14 Kritische Vulnerabilitäten im NicheStack TCP/IP Stack exponieren OT Devices zu Remote Attacks

14 Kritische Vulnerabilitäten im NicheStack TCP/IP Stack exponieren OT Devices zu Remote Attacks

Im August 2021 uncovered Forescout Research Labs und JFrog Security Research 14 Serious Flaws im NicheStack TCP/IP Stack, die sie INFRA:HALT nannten.

Der NicheStack Stack Powers ein Wide Array von Operational-Technology (OT) Devices Across Critical Infrastructure Sektoren – Manufacturing, Water Treatment, Power Generation und mehr – making it ein High-Profile Target für Adversaries.

Diese Defects Allow Attackers zu Perform Remote Code Execution, Launch Denial-of-Service Attacks, Steal Sensitive Information, Spoof TCP Connections und Poison DNS Caches.

Industrial Control Systems Under Threat

Die Findings Underscore How Aging, Internet-Connected OT Systems Remain Vulnerable. „Es ist ein Unfortunate Example der Huge Vulnerability einer Aging Infrastructure, die Been Connected, Directly oder Indirectly, zum Internet“, sagt Curtis Simpson, CISO bei Armis.

Brian Kim von Forrester Research Advises Critical-Infrastructure Operators zu First Map Their OT Assets, Then Adopt a Zero-Trust Posture That Enforces Least Privilege, Network Segmentation und Strict Allow-Lists.

„Einer der Besten Wege, We Can Reduce the Impact of a Breach Is a Zero-Trust Strategy By Limiting the Communications of These Industrial Control Systems“, erklärt Kim. „We Can Create an Allow List That Only Permits Communications With Control Systems That Run a Process – Allowing Least Privilege für Network Connections – Und Ideally Place a Barrier Between IT und OT, Segmenting Each Facility Into Its Own Network.“

JFrog und Forescout Will Present a Webinar on August 19 to Detail How the Vulnerabilities Were Discovered und die Mitigation Steps Operators Can Take.

Rising Attacks on Critical Infrastructure

Recorded Future Reported Roughly 65.000 Ransomware Attacks Last Year Alone.

Attackers Are Drawn to OT Devices Because They Often Lack Modern Security Controls. Compromise of a Single Device Can Cripple Operations, Prompting Organizations zu Consider Paying Ransom to Restore Services.

„The Nature of These Vulnerabilities Could Lead to Heightened Risk und Expose National Critical Infrastructure At a Time When the Industry Is Seeing an Increase in OT Attacks Against Global Utilities, Oil and Gas Pipeline Operators, As Well As Healthcare und the Supply Chain“, Warned Forescout Research Labs.

Once a Device Is Compromised, the Vulnerable Stack Can Serve as an Entry Point für Malware zu Spread Throughout an Organization's IT Network.

Brian Kim Highlighted the Colonial Pipeline Incident as a Stark Reminder That Critical Infrastructure Systems Are Not Isolated; They Are Interconnected „Systems of Systems“ That Can Propagate Attacks Across Supply Chains.

„Ultimately, Operators Must Shift Their Perspective Toward Comprehensive Resilience“, Concluded Kim. „A Strong Focus on Security und Resilience Is Essential für Protecting the Critical Infrastructure They Manage.“