Source: http://chemical-facility-security-news.blogspot.ca/2017/02/
Timestamp: 2017-09-22 04:33:19
Document Index: 412587640

Matched Legal Cases: ['art 107', 'art 172', 'art 27', '§ 621', '§313', '§2', '§2', '§2', '§3', '§3', '§4', '§109', '§109', '§1030', '§1030', '§1030', '§1030', '§1030', '§1030', '§1030', '§1030', '§312', '§321', '§2', '§312', '§312']

Chemical Facility Security News: February 2017
Yesterday, with both the House and Senate in session, there were 48 bills introduced. Of those one may be of specific interest to readers of this blog:
HR 1224 To amend the National Institute of Standards and Technology Act to implement a framework, assessment, and audits for improving United States cybersecurity. Rep. Abraham, Ralph Lee [R-LA-5]
This is the bill that I mentioned in yesterday’s blog post. The GPO does not yet have the official copy of this bill, but the Committee web site does have a committee draft available along with a list of proposed amendments. I haven’t had a chance to review these yet.
Labels: Bills Introduced, HR 1224, NIST Cybersecurity Framework
Today the DHS ICS-CERT published a new control system security advisory and updated another; both of those were for products from Siemens.
This advisory describes two vulnerabilities in the Siemens RUGGEDCOM NMS monitoring products. It appears that these vulnerabilities are self-reported by Siemens. Siemens has produced a new version that mitigates the vulnerabilities.
• Cross-site request forgery - CVE-2017-2682; and
• Cross-site scripting - CVE-2017-2683
ICS-CERT reports that a relatively low skilled attacker could remotely export these vulnerabilities to perform administrative operations under certain conditions.
This update address changes to an advisory that was originally published on April 12th, 2016. The new information includes:
• Updated version information for SCALANCE X200 IRT family; and
• Provides link to a new version for SCALANCE X200 IRT family.
NOTE: These were the two (oops, not three; the other was from the 13th and already reported by ICS-CERT) advisories that I mentioned last week the day after Siemens announced their notifications on TWITTER® on February 22nd.
Labels: Control System Security, ICS-CERT Advisory, ICS-CERT Update, Siemens
Today the folks at the DHS Infrastructure Security Compliance Division (ISCD) published a brief note on their CFATS Knowledge Center that they had added three new frequently asked questions (FAQ). An additional search of the Knowledge Center also showed that ISCD had updated the responses to thirteen previously released FAQ.
The three new FAQ’s are:
FAQ #1777 How do I determine “Need to Know” under Chemical-terrorism Vulnerability Information (CVI)?
FAQ #1778 The Department of Transportation (DOT), pursuant to 49 Code of Federal Regulations (C.F.R.) Part 107, has granted my facility a special permit that exempts sabotage/contamination Chemicals of Interest (COI) shipments from placarding requirements of Subpart F of 49 CFR Part 172. Pursuant to the Chemical Facility Anti-Terrorism Standards (CFATS) 6 C.F.R. Part 27, is my facility still required to report its sabotage/contamination COI holdings?
FAQ #1779 A local governmental entity operates a Public Water System (PWS) consisting of two separate facilities. Facility “A” receives a Chemical of Interest (COI) above the applicable Screening Threshold Quantity (STQ), off-loads and uses some of the COI, and then repackages the unused COI and ships it for use at PWS Facility “B.” At both facilities, the COI is used exclusively to treat drinking water to enable consumption by residents of the community serviced by the PWS. Is PWS Facility “A” required to submit a Top-Screen to report the COI to DHS, or is PWS Facility “A” an excluded facility under “The Protecting and Securing Chemical Facilities from Terrorist Attacks of 2014” Public Law 113-254 (6 U.S.C. § 621 et seq.)?
The updated FAQ’s are:
FAQ #81 How can I obtain access to the Chemical Security Assessment Tool (CSAT) User Registration web site? Last updated - August 13, 2008;
FAQ #102 I have reached a page on the Chemical Security Assessment Tool (CSAT) User Registration web site that states, "To continue, please enter the letters that are in the image below:" I cannot read the letters in the image and am unable to continue. Last updated - October 07, 2008;
FAQ #702 I was in the Chemical Security Assessment Tool (CSAT) User Registration System and got distracted. When I returned, it had timed out; can I get back in? Last updated - August 13, 2008;
FAQ #706 I have multiple usernames. Can I get rid of the duplicates? Last updated - August 14, 2009;
FAQ #707 How do I change the name of the Authorizer/Submitter/Preparer? Last updated - August 14, 2009;
FAQ #708 I have multiple usernames. Can I get rid of the duplicates? Last updated - August 08, 2008;
FAQ #711 What are the responsibilities of a Submitter? Last updated - August 14, 2009;
FAQ #715 What guidance is there regarding the selection of an Authorizer? Last updated - August 08, 2008;
FAQ #716 What is the Notification Code and where can I find it? Last updated - August 08, 2008;
FAQ #718 How do I enter additional facilities? Last updated - August 08, 2008;
FAQ #1238 How do I comply with the Chemical Facility Anti-Terrorism Standard (CFSATS) regulation if my facility does not have Internet access? Last updated - August 14, 2008;
FAQ #1392 How do I transfer my account or reassign my user role? Last updated - October 21, 2009;
FAQ #1610 Can a consultant request a user change? Last updated - November 13, 2009
Both the Senate and House will be back in Washington this week. The Senate is still working on cabinet nominations and the House has at least one more regulation reversal to deal with. There are a number of hearings this week, but only two that may be of specific interest to readers of this blog; one on cybersecurity and one on the FY 2018 spending for DHS.
