It has been 10 years since Project Basecamp, a research project conducted by Digital Bond that investigated how critical operational technology (OT) devices and protocols were, to use the term they coined, “insecure by design.” Since then, we have seen hugely impactful real-world OT malware such as Industroyer, TRITON, Industroyer2 and INCONTROLLER abusing insecure-by-design functionality.
In collaboration with CISA’s vulnerability disclosure process, Forescout’s Vedere Labs today is disclosing OT:ICEFALL, a set of 56 vulnerabilities affecting devices from 10 OT vendors. Why “Icefall”? That’s the name of the second stop on the Everest route, after Base Camp, and given the rising number of OT vulnerability disclosures, we know we have a mountain to climb to secure these devices and protocols.
The vulnerabilities in OT:ICEFALL are divided into four main categories:
- Insecure engineering protocols
- Weak cryptography or broken authentication schemes
- Insecure firmware updates
- Remote code execution via native functionality
