Protect your corporate IT network from hackers and other unwanted intruders with Proxy Sentinel™. Click here for all the details and get the peace of mind you deserve.
Back to our Homepage Proxy Sentinel™ high performance Internet proxy server and secure firewall solution Firewall Sentinel™ secure & powerful Internet firewall solution About Internet Security.ca and GCIS Frequently Asked Questions on Internet security issues Internet Security Industry News - Stay informed of what's happening Contact Internet Security.ca today and order your Proxy Sentinel™ or Firewall Sentinel™ server now!

Another critical security issue in control kits from Schneider Electric

Sponsered ads:
Read the latest IT news. Visit ItDirection.net. Updated several times daily.

If you need reliability when it comes to SMTP servers, get the best, get Port 587.

Get a powerful Linux Dual-Core dedicated server for less than $2.67 a day!

Share on Twitter.

November 1, 2016

Security researchers have discovered another critical security vulnerability in industrial control systems made by Schneider Electric. That's on top of what other security issues were discovered last week in the popular systems.

System crashing security flaws in the physical HMI (Human Machine Interface) hardware, dubbed PanelShock by security researchers, follow just a few days after the earlier disclosure of security vulnerabilities in Schneider Electric’s Unity simulator (PLC programming framework).

The security issues were discovered by researchers from Check Point and cybersecurity startup Critifence, among others.

“Vulnerabilities of the physical HMI hardware affect all the Magelis HMI series,” explained Eran Goldstein, CTO and co-founder of cybersecurity startup Critifence. “In addition our zero-day vulnerabilities doesn’t require any software to be installed on the target server,” he asserted.

Security problems in the Web Gate service of the Magelis Advanced HMI panels series create a means for an attacker to “freeze” the panel remotely and disconnect the HMI panel devices from the SCADA network.

This prevents the panel from communicating with PLCs and other various devices on an industrial control network.

The latest security flaws are “totally different” to the recently disclosed bugs affecting Unity Simulator, he added.

Schneider Electric did confirm what it describes as a potential DDoS risk. The firm has pushed out an advisory to customers offering mitigation advice. A more comprehensive fix is not due for four months until next March.

The use cases identified demonstrate the ability to generate a freeze condition on the HMI that can lead to a denial of service due to incomplete error management of HTTP requests in the Web Gate Server.

While under attack via a malicious HTTP request, the HMI may be rendered totally unable to manage communications due to high resource consumption.

This can lead to a loss of communications with devices such as Programmable Logic Controllers (PLCs), and require a reboot (or more than one reboot) of the HMI in order to recover.

Exploitation of this security vulnerability requires the Web Gate Server to be activated. By default, this function is disabled.

The security flaw rates a CVSS Score of 7.5 (hot as in a Madras but short of a Vindaloo in curry equivalency).

Goldstein explained that the vulnerability - which for now remains unresolved - is more serious than its designation as a DDoS risk might imply, and that's what makes all of this so critical.

“The exact security vulnerability is uncontrolled resource consumption (as documented in CVE-2016-8367 and CVE-2016-8374 by ICS-CERT and MITRE),” Goldstein asserted.

“But despite the fact that we are talking about pretty simple DDoS attacks, they are still dangerous in this case and can cause serious damage to any system,” Goldstein added.

“By freezing the HMI panel devices it could cause the supervisor or operator to perform the wrong actions, which may further damage the whole factory or plant operations,” he warned.

Magelis Advanced HMI Panel devices are still vulnerable to PanelShock attacks as Schneider Electric's advisory explains “current owners of the following affected products will be able to upgrade Video Designer to a new software offering with new run times for their units in March 2017”.

Source: AV-TEST.org.

Sponsered ads:
Read the latest IT news. Visit ItDirection.net. Updated several times daily.

If you need reliability when it comes to SMTP servers, get the best, get Port 587.

Get a powerful Linux Dual-Core dedicated server for less than $2.67 a day!

Share on Twitter.


Home | Proxy Sentinel™ | Firewall Sentinel™ | FAQ | News | Sitemap | Contact
Copyright © Internet Security.ca    Terms of use    Privacy agreement    Legal disclaimer