On Wednesday, the House Science, Space, and Technology Committee will hold a markup hearing on an as of yet unintroduced bill on “NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017”. There is no draft of this bill publicly available at this time. I expect that the actual bill will be introduced today or tomorrow.
On Wednesday, the Homeland Security Subcommittee of the House Appropriations Committee will hold a ‘Members’ Day’ hearing to start the hearing process that will eventually lead to the introduction of the DHS spending bill. This hearing is where individual members of the House get their chance to tell the Committee what they would like to see included in the DHS spending bill.
There is nothing of specific interest to readers of this blog currently scheduled on the floor of the House. There are two bill that may have a long-term effect on the regulatory process that will make it to the floor near the end of the week; HR 1009, the OIRA Insight, Reform, and Accountability Act, and HR 1004, the Regulatory Integrity Act of 2017. Both of these bills would combine to try to make the regulatory process more regular and ‘accountable’. Most of the changes will be relatively invisible to the public, but they would provide more chances for Congress to interfere in the regulatory process. Regardless of your political view point, it is easy to see that the regulatory process will become more complex and unpredictable if these bills pass.
Labels: Committee Hearings, Cybersecurity, Cybersecurity Framework, DHS Spending
Posted by Patrick Coyle at 8:09 AM No comments: Links to this post
Last week Rep. Langevin (D,RI) introduced HR 1049, the Department of Defense Emergency Response Capabilities Database Enhancement Act of 2017. This is a companion bill to S 307; that is an identical bill introduced to allow for simultaneous action by both houses of Congress instead of serial consideration.
Langevin is a member of the House Armed Services Committee, the committee to which this bill was referred for consideration. This means that it is possible that he could have enough influence to have this bill considered in committee. As I mentioned with S 307, there is nothing in this bill which should engender significant opposition.
Labels: Cyber Emergency Response, DOD Database, HR 1049
Today the DHS ICS-CERT published three control system security advisories for products from Schneider Electric, Red Lion Controls and VIPA Controls.
This advisory describes a resource exhaustion vulnerability in the Schneider Electric Modicon M340 PLC. The vulnerability was reported by Luis Francisco Martin Liras. Schneider has released a new firmware version that mitigates the vulnerability. There is no indication that Liras has been provided an opportunity to verify the efficacy of the fix.
ICS-CERT reports that a relatively low skilled attacker could remotely exploit the vulnerability to render the device unresponsive requiring a physical reset of the PLC.
Red Lion Controls Advisory
This advisory describes a hard-coded cryptographic key vulnerability in the Red Lion Controls Sixnet-Managed Industrial Switches and the AutomationDirect STRIDE-Managed Ethernet Switch models. The vulnerability was reported by Mark Cross of RIoT Solutions. New firmware versions have been made available for both sets of devices. There is no indication that Cross has been provided an opportunity to verify the efficacy of the fix.
ICS-CERT reports that a relatively low skilled attacker could remotely exploit this vulnerability to effect the loss of data confidentiality, integrity, and availability.
VIPA Controls Advisory
This advisory describes a stack-based buffer overflow vulnerability in the VIPA Controls WinPLC7. The vulnerability was reported by Ariele Caltabiano (kimiya) through ZDI. VIPA Controls has developed a patch to mitigate the vulnerability. There is no indication that kimiya has been provided the opportunity to verify the efficacy of the fix.
ICS-CERT reports that a relatively unskilled attacker could remotely exploit the vulnerability to crash the device; a buffer overflow condition may allow remote code execution.
NOTE: Yesterday Siemens announced on TWITTER® the publication of two security notification updates (here and here) and the publication of a new security notification (here). I had almost expected ICS-CERT to publish their updates and advisory today; maybe tomorrow.
Labels: Ariele Caltabiano (kimiya), Control System Security, ICS-CERT Advisory, Luis Francisco Martin Liras, Mark Cross, Red Lion Controls, RIoT Solutions, Schneider, VIPA Controls
Last week Rep. Wilson (R,SC) introduced HR 1030, the Cyber Attack Standards of Measurement Study. The bill would require the Director of National Intelligence (DNI) to conduct a study on measuring and quantifying damage from cyber incidents.
This bill is virtually identical to HR 2708 that was introduced by Wilson in the 114th Congress. That bill was incorporated in the final version of Consolidated Appropriations Act, 2016 as §313 of Division N, the Cybersecurity Act of 2015 {PL 114-113 (129 STAT. 2920)}.
