Rockwell urges users to disconnect ICS equipment

Vulnerable to attack

Ken Dunham, director of cyber threat at the Qualys Threat Research Unit, said: “The Rockwell Automation alert recommends immediate removal of any device that is currently installed with public internet connectivity, for which it was not designed. This may seem like common sense, but all too often in a world of ‘Hello, it works,’ organisations find themselves in a situation where hardware and software are installed and configured in ways that are not recommended and are vulnerable to attack.”

He urged Rockwell customers to pay close attention. “Automated industrial control systems [ICS] are a prime target for attack by adversaries that wish to impact critical infrastructure, especially in a high-volatility year of elections and war,” said Dunham.

Forescout research vice-president Elisa Costante added: “Despite decades of efforts, the threat to critical infrastructure via industrial control systems remains alarmingly high, with Forescout Research – Vedere Labs ranking these systems as the fifth-riskiest in operational technology.

“Even as cyber attacks bridge the digital and physical worlds, impacting our physical health and safety, advisories often fall short of offering comprehensive risk assessments,” she said. “Forescout recently uncovered 90,000 vulnerabilities without a CVE ID, and identified network-attached storage, IP cameras, building automation devices and VoIP equipment as the most exploited OT [operational technology] and IoT [internet of things] devices.

“It’s crucial that we adopt network-centric defence strategies, harden devices, segment networks and vigilantly monitor systems to mitigate rising OT threats and secure all managed and unmanaged devices,” said Costante. “Now is the time to address this and prevent a potential mass attack.”

Rockwell’s warning comes amid a growing sense of alarm across the cyber security industry over the activities of state-backed espionage operations, such as China’s Volt Typhoon, which is known to have targeted critical infrastructure operations – heavy users of ICS tech – for intrusion, and according to the US authorities, may be laying the groundwork for a major, multi-pronged cyber offensive should the geopolitical situation deteriorate.

In a related development, researchers at Mandiant today reported on the growing use of operational relay box (ORB) networks by Chinese state threat actors.

ORB networks are short-lived, frequently cycled networks that function somewhat like traditional botnets, comprising largely virtual private servers rented by contractors, and compromised internet of things devices and even consumer routers. Because they are frequently changed up, ORB networks render so-called indicator of compromise (IoC) extinction – where a known IoC ceases to be used or valid – a greater concern, leaving defenders struggling to keep up.

Mandiant said that while ORBs are not new in and of themselves, their enthusiastic adoption in the Chinese cyber espionage community points to a growing investment in sophisticated tradecraft.