Security Market Segment LS
Wednesday, 09 November 2011 20:51

Critical Infrastructure exploitable vulnerability will not be patched

By

In April this year, a vulnerability was discovered in a commonly used critical infrastructure Web Access product.  Exploitable code was also made available.  The manufacturer has announced that no patch will be released.

According to ISC-CERT, advisory ICSA-11-094-02A spells out the following:

'Independent security researcher Rubén Santamarta has identified details and released exploit code for a Remote Procedure Call (RPC) vulnerability in Advantech/BroadWin WebAccess. This is a web browser-based human-machine interface (HMI) product. This RPC vulnerability affects the WebAccess Network Service on 4592/TCP and allows remote code execution.

'Advantech/BroadWin has notified ICS-CERT that a patch will not be issued to address this vulnerability.'

Allow me to repeat that.  A simple RPC exploit in software that is used for a variety of critical infrastructure projects WILL NOT BE PATCHED.

Worse, the company continues to sell the product with absolutely no advice on its web site (visible to this writer) that there is an issue.

Well-known SCADA security expert Dale Peterson was so astonished by this action that he was moved to create a new Insecure Products List currently with just one entry.

Peterson's thoughts are on the next page.


Peterson's company Digital Bond, specialists in Control System security has a blog posting where Peterson observes, 'DHS recent stance that insecure by design products, even those that are remotely exploitable because they lack any security controls, are not going to be considered vulnerabilities makes it difficult for them to come down hard on Advantech or any other product that has known exploits. Still it seems like more should be done than a one line update in an advisory.'

Peterson asks, what more should be done - anyone with ideas should visit his blog entry and add their thoughts to the comment stream.

At the time of writing, two leading luminaries (Ralph Langner and Jake Brodsky) in the Control System security business have offered their thoughts, but at the moment, mostly critical of the role played by ICS-CERT.

In a posting to a members-only SCADA security discussion list (of which this writer is a member), one participant pointed out the legal concept of 'negligent enablement.'  He writes, 'IMHO, the only way to incent change is to hit the wallet.  A loss that is incurred where a provider was aware and willingly ignored is negligence and the financial cost to repair ought be shared.  Then I bet they fix.'

Perhaps it is too difficult to patch the product, but if that were true, the product has no business continuing to be made available for sale.

Advantech has been contacted for comment.


Subscribe to ITWIRE UPDATE Newsletter here

Active Vs. Passive DWDM Solutions

An active approach to your growing optical transport network & connectivity needs.

Building dark fibre network infrastructure using WDM technology used to be considered a complex challenge that only carriers have the means to implement.

This has led many enterprises to build passive networks, which are inferior in quality and ultimately limit their future growth.

Why are passive solutions considered inferior? And what makes active solutions great?

Read more about these two solutions, and how PacketLight fits into all this.

CLICK HERE!

WEBINAR INVITE 8th & 10th September: 5G Performing At The Edge

Don't miss the only 5G and edge performance-focused event in the industry!

Edge computing will play a critical part within digital transformation initiatives across every industry sector. It promises operational speed and efficiency, improved customer service, and reduced operational costs.

This coupled with the new capabilities 5G brings opens up huge opportunities for both network operators and enterprise organisations.

But these technologies will only reach their full potential with assured delivery and performance – with a trust model in place.

With this in mind, we are pleased to announce a two-part digital event, sponsored by Accedian, on the 8th & 10th of September titled 5G: Performing at the Edge.

REGISTER HERE!

BACK TO HOME PAGE
David Heath

David Heath has had a long and varied career in the IT industry having worked as a Pre-sales Network Engineer (remember Novell NetWare?), General Manager of IT&T for the TV Shopping Network, as a Technical manager in the Biometrics industry, and as a Technical Trainer and Instructional Designer in the industrial control sector. In all aspects, security has been a driving focus. Throughout his career, David has sought to inform and educate people and has done that through his writings and in more formal educational environments.

Share News tips for the iTWire Journalists? Your tip will be anonymous

WEBINARS ONLINE & DEMAND

GUEST ARTICLES

VENDOR NEWS

Guest Opinion

Guest Interviews

Guest Reviews

Guest Research

Guest Research & Case Studies

Channel News

Comments