In my post on HR 2708 I noted that Wilson was not a member of the House Intelligence Committee so that there was little chance of that bill being considered in Committee. It was never taken up by the Committee, but it did apparently attract the attention of someone in the Republican leadership (or, more likely, their staff) so that it was added to the Cybersecurity Act.
What is so odd here is that Wilson is not aware that the language from HR 2708 was added to the Cybersecurity Act and felt that it was necessary to re-introduce this bill. Part of this is due to the way that the Cybersecurity Act was put together at the last minute with little communication with the members of Congress and that is part of the reason for the attempt to repeal that portion of the spending bill.
Since it has been well over a year now since the spending bill was passed, the introduction of this bill calls into question how well Wilson and his staff are working with their fellow Republicans. It is really sad that the wording of his original bill was included in a larger bill (not an unusual occurrence) and no one thought that he was influential enough to notify.
Posted by Patrick Coyle at 8:05 PM No comments: Links to this post
Labels: Cyber Incident Metrics, HR 1030
Yesterday the DHS ICS-CERT updated a control system security advisory for products from XZERES. The original advisory was published on December 8th, 2015 and then updated on December 10th, 2015. The new update describes new mitigation measures for the cross-site scripting vulnerability and adds the name of a new researcher, Tim Thurlings, to the advisory.
The new mitigation measures include:
• A new ‘Secure Gateway’ module to install between the internet and the Controller board;
• New notebooks for remote access that include a Secure Remote Connection system; and
• A work around that includes shutting down the port forwarding feature.
Labels: Control System Security, ICS-CERT Update, Tim Thurlings, Xzeres
Earlier this month Rep. Jackson-Lee (D,TX) introduced HR 940, the Securing Communications of Utilities from Terrorist Threats (SCOUTS) Act. The bill addresses the relationships between DHS and critical infrastructure in planning for, and responding to, terrorist attacks.
Section 2 of the bill sets some pretty broad policy guidelines for DHS. First it allows DHS to work with “critical infrastructure owners and operators and State, local, tribal, and territorial
entities” {§2(a)} to determine how DHS “can best serve the sector-specific cybersecurity needs to manage risk and strengthen the security and resilience of the Nation’s critical infrastructure against terrorist attacks”.
In fulfilling this policy DHS is specifically directed to “seek to reduce vulnerabilities, minimize consequences, identify and disrupt terrorism threats, and hasten response and recovery efforts related to impacted critical infrastructures” {§2(b)}. Additionally, the Secretary is allowed to “investigate the best means for engaging sector-specific agencies in participation in a voluntary cybersecurity information sharing, emergency support, and emerging threat awareness program” {§2(c)}.
Section 3 of the bill requires DHS to “implement an integration and analysis function for critical infrastructure that includes operational and strategic analysis on terrorism incidents, threats, and emerging risks” {§3(b)}. That ‘function’ will include data sharing with Fusion Centers to accomplish the following:
• Determine the appropriate role that Fusion Centers may fill in reporting data related to cybersecurity threat or incident information regarding individuals or service providers with access to or ongoing business relationships with critical infrastructure.
• Determine whether or how the National Protection and Programs Directorate and the National Cybersecurity and Communications Integration Center may work with Fusion Centers to report possible cybersecurity incidents.
• Determine a means for Fusion Centers to report availability of critical infrastructure to support local, State, Federal, tribal, and territorial law enforcement and the provision of basic public services after disruption events such as electric power brownouts and blackouts, accidents that disrupt service, and vandalism to or near facilities.
• Categorize and prioritize cybersecurity intake risk information based on relevance to critical infrastructure owners or operators in the area served by the Fusion Center.
• Establish an emerging threat hotline and secure online sector-specific cybersecurity incident reporting portal by which information may be disseminated through Fusion Centers.
• Develop, keep up to date, and make available a Federal agency directory of designated offices or individuals tasked with responding to, mitigating, or assisting in recovery from cybersecurity incidents involving critical infrastructure and make the directory available on a voluntary basis to critical infrastructure owners and operators.
• Establish a voluntary incident access portal with the ability to allow users to determine the means, methods, and level of incident reporting that is sector-specific and relevant to the recipient as defined and controlled by the recipient.
• Gather voluntary feedback from critical infrastructure owners and operators on the value, relevance, and timeliness of the information received, which shall include how they believe information and the means used to disseminate that information might be improved.
• Report to Congress every 2 years on the voluntary participation of critical infrastructure owners and operators in the programs established under this title.
• Implement a capability to collate, assess, and integrate vulnerability and consequence information with threat streams and hazard information
• Support the Department of Homeland Security’s ability to maintain and share, as a common Federal service, a near real-time situational awareness capability for critical infrastructure.
