Perch Indicators - 02 October 2018
WaterISAC entered over 220 indicators of compromise regarding recent open source reporting. Perch users subscribed to the WaterISAC Community will be able to detect the following within their environment:
Cybersecurity
Improving ICS Cybersecurity with Defense-in-Depth Strategies (DHS)
A recommended practice document from the NCCIC provides guidance for developing mitigation strategies for specific cyber threats and direction on how to create a Defense-in-Depth security program for control system environments.
Director of National Intelligence Warns Chinese Cyber Activities Target State and Local Governments
Director of National Intelligence Dan Coats issued one of the starkest and most explicit warnings to date about China's cyber activities, calling them "unprecedented in scale" and explicitly aimed at undermining U.S. interests. In remarks at The Citadel, Coats said the Chinese government is actively targeting U.S. state and local governments and officials, "trying to exploit any divisions between federal and local levels on policy." He did not name either states or officials, nor did he elaborate on which policies had been targeted.
October is National Cyber Security Awareness Month
This October, National Cybersecurity Awareness Month (NCSAM) is commemorating its fifteenth year as an annual initiative to raise awareness about the importance of cybersecurity. This year’s theme is: “Cybersecurity is our shared responsibility and we all must work together to improve our Nation’s cybersecurity.” DHS has released the NCSAM 2018 Toolkit, a comprehensive guide with resources intended to make it easy for organizations, regardless of size or industry, to engage and promote NCSAM.
Apple Releases Security Update for macOS Mojave
Apple has released a security update to address multiple vulnerabilities in macOS Mojave 10.14. An attacker could exploit one of these vulnerabilities to take control of an affected system. NCCIC encourages users and administrators to review Apple's security page for macOS Mojave 10.14 and apply the necessary update. NCCIC/US-CERT.
Assessing the Human Element in Cyber Risk Analysis
When it comes to assessing the risk from the human element, most cybersecurity professionals don’t know where to start. Often organizations are shortsighted and look at only the immediate phishing or misdirected emails rather than what the impacts are further down the attack chain. This can lead to over-stating or under-stating the actual risk.
Despite their Decreasing Numbers, USBs are Still Leveraged to Conduct Attacks
The use of USBs as an essential business tool is declining, but millions of these devices are still produced and distributed annually, with many given away in marketing promotion campaigns and at trade shows and destined for use in homes and businesses. USBs have been exploited by cyber threat actors, most famously by the Stuxnet worm in 2010, and remain a target for cyber threats. Kaspersky Lab data for 2017 shows that every 12 months or so, around one in four users worldwide is affected by a ‘local’ cyber incident.
White House Releases National Cyber Strategy
Late last week, the White House announced a new national cybersecurity strategy intended to improve the defensive postures of federal and private sector networks and systems. The strategy is comprised of four overarching pillars, each of which consists of a series of actions.
Tec4Data SmartCooler (ICSA-18-263-01)
The NCCIC has released an advisory on a missing authentication for critical function vulnerability in Tec4Data Smart Cooler. All versions prior to firmware 180806 are affected. Successful exploitation of this vulnerability could cause the device to shut down by exploiting missing authentication for a critical function. Tec4Data has released new firmware to address the vulnerability and has distributed the new firmware to affected devices. The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities.
Rockwell Automation RSLinx Classic (ICSA-18-263-02) – Product Used in the Water and Wastewater and Energy Sectors
The NCCIC has released an advisory on an uncontrolled search path element vulnerability in Rockwell Automation RSLinx Classic. Versions 4.00.01 and prior are affected. Successful exploitation of these vulnerabilities could crash the device being accessed or allow arbitrary code execution on the device. Rockwell Automation has released a new version of the software and also reports that users can disable Port 44818 if it is not utilized during system operation. The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities.
Pages
