Exposed Infrastructures: Discovery, Attacks and Remediation of Insecure ICS Remote Management Devices

Abstract

Geographically distributed infrastructures, such as buildings, dams, and solar power plants, are commonly maintained via Internet-connected remote management devices. Previous studies on detecting and securing industrial control systems (ICS) have overlooked these remote management devices, as they do not expose ICS-specific services like Modbus and BACnet and thus do not show up in Internet-wide scans for such services. In this paper, we implement and validate a discovery method for these devices via their Web User Interface (WebUI) and detect 890 devices in Japan alone. We also show that many of these devices are highly insecure. Many allow access to the status or even the control over industrial systems without proper authentication. Taking a closer look at three prevalent remote management devices, we discovered 13 0-day vulnerabilities, several of which were rated as medium or high severity. They have been responsibly disclosed to the manufacturers. By using honeypots that imitate these systems, we show that over time, only a small number of attackers enter these systems, but some do change critical parameters. Attackers appear to interact more with the system when more facility information is displayed on the WebUI. Finally, we notified operators of 317 vulnerable remote management devices by email and telephone. We reached 212 persons in charge of the devices and received confirmation that our method had correctly identified the device. 50% of the persons in charge of the devices stated that they mitigated or will mitigate the problem. We confirmed their actions via a followup scan for vulnerable devices and found that measures were taken for 58% of the devices when we could reach the persons in charge of the device.

Performance, privacy, and security issues of TCP/IP at the application layer: A comprehensive survey

“…Telnet serves as a communication tool, allowing users to interact with devices located at remote locations. Network administrators commonly utilize Telnet for accessing and managing remote devices by establishing connections through the IP address or hostname of the remote device [91]. Figure 4 below illustrates the Telnet.…”

Critical Relation Path Aggregation-Based Industrial Control Component Exploitable Vulnerability Reasoning

“…Exploiting such vulnerability allows a remote authenticated attacker to escalate the privilege. The attacker may manipulate the ICS devices connected to the DL8 [29].…”

Compromising Industrial Processes using Web-Based Programmable Logic Controller Malware

“…In the ICS domain, malicious front-end code can be pushed to a programmable controller through the legitimate channels discussed in Section IV-B and perpetually executed on a multitude of browser-equipped devices throughout the industrial network [16]. [17]. In this work, Sasaki et al scanned the public Internet to find Remote Management Device web portals (these servers are often intentionally Internet-facing since they are meant to be used remotely) and performed successful penetration tests on interfaces made by various mid-sized vendors.…”