In evaluating vulnerability and consequence information the bill specifies the following cybersecurity related considerations {§3(b)(10)}:
• Evaluate the impact of cybersecurity and cyberphysical impacts of critical physical assets;
• Determine, through the voluntary cooperation of critical infrastructure owners and operators, the staffing and professional need for cybersecurity critical infrastructure protection with Fusion Centers;
• Determine, through coordination with the sector-specific agencies, the agency staffing needed to support cybersecurity critical infrastructure protection and report the findings to Congress;
• Anticipate interdependencies and cascading impacts related to cyber telecommunications failures;
• Recommend security and resilience measures for critical infrastructure prior to, during, and after a terrorism event or incident;
• Evaluate interdependencies and cascading impacts related to electric grid failures; and
• Make recommendations on preventing the collapse or serious degrading of the telecommunication capability in an area impacted by a terrorism event.
Jackson-Lee is an influential member of the House Homeland Security Committee, the committee to which this bill was assigned for consideration. She certainly has the political influence to see this bill considered in committee.
Since the bill requires no new regulations or spending, there is little to attract the ire of the Republican leadership. It is very likely that if this bill is considered that it would attract bipartisan support. I suspect that if it would make it to the floor of the House for consideration, that it would be considered under the House suspension of the rules process. This means there would be limited debate, no floor amendments and it would require a super-majority for passage.
The title of this bill is more misleading than most. The bill has only very limited influence on ‘securing communications of utilities’. It is a much more generalized counter-terrorism support of critical infrastructure bill that would probably have minimal impact on operations of DHS, fusion centers or critical infrastructure.
The term ‘cybersecurity’ is thrown into various places in the bill in a haphazard manner. We see it combined frequently with ‘critical infrastructure’ in a way that makes it unclear whether the bill is calling out a new, undefined, type of critical infrastructure or whether it is referring to cybersecurity for each of the current critical infrastructure categories.
The closest the bill comes to defining its use of cybersecurity is the definition of the term ‘security’. That is defined as “reducing the risk to critical infrastructure by physical means or defense cyber measures to intrusions, attacks, or the effects of terrorist intrusions or attacks” {§4(4)}. This is about as useless a definition as I have seen in proposed legislation.
I suspect that this bill will make it to the President’s desk as a feel-good measure for congress critters to be able to claim that they have done something about counterterrorism and cybersecurity. At least it will not cost anything; except perhaps the preemption of attempts at actually doing something.
Posted by Patrick Coyle at 10:55 AM No comments: Links to this post
Labels: Counterterrorism, Cybersecurity, HR 940, SCOUTS Act
Earlier this month Rep. Amash (R,MI) introduced HR 923 which would repeal the Cybersecurity Act (Division N, PL 114-113). Amash and his bipartisan cosponsors are concerned about the way the Cybersecurity Act was slipped into the 2016 Consolidated Appropriations Act at the last minute.
Amash introduced a similar bill (HR 4350) last year in the 114th Congress. That bill was also assigned to eight committees for consideration. No action was taken in four of those committees and the remaining four only further assigned it to subcommittees for consideration. No hearings were held and no further action was taken.
Since the Cybersecurity Act was only added to the appropriations bill with the full consent of the House Republican leadership, I do not suspect that there will be any actions taken on this bill.
Labels: Cybersecurity Act Repeal, HR 923
HR 905 Introduced – Computer Code Copywrite Transfer
Earlier this month Rep. Farenthold (R,TX) introduced HR 905, the You Own Devices Act. This bill address some of the copywrite issues related to software used to operate equipment.
Software Copywrite Issues
The bill amends 17 USC 109, “Limitations on exclusive rights: Effect of transfer of particular copy or phonorecord”. It adds a new paragraph (f) to the section. That paragraph addresses the transfer of certain computer programs.
The first provision codifies the legal transfer of the software that “enables any part of a machine or other product to operate” {§109(f)(1)} when that machine or product is legally sold or otherwise transferred.
The second provision addresses software updates. It specifies that the right to receive any software changes related “in whole or in part to security or error correction” {§109(f)(2)} is transferred along with any transfer of the equipment that the software operates.
The third provisions prohibits the retention of a copy of the software when a party transfers the equipment and/or software to another party.
Farenthold is a member of the House Judiciary Committee (the committee to which this bill was assigned for consideration) so there is a decent possibility that this bill could be considered in committee. There may be some opposition to the update provisions of this bill from some software vendors, so it is unclear at this point if there would be enough support in the House for the bill to allow it to be considered under suspension of the rules. It is unlikely that this bill would make it to the floor of the House under a rule.
If the bill were considered in the House, I suspect that it would pass.
I think that this bill could end up being important for security researchers. The first provision allowing that legally buying software operated equipment automatically includes the legal transfer of the copy of the operation software precludes a vendor from threatening to prosecute researchers for illegally accessing the software.
The second provision means that when a researcher finds a vulnerability in a piece of control system software and the vendor issues an update or patch, the researcher is entitled to obtain a copy of that patch or update as long as he owns a piece of equipment that uses that software to operate. This would make it easier for the researcher to determine the efficacy of the fix.
One software related copywrite issue that is not addressed in this bill is the legal right to modify software used to operate a piece of equipment.
