Cybersecurity

The NCCIC has released an advisory on authentication bypass using an alternate path or channel and insufficiently protected credentials vulnerabilities in Circontrol CirCarLife. All versions prior to 4.3.1 are affected. Successful exploitation of these vulnerabilities could allow a remote attacker to retrieve credentials stored in clear text to bypass authentication, and see and access critical information. Circontrol has released a new version of the software. The NCCIC also recommends a series of defensive measures to minimize the risk of exploitation of these vulnerabilities.

The NCCIC has released an advisory on stack-based buffer overflow and empty password in configuration file vulnerabilities in AVEVA InduSoft Web Studio and InTouch Edge HMI (formerly InTouch Machine Edition). InduSoft Web Studio versions prior to 8.1 SP2 and InTouch Edge HMI versions prior to 2017 SP2 are affected. Successful exploitation of these vulnerabilities could allow an unauthenticated user to remotely execute code. AVEVA recommends that users upgrade to InduSoft Web Studio v8.1 SP2 and InTouch Edge HMI (formerly InTouch Machine Edition) 2017 SP2 as soon as possible.

While many types of ransomware are spread indiscriminately, SamSam in used in a targeted fashion, with the threat actors spending time performing reconnaissance by mapping out the network before encrypting as many computers as possible. A successful SamSam attack will likely be highly disruptive. In the worst-case scenario, if no backups are available or if backups are encrypted by SamSam, valuable data could be lost permanently. Even if an organization does have backups, restoring affected computers and cleaning up the network will cost time and money and may lead to reputational damage.

October 30, 2018

The NCCIC has updated this advisory with additional information on the nature of the vulnerabilities, its evaluation of the risk presented, the affected products, and mitigation measures. NCCIC/ICS-CERT.

April 24, 2018