McAfee warns of serious security flaw in building controller

eBMGR lets attackers in

However, from a cyber attacker’s point of view, the eBMGR is a potential single point of failure attached to a network, according to Mark Bereza, a security researcher at McAfee Advanced Threat Research.

Under testing, McAfee researchers discovered the buffer overflow vulnerability, a “seemingly innocuous mistake” that rendered the eBMGR “vulnerable to our carefully crafted network attack, which allows a hacker on the same network to gain complete control of the device’s operating system”, he wrote in a blog post.

The attack uses what is known as broadcast traffic, said Bereza, meaning bad actors can launch the attack without knowing the location of the targets on the network.

“The result is a twisted version of Marco Polo – the hacker needs only shout ‘Marco’ into the darkness and wait for the unsuspecting targets to shout ‘Polo’ in response,” he wrote.

The researchers then investigated if they could use control of the eBMGR to control the devices it was connected to. By examining some hardware that the Delta device might be used to manage, the researchers were able to identify some control code to enable them to carry out a replay attack.

“This strategy proved effective in granting us control over every category of device the eBMGR supports,” said Bereza.

The result was an attack that would compromise any enteliBUS Manager on the same network and attach a custom piece of malware the researchers developed to the software running on it. This malware was then used to create a backdoor for issuing commands to the manager remotely to control any hardware connected to it.

The researchers noted that if an attacker knows the IP address of the device ahead of time, this exploit can be performed over the internet, increasing its impact exponentially.

A Shodan scan revealed that more than 1,600 such devices are internet connected, meaning the danger is far from hypothetical. The total number of network-connected vulnerable devices is much higher still.

Patch to block attacks

In line with McAfee’s responsible disclosure policy, the researchers contacted Delta Controls, which responded with a beta version of a patch that the researchers were able to confirm was effective in blocking the attack they had developed.

“This is our idea of a success story – researchers and vendors coming together to improve security for end users and ultimately reduce the attack surface for the adversary,” said Bereza.

The important lesson to be learned, he said, is that it takes very little to make a critical system vulnerable, and therefore it is important that companies extend proper security practices to all network-connected devices.

Mo Cashman, principal engineer at McAfee, said it is important for industrial and manufacturing organisations to take a “one enterprise” approach to security and risk management.

“Many organisations still operate in silos. For instance, a CISO [chief information security officer] may be responsible for IT only, yet not charged with securing OT [operational technology] environments. This needs to change,” he said.

“Recent attacks demonstrate that threats to industrial control systems enter from multiple routes. As a result, increased collaboration and achieving one unified view across the digital workplace, cloud services, industrial controls and the supply chain are necessary considerations if an organisation is to maintain business resilience as it transitions to create a factory of the future.”