Posted by Patrick Coyle at 3:13 PM No comments: Links to this post
Labels: Computer Code Copywrite Transfer, HR 905
Posted by Patrick Coyle at 9:28 PM 1 comment: Links to this post
Yesterday with the House and Senate getting ready to depart for their Presidential Day recess next week there were 154 bills introduced. Many of these bills were introduced to provide fundraising talking points next week, but one of the bills may be of specific interest to readers of this blog:
S 412 A bill to amend the Homeland Security Act of 2002 to require State and local coordination on cybersecurity with the national cybersecurity and communications integration center, and for other purposes. Sen. Peters, Gary C. [D-MI]
It will be interesting to see how this bill avoids the ‘unfunded federal mandate’ label. I’ll only be covering this bill if it specifically includes control system security issues.
Posted by Patrick Coyle at 6:23 PM No comments: Links to this post
Labels: Bills Introduced, Cybersecurity Coordination, S 412
Yesterday the US Attorney’s Office for the Middle District of Louisiana announced that an individual had been sentenced to serve 34 months and pay $1.1 million as a result of his conviction for “for hacking into the computer system of an industrial facility to disrupt and damage its operations”. This appears to be the first conviction for an attack on an industrial control system in the United States.
There is very limited information available on the attack. What is publicly available is that a fired IT worker at the Georgia Pacific Port Hudson Mill (Port Hudson, LA, just north of Baton Rouge) accessed “the control and quality control systems for making paper towels” according to one news report. The attack was conducted via a virtual private network (VPN) connection to the plant computer network.
A plant spokesman was quoted as saying: “"Things that were automatic were completely shut down.”
Another news report notes that there were multiple attacks on the facility computers between February 14th and 27th in 2014.
On the face of it, this does not appear to have been a sophisticated attack involving unknown or ineffectually mitigated control system vulnerabilities. Rather it looks like a fairly standard case of a system-knowledgeable person who did not have his system access adequately revoked when he was terminated.
The individual was convicted for violations of 18 USC 1030(a)(5)(A). Section 1030 is known as the “Fraud and related activity in connection with computers” section of the US Code and was designed to deal with financial crimes dealing with computers. The specific sub-paragraph charged explains the offense as whoever “knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer”.
The key definition here is that for a ‘protected computer’. The first part of that definition applies specifically to computers at financial institutions or the US government; which obviously does not apply in this case. Instead the second part of the definition (which I’ll call the ‘interstate commerce clause’) which states:
A computer “which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States” {§1030(e)(2)(B)}.
Since Georgia Pacific is a multi-national company that certainly sells materials from this facility across state-lines, it would be easy how to see that the US Attorney could argue that this attack had a significant effect on either interstate and foreign commerce if the damage caused by the attack interfered with timely product shipments.
In establishing the ability for the court to punish a violation of §1030(a)(5)(A) the prosecution would have to prove that the attack resulted in one of six specific types of harm outlined in §1030(b)(4)(A)(i). Only four of those are potential interest in this case:
• Loss to 1 or more persons during any 1-year period aggregating at least $5,000 in value;
• Physical injury to any person;
• A threat to public health or safety;
• Damage affecting 10 or more protected computers during any 1-year period.
Give the $1.1 million restitution ordered by the court, I would assume that the US Attorney used the first harm category.
There is nothing in readily available information on this case that explains how the damage of $1.1 million occurred. Having worked in a company that sold into the paper industry for years I have learned a little about the paper making process. As each large paper roll is made any interruption of the machinery making that roll significantly damages that roll and requires a restart of a fresh roll of paper. If stoppages occurred on multiple occasions that week, I suspect that an accounting of damaged rolls and lost production could total $1.1 million without having to have included any physical damage to the equipment at the facility.
These attacks happened in 2014 and the Federal Grand Jury indicted the individual in 2015. There is no indication that the DHS ICS-CERT was involved in the investigation of the incident (and given the rapidity with which the FBI responded to the issue, it does not appear that it would have been necessary).
It would have been nice, however, if ICS-CERT had been brought into the case early on, not so much to help in the arrest and prosecution of the perpetrator, but so that ICS-CERT could publicize the attack to the ICS community. This could have been used to reinforce the need for some basic security procedures (revocation of access) and to point out (again) the vulnerability of ICS to easy attacks by anyone with control system network access.
It is not too late, however, for ICS-CERT to prepare a public report on this attack. While there was no trial for this case (the perpetrator plead guilty) there was a grand jury indictment in which the process of the attack had to presented in some detail. That should provide enough detail for ICS-CERT to prepare a relatively detailed report on the attacks.
This case also raises some interesting legal questions (DISCLAIMER: I AM NOT A LAWYER) about the adequacy of §1030 for the prosecution of attacks on industrial control systems. There have been a couple of attempts to amend §1030 (for example S 2931 in the 114th Congress) to specifically address industrial control system attacks, but none of them have proceeded past the introduction phase.
