Microsoft finds critical vulnerabilities in equipment that could be used to shut down...

[nanoguy]

Why it matters: One of the problems with industrial equipment is that it rarely gets patched for security flaws unless something isn't working and impeding production or causing other major issues. Microsoft's cybersecurity team has found several security flaws in a widely-used software development kit for programable logic controllers, so many machine builders and integrators will have to find a way to deploy the relevant patches as soon as possible.

Microsoft researchers believe they've identified not one, but multiple high-severity security vulnerabilities in widely-used industrial software that could be used by threat actors to "shut down power plants."

In the report, Microsoft threat intelligence specialist Vladimir Tokarev details no fewer than 15 flaws in the CODESYS V3 software development kit (SDK), which is used for millions of programmable logic controllers (PLC) in industrial environments worldwide. The vulnerabilities are tracked as CVE-2022-47379 through CVE-2022-47393 and have received severity ratings ranging from 7.5 to 10 out of 10.

Map of CODESYS devices exposed to the Internet

More than 500 manufacturers of such equipment leverage the CODESYS V3 SDK to program over 1,000 different PLC models and develop custom automation applications across a variety of use cases, from CNC and robotics to motion control, power delivery for data centers, medical technology, and safety systems, to the automation of commercial and residential buildings. However, Microsoft's security team focused its efforts primarily on embedded code targeting devices from Wago and Schneider Electric.

While this simplifies the work of engineers, the embedded code that makes all of this possible is vulnerable to remote code execution and denial of service attacks. And while exploiting the 15 vulnerabilities requires an attacker to authenticate, that wouldn't be a major barrier for motivated threat actors looking to tamper with industrial operations in factories or energy infrastructure.

The humble PLC is the heart and brain of industrial and commercial automation

Microsoft reported its discovery to CODESYS in September 2022, and patches are being rolled out by the latter company to address the security flaws in question. The biggest priority for system admins should be to upgrade to CODESYS V3 v3.5.19.0 as soon as possible, while Microsoft security experts also recommend disconnecting PLCs, routers, and other relevant infrastructure from the Internet and segmenting it to lower the attack surface.

Additionally, the Microsoft 365 Defender team has released an open-source software tool that can help engineers and admins determine which devices in their infrastructure are vulnerable or if they've already been compromised.

Permalink to story.

https://www.techspot.com/news/99774-microsoft-finds-critical-vulnerabilities-plcs-could-used-shut.html

 

[waclark]

MS is just finding this out? There were people testifying before Congress back in 1998 who said this. It's not even that hard. A Molotov cocktail at the right remote substation location would be equally effective.

 

[wiyosaya]

MS is just finding this out? There were people testifying before Congress back in 1998 who said this. It's not even that hard. A Molotov cocktail at the right remote substation location would be equally effective.

And, of course, Congress totally ignored it and did, as usual, nothing meaningful.

 

[gamerk2]

And, of course, Congress totally ignored it and did, as usual, nothing meaningful.

Because most things require this wonderful thing called MONEY.

 

[waclark]

And, of course, Congress totally ignored it and did, as usual, nothing meaningful.

Well, it's hard to say what, if anything Congress could have done about it. Also, it's hard to tell from this article how much of a problem it is in the US. If you look at the graphic, it appears to be a much larger problem in Europe, which Congress has no control over. Also, it mentions "industrial" environments and then tries to link that to the power grid, but I saw nothing in the article that showed how power plants are using these controllers and how widespread the usage is.

 

[hwertz]

Really the moral of the story is "don't connect your industrial equipment to the internet". I'm not surprised these systems have security flaws -- the goal is to run reliably for decades and be failsafe, not security in the face of bad actors. I AM surprised that Microsoft found these systems Internet-exposed to futz with to begin with. I remember seeing dire warnings already in the 1990s, and again in the 2000s, basically every couple years, saying that these industrial systems in general have very poor security by "open internet" standards and please keep them on a secured network if they are networked at all.