GPS Week Rollover occurs on April 6, 2019, which could cause a mini "millennium bug" for some GPS devices. While this is a known issue arising from the way the system works, critical infrastructure operators whose systems use GPS are encouraged to prepare for the event. Most modern GPS receivers shouldn't be affected by this (devices that conform to IS-GPS-200 and provides UTC will be fine), but testing carried out by the U.S.
February 12, 2019
The NCCIC has updated this advisory with additional details on the affected products and mitigation measures. Read the advisory at NCCIC/ICS-CERT.
January 23, 2018
A former cyber attacker writes about why city governments are appealing targets for malicious cyber operations. For one, the potential impact of targeting a city is huge. In addition to the normal “benefits” of getting access to private customer data, credit cards and so on, penetrating a city may give attackers access to sensitive information about residents. Depending on the local-government agency and its IT structure, attackers can access and impact a variety of systems, including those associated with critical infrastructure. Secondly, cities are vulnerable.
Hackers have breached the severs of email provider VFEmail and wiped the data from all its US servers, destroying customers' data in the process. "At this time, the attacker has formatted all the disks on every server," the company said yesterday. "Every VM is lost. Every file server is lost, every backup server is lost. This was more than a multi-password via SSH exploit, and there was no ransom. Just attack and destroy," VFEmail said. Founded in 2001 and based in Milwaukee, VFEmail provides email service to businesses and end users.
The NCCIC reports it is aware of a vulnerability affecting several open-source container management systems that leverage runc.
Microsoft has released its monthly update to address vulnerabilities in its software. For this month, Microsoft has released security updates for Adobe Flash Player, Internet Explorer, Microsoft Edge, Microsoft Windows, Microsoft Office and Microsoft Office Services and Web Apps, ChakraCore, .NET Framework, Microsoft Exchange Server, Microsoft Visual Studio, Azure IoT SDK, Microsoft Dynamics, Team Foundation Server, and Visual Studio Code.
The NCCIC has published an advisory on an improper input vulnerability in Siemens EN100 Ethernet Module. Firmware variant IEC 61850 for EN100 Ethernet module version prior to 4.33 is affected. The EN100 Ethernet module for the SWT 3000 management platform is affected by security vulnerabilities that could allow an attacker to conduct a denial-of-service attack over the network. Siemens has released update v4.33 for several affected products, is working on updates for the remaining affected products, and recommends specific countermeasures until fixes are available.
The NCCIC has published an advisory on an uncaught exception vulnerability in Siemens SICAM A8000 RTU Series. Multiple versions are affected. The SICAM A8000 RTU series is affected by a security vulnerability that could allow unauthenticated remote users to cause a denial-of-service condition on the web server of affected products. Siemens has released updates for all product variants and recommends users update to the new versions. The NCCIC also advises on a series of mitigating measures for these vulnerabilities.
February 7, 2019
The NCCIC has updated this advisory with additional information on the vulnerabilities and technical details of the affected products. Read the advisory at NCCIC/ICS-CERT.
January 17, 2019
February 7, 2019
The NCCIC has updated this advisory with additional information on mitigation measures. Read the advisory at NCCIC/ICS-CERT.
September 27, 2018
1620 I Street, NW, Suite 500
Washington, DC 20006
1-866-H2O-ISAC (1-866-426-4722)
© 2025 WaterISAC. All Rights Reserved.