The big problem is that §1030 is a fraud related section of the US Code and attacks against control system (other than perhaps ransomware attacks) are not really related to fraud. The problem is further aggravated by the fact that the definition of computer used in that section is really designed to identify IT or communications systems not industrial control systems. Since this bill never came to trial, the use of this section to prosecute ICS related attacks has not really been legally tested.
I am sure that the US Attorney was prepared to argue that the definition could be interpreted (very broadly) to have included control system computers. A defense lawyer, on the other hand, could argue that the failed congressional attempts to specifically include ICS computers in the definition reflect a congressional intent not to allow that inclusion.
Unfortunately, it is impossible to determine in advance how a specific court would deal with such arguments. Appellate court acceptance of any outcome of that decision would be even harder to predict. The fact that this individual’s legal team did not (apparently) recommend such a fight of the prosecution might simply reflect the legal cost of such a fight rather than having reached a conclusion on the merits of the use of §1030 to prosecute an ICS attack.
That fight is almost certain to occur on some future case.
NOTE: Thanks to Chris Sistrunk for sharing the press release on this case on the ICS-ISAC Open Community on Facebook.
Posted by Patrick Coyle at 5:33 PM No comments: Links to this post
Labels: §1030, Georgia Pacific, ICS Attack
Today the DHS ICS-CERT published an update to their control system security advisory for products from Rockwell Automation that was originally published on September 15th, 2016. The update provides information on:
• A new software version to replace the original patch mitigation;
• More detailed information on the affected versions; and
• Notification that the previous patch is only to be used on version 8.40.00.
Posted by Patrick Coyle at 6:46 PM No comments: Links to this post
Labels: Control System Security, ICS-CERT Update, Rockwell
Yesterday, with both the House and Senate in session, fifty bills were introduced in Congress. Of those two may be of specific interest to readers of this blog:
HR 1030 To direct the Director of National Intelligence to conduct a study on cyber attack standards of measurement. Rep. Wilson, Joe [R-SC-2]
HR 1049 To enhance the database of emergency response capabilities of the Department of Defense. Rep. Langevin, James R. [D-RI-2]
HR 1030 is almost certainly a repeat of HR 2708 that was introduced in the 114th Congress and died in committee. This will probably suffer the same fate.
HR 1049 is probably going to be a companion bill to S 307 that was introduced earlier this month in the Senate; the official text is still not available on S 307, but there is a draft available. Interesting post here on S 307.
Labels: Bills Introduced, Cyberattack Measurement, DOD Cybersecurity Database, HR 1030, HR 1049
Today the DHS ICS-CERT published three control system security advisories for products from Siemens, Geutebrück and Advantech. They also updated three control system security advisories for products from Siemens and Rockwell.
This advisory describes an authentication bypass vulnerability in the Siemens SIMATIC Logon application. This vulnerability is being self-reported by Siemens. Siemens has produced an updated version of the application to mitigate the vulnerability.
ICS-CERT reports that an relatively low skilled attacker could remotely exploit this vulnerability to circumvent user authentication under certain conditions.
Geutebrück Advisory
This advisory describes two vulnerabilities in the Geutebrück G-Cam IP camera. The vulnerabilities were reported by Davy Douhine of RandoriSec, Florent Montel and Frédéric Cikala. There is no indication that the researchers were provided an opportunity to verify the efficacy of the fix.
• Authentication bypass using an alternative path or channel - CVE-2017-5174;
• Improper neutralization of special elements used in an OS command - CVE-2017-5173
ICS-CERT reports that a relatively low skilled attacker could remotely exploit these vulnerabilities to bypass authentication and obtain remote anonymous access to the device; these vulnerabilities may allow remote code execution.
This advisory describes a DLL hijacking vulnerability in the Advantech WebAccess application. The vulnerability was reported by Li MingZheng Kuangn. Advantech has produced a new version to mitigate the vulnerability. There is no indication that the researcher has been provided an opportunity to verify the efficacy of the fix.
ICS-CERT reports that a relatively low skilled attacker could exploit the vulnerability o execute arbitrary code within the system. ICS-CERT does not mention what type access is required or comment on the need for an social engineering attack.
Siemens APOGEE Update
This update provides additional information about an advisory originally published on March 22nd, 2016. The update includes:
• A correction of the name of one of the reporting institutions;
• Additional information about the affected versions; and
• Reports a new version that mitigates the vulnerability.
Siemens Industrial Produces Update
This update provides additional information about an advisory originally published on November 8th, 2016 and then updated on November 22nd, 2016 and updated again on December 22nd. The update includes:
• Updated ‘version affected’ information on SIMATIC IT Production Suite;
• Provided mitigation information for SIMATIC IT Production Suite; and
• Removed SIMATIC IT Production Suite from the temporary fix list.
This update provides additional information about an advisory originally published on January 5th, 2017. The update includes:
• Adds PowerFlex 700S drives to the list of affected devices;
• Adds DriveLogix 5730 controller option explanation; and
• Explains that the PowerFlex 700S is not covered by the new firmware version mitigation.
