Home Business IT Security Critical Infrastructure exploitable vulnerability will not be patched

In April this year, a vulnerability was discovered in a commonly used critical infrastructure Web Access product.  Exploitable code was also made available.  The manufacturer has announced that no patch will be released.

According to ISC-CERT, advisory ICSA-11-094-02A spells out the following:

'Independent security researcher Rubén Santamarta has identified details and released exploit code for a Remote Procedure Call (RPC) vulnerability in Advantech/BroadWin WebAccess. This is a web browser-based human-machine interface (HMI) product. This RPC vulnerability affects the WebAccess Network Service on 4592/TCP and allows remote code execution.

'Advantech/BroadWin has notified ICS-CERT that a patch will not be issued to address this vulnerability.'

Allow me to repeat that.  A simple RPC exploit in software that is used for a variety of critical infrastructure projects WILL NOT BE PATCHED.

Worse, the company continues to sell the product with absolutely no advice on its web site (visible to this writer) that there is an issue.

Well-known SCADA security expert Dale Peterson was so astonished by this action that he was moved to create a new Insecure Products List currently with just one entry.

Peterson's thoughts are on the next page.


Peterson's company Digital Bond, specialists in Control System security has a blog posting where Peterson observes, 'DHS recent stance that insecure by design products, even those that are remotely exploitable because they lack any security controls, are not going to be considered vulnerabilities makes it difficult for them to come down hard on Advantech or any other product that has known exploits. Still it seems like more should be done than a one line update in an advisory.'

Peterson asks, what more should be done - anyone with ideas should visit his blog entry and add their thoughts to the comment stream.

At the time of writing, two leading luminaries (Ralph Langner and Jake Brodsky) in the Control System security business have offered their thoughts, but at the moment, mostly critical of the role played by ICS-CERT.

In a posting to a members-only SCADA security discussion list (of which this writer is a member), one participant pointed out the legal concept of 'negligent enablement.'  He writes, 'IMHO, the only way to incent change is to hit the wallet.  A loss that is incurred where a provider was aware and willingly ignored is negligence and the financial cost to repair ought be shared.  Then I bet they fix.'

Perhaps it is too difficult to patch the product, but if that were true, the product has no business continuing to be made available for sale.

Advantech has been contacted for comment.

HOW TO OFFER 4G TO YOUR CUSTOMERS

Download an information pack to learn more about how you can offer competitive 4G plans to your customers.

> everything you need to operate your own 4G telco

> support for you and your customers

> billing, back-end and full compliance.

DOWNLOAD NOW!

HOW TOP MANAGERS MOTIVATE, ENERGISE EMPLOYEES

Download an in-depth guide to managing a healthy, motivated and energetic workforce without breaking the bank.

DOWNLOAD NOW!

David Heath

joomla statistics

David Heath has over 25 years experience in the IT industry, specializing particularly in customer support, security and computer networking. Heath has worked previously as head of IT for The Television Shopping Network, as the network and desktop manager for Armstrong Jones (a major funds management organization) and has consulted into various Australian federal government agencies (including the Department of Immigration and the Australian Bureau of Criminal Intelligence). He has also served on various state, national and international committees for Novell Users International; he was also the organising chairman for the 1994 Novell Users' Conference in Brisbane. Heath is currently employed as an Instructional Designer, building technical training courses for industrial process control systems.

 

 

 

 

Connect

Join the iTWire Community and be part of the latest news, invites to exclusive events, whitepapers and educational materials and oppertunities.
Why do I want to receive this daily update?
  • The latest features from iTWire
  • Free whitepaper downloads
  • Industry opportunities