You are here

Home » Cybersecurity

Cybersecurity

Emerson DeltaV Distributed Control System (ICSA-19-190-01) – Product Used in the Energy Sector

The NCCIC has published an advisory on a use of hard-coded credentials vulnerability in Emerson DeltaV Distributed Control System. Versions 11.3.x and 12.3.x are affected. Successful exploitation of this vulnerability could allow an attacker to gain administrative access to DeltaV Smart Switches. Emerson recommends users patch affected products. The NCCIC also advises of a series of measures for mitigating this vulnerability. Read the advisory at CISA.

U.S. Cyber Command Issues Alert about Hackers Exploiting Outlook Vulnerability

Last week, U.S. Cyber Command issued an alert via Twitter about threat actors abusing an Outlook vulnerability to plant malware on government networks. The vulnerability is CVE-2017-11774, a security bug that Microsoft patched in Outlook in October 2017. U.S. Cyber Command recommends immediate patching, if not done already.

The True Cost of Paying Ransoms – Pay a Lot Now, or Pay a Lot More Later

Paying ransom demands in the hopes of regaining access to critical data is controversial, to say the least. Succumbing to extortion goes against conventional advice and wisdom against incentivizing the cybercrime business model, but sometimes organizations feel they have no other choice and paying seems like the best option at the time. However, paying a ransom is not straightforward.

Quest KACE Systems Management Appliance (ICSA-19-183-02)

The NCCIC has published an advisory on an improper input validation vulnerability in KACE Systems Management Appliance. All versions of 8.0.x, 8.1.x, and 9.0.x are affected. Successful exploitation of this vulnerability could allow an administrative user unintentional access to the underlying operating system of the device. Quest recommends affected users upgrade to Version 9.1 or newer. The NCCIC also advises of a series of measures for mitigating the vulnerability. Read the advisory at CISA.

Rules of Engagement for Cyber War Needed Before Someone Gets Hurt

With escalating tensions against the US from Iran, their perceived allies and proxies we have been informed of the increased cyber threat particularly against our industrial control systems. As the very same systems that provide for our livelihoods are being targeted by faceless enemies egregiously putting human lives at risk, it is past time for rules of engagement for cyber war to be agreed upon before lives are lost.

SICK MSC800 (ICSA-19-178-04)

The NCCIC has published an advisory on a use of hard-coded credentials vulnerability in SICK MSC800. All versions prior to 4.0 are affected. Successful exploitation of this vulnerability could allow a low-skilled remote attacker to reconfigure settings and/or disrupt the functionality of the device. SICK recommends affected users upgrade to the latest firmware version (v4.0). The NCCIC also advises of a series of measures for mitigating the vulnerabilities. Read the advisory at CISA.

ABB CP635 HMI (ICSA-19-178-03)

The NCCIC has published an advisory on use of hard-coded credentials vulnerability in ABB CP635 HMI. Numerous products and versions of these products are affected. Successful exploitation of this vulnerability could allow an attacker to prevent legitimate access to an affected system node, remotely cause an affected system node to stop, take control of an affected system node, or insert and run arbitrary code in an affected system node. ABB recommends users apply the BSP update on affected CP600 control panels at their earliest convenience.

Pages

Subscribe to Cybersecurity