Labels: Advantech, Control System Security, Davy Douhine, Florent Montel, Frédéric Cikala, Geutebrück, ICS-CERT Advisory, ICS-CERT Update, Li MingZheng Kuangn, RandoriSec, Rockwell, Siemens
Both the House and Senate will be in session this week. The House continues to focus on repealing Obama Administration regulations and the Senate focuses on Cabinet nominations. There will be two cybersecurity related hearings that may be of interest to readers of this blog.
On Tuesday the Digital Commerce and Consumer Protection Subcommittee of the House Energy and Commerce Committee will hold a hearing to look at “Self-Driving Cars: Road to Deployment”. The witness list includes:
• Mike Abelson, General Motors;
• Nidhi Kalra, RAND Center for Decision Making Under Uncertainty;
• Anders Karrberg, Volvo Car Group
• Joesph Okpaku, Lyft
• Gill Pratt, Toyota Research Institute
None of the current witness statements mention cybersecurity concerns with self-driving vehicles. Perhaps we will see some discussion during the questioning phase of the hearing. You probably should not hold your breath.
US Cybersecurity Capabilities
On Tuesday the Research and Technology Subcommittee of the House Science, Space, and Technology Committee will hold a hearing on “Strengthening US Cybersecurity Capabilities”. The witness list includes:
• Charles H. Romine, National Institute of Standards and Technology (NIST);
• Iain Mulholland, VMware, Inc;
• Diana Burley, The George Washington University; and
• Gregory Wilshusen, Government Accountability Office (GAO)
Witness testimony documents are not yet available, so it is too early to tell if industrial control system security will be mentioned, but with no witnesses specifically representing ICS organizations it is probably not happening. The document to watch will be the new GAO report.
Committee Hearings, Cybersecurity Capabilities, Self-Driving Cars
Labels: Committee Hearings, Cybersecurity Capabilities, Self-driving Cars
Earlier this month Sen. Daines (R,MT) introduced S 278, the Support for Rapid Innovation Act of 2017. The bill would require the DHS Science and Technology Directorate to support the research, development, testing, evaluation, and transition of cybersecurity technologies.
The bill would add a new §312, Cybersecurity Research and Development, to Title III of the Homeland Security Act of 2002 (6 USC 181 et seq). The new section outlines a number of areas of cybersecurity research, including {§321(b)}:
• Advancing the development and accelerating the deployment of more secure information systems;
• Improving and creating technologies for detecting and preventing attacks or intrusions;
• Improving and creating mitigation and recovery methodologies;
• Assisting the development and supporting infrastructure and tools to support cybersecurity research and development efforts;
• Assisting the development and support of technologies to reduce vulnerabilities in industrial control systems [emphasis added];
• Assisting the development and support cyber forensics and attack attribution capabilities;
• Assisting the development and accelerating the deployment of full information lifecycle security technologies to enhance protection, control, and privacy of information to detect and prevent cybersecurity risks and incidents;
• Assisting the development and accelerating the deployment of information security measures, in addition to perimeter-based protections;
• Assisting the development and accelerating the deployment of technologies to detect improper information access by authorized users;
• Assisting the development and accelerating the deployment of cryptographic technologies to protect information at rest, in transit, and in use;
• Assisting the development and accelerating the deployment of methods to promote greater software assurance;
• Assisting the development and accelerating the deployment of tools to securely and automatically update software and firmware; and
• Assisting in identifying and addressing unidentified or future cybersecurity threats.
The bill also specifies that no additional funding is provided to support these research efforts. It closes by noting that {§2(c)}: “Such requirements shall be carried out using amounts otherwise authorized.”
Daines is a member of the Senate Homeland Security and Governmental Affairs Committee, the committee to which this bill was assigned for consideration. This means that there is at least the potential that the Committee will consider this bill. If the bill were considered, it is likely that it would be approved since there are no new regulations or spending authorized by the bill. Similarly, if the bill were to make it to the floor of the Senate, it would likely pass. It is too early to tell if there is the necessary political will to advance this bill.
Back on January 10th the House passed HR 240 by a voice vote with limited debate. HR 240 is a companion bill to S 278 according to the introductory speech (pgs S 657-8) by Daines. There was no committee action on HR 240 in the House Homeland Security Committee.
It is a good thing that industrial control systems are specifically mentioned in the bill since the bill relies on the IT limited definition of ‘information system’ both in the bill {new §312(e)(4)} and as a part of the support for the definition of the term ‘incident’ {new §312(e)(4)}. That information system definition is found in 44 USC 35002(8).
Given the funding limitation in this bill and the long list of cybersecurity research activities to be supported, it is extremely unlikely that the bill will result in any new significant cybersecurity research support. But passing the bill would make it look like Congress is doing something; appearances are everything.
Posted by Patrick Coyle at 9:38 PM No comments: Links to this post
Labels: Cybersecurity Research, HR 240, S 278
I read an interesting blog post by Michael Kennedy about President Trump’s executive order entitled “Reducing Regulation and Controlling Regulatory Costs” (EO 13771). Anyone trying to predict the regulatory burden of the new Trump administration should read Michael’s post. The new powers given to the OMB Director (and presumably through the Office of Information and Regulatory Affairs – OIRA) just mean that the White House will retain tighter control over the regulatory actions of the Executive Branch.
