied Risk strongly believes security should be seen as a business enabler and has issued recommendations for end users and manufacturers to mitigate key risks:?

• Identify physical security concerns and implement measures to tighten these.
• Update access control lists to ensure only correctly trained staff access systems.
• Set lock and fuse bits for system on chip (SoC) devices.
• Secure the storage on all Level 1 field devices.
• Ensure device sensors are equipped with tamper evident tape.
• Regularly change and update default keys.

Investing in technology will secure a manufacturing plant’s equipment, while assisting industry to boost security of field devices and most importantly, prevent incidents from occurring on the plant floor.

Adapted from press release by Rosalie Starling

Read the article online at: https://www.hydrocarbonengineering.com/product-news/05022016/vulnerabilities-discovered-in-automation-and-control-systems-2386/