There is an additional caveat restricting the application of this EO. In multiple place we see phrases like “unless otherwise required by law”. The EO explicitly acknowledges that regulations required by statute must be implemented by the Executive Branch. This includes, for instance, the current DOT rulemaking on security training for surface transportation organizations.
Before anyone gets too excited about the prospects of reduced Federal regulations we need to wait and see what the Spring 2017 Unified Agenda looks like. That will provide the first formal look at what the Administration really intends to do in the regulatory arena. But even that will not be the final story.
One thing is already clear; Donald Trump is a man who expects to get his way. I suspect that we will see him continue the Obama legacy of legislating via executive order. And implementation of those orders will require regulations. And those regulations will be much harder to predict.
Posted by Patrick Coyle at 6:49 AM No comments: Links to this post
Labels: EO 13771, Regulatory Agenda
Posted by Patrick Coyle at 7:40 AM No comments: Links to this post
Today the DHS ICS-CERT published an industrial control system advisory for products from Hanwha Techwin. The advisory describes two vulnerabilities in the Hanwha Techwin Smart Security Manager. The vulnerabilities were reported by Steven Seeley of Source Incite. Hanwah Techwin has produced a patch to mitigate the vulnerability. There is no indication that Seely has been provided an opportunity to verify the efficacy of the fix.
• Path traversal - CVE-2017-5168; and
• Cross-site request forgery - CVE-2017-5169
ICS-CERT only notes that the vulnerabilities are remotely exploitable and reports that a successful exploit could lead to create an arbitrary file on the server with attacker controlled data as well as an attacker gaining root shell access.
Posted by Patrick Coyle at 7:13 PM No comments: Links to this post
Labels: Control System Security, Hanwha Techwin, Source Incite, Steven Seeley
With both the House and Senate in session there were 133 bills introduced yesterday. Of those six may be of specific interest to readers of this blog:
HR 905 To amend title 17, United States Code, to provide that the first sale doctrine applies to any computer program that enables a machine or other product to operate, and for other purposes. Rep. Farenthold, Blake [R-TX-27]
HR 923 To repeal the Cybersecurity Act of 2015. Rep. Amash, Justin [R-MI-3]
HR 935 To codify an office within the Department of Homeland Security with the mission of strengthening the capacity of the agency to attract and retain highly trained computer and information security professionals, and for other purposes. Rep. Jackson Lee, Sheila [D-TX-18]
HR 940 To secure communications of utilities from terrorist threats, and for other purposes. Rep. Jackson Lee, Sheila [D-TX-18]
HR 945 To codify the objective of Presidential Policy Directive 21 to improve critical infrastructure security and resilience, and for other purposes. Rep. Jackson Lee, Sheila [D-TX-18]
HR 955 To require the Director of National Intelligence to conduct a study on the feasibility of establishing a Cyber Defense National Guard. Rep. Jackson Lee, Sheila [D-TX-18]
It looks like HR 905 would allow the purchaser of ICS software or firmware to sell or transfer that software without permission of the vendor; see 17 USC 109. This may be an interesting bill.
HR 923 is likely a repeat of HR 4350 introduced in the 114th Congress. The House leadership killed that bill by referring it to eight separate committees for consideration; no action was taken in any of the committees.
HR 935 looks to be a repeat of HR 53 introduced in the 114th Congress; no action was taken on HR 53.
It looks like HR 940 is new legislation. If it contains specific mention of control system security, it will be covered in this blog.
I will be watching HR 945 for mention of cybersecurity, chemical facility security and/or chemical transportation security.
It looks like HR 955 will be a repeat of HR 60 in the 114th Congress; no action was taken on that bill.
Labels: Bills Introduced, Cybersecurity, HR 905, HR 923, HR 935, HR 940, HR 945, HR 955
I missed it last night, but yesterday the DHS ICS-CERT updated a controls system security advisory for products from BINOM3. That advisory was originally published on January 31st, 2017.
The new update greatly expands the impact assessment of the multiple vulnerabilities. Instead of just allowing inaccurate reporting of electric quality measurements, the new impact statement reports:
“Successful exploitation of these vulnerabilities could cause unauthorized access to the device, sensitive information leakage, arbitrary script/code execution, unauthorized functional configuration and data changes, and denial-of-service attacks.”
Labels: BINOM3, Control System Security, ICS-CERT Update
Yesterday, with both the House and Senate in session, there were 54 bills introduced. Once of those may be of specific interest to readers of this blog:
HR 876 To amend the Homeland Security Act of 2002 to reform programs of the Transportation Security Administration, and for other purposes. Rep. Katko, John [R-NY-24]
I’ll only be covering this bill if it includes surface transportation security provisions related to the transportation of chemicals.
Labels: Bills Introduced, HR 876, TSA Reform
Posted by Patrick Coyle at 8:23 PM 1 comment: Links to this post