Security researchers discovered four vulnerabilities in FL Switch industrial switches that could have potentially given hackers the ability to access and disrupt industrial networks.
The flaws were discovered by security researchers at Positive Technologies and disclosed by German electrical engineering and automation firm Phoenix Contact. The flaws affect devices that are used for automation purposes in the oil and gas industry, at digital substations and in the maritime industry, among others.
The discovery of the flaws indicate how an increasing number of vulnerabilities have been spotted in industrial networks, highlighting the lack of security in the industry.
“By informing the public of vulnerabilities and providing patches, vendors of network equipment—such as switches and interface convertors—are stepping up to the plate and setting a great example,” Leigh-Anne Galloway, Cyber Security Resilience lead at Positive Technologies said, SC Magazine reported.
"However, these patches don't always reach installed equipment already in the field. Clients often rely on air gapping even though 82 percent of tested industrial network segments are insufficiently segmented off from corporate IT systems,” Galloway added. “In these cases, attackers can use ordinary hacking methods, including phishing, to attack the corporate network and then sidestep their way onto mission-critical industrial segments. At that point, they can exploit vulnerabilities in all sorts of industrial equipment, such as unpatched Phoenix Contact switches.”
According to Ofer Maor, director of solutions management at Synopsys, attacks like Stuxnet are prime examples of how hackers can launch attacks against air-gapped networks.
“Air gapped networks still require input and output of data, most commonly done over media such as USB drives, which can be used to inject malicious Trojans,” Maor told SC Magazine. “Nonetheless, air gapping makes it much harder (ergo more expensive) to attack and is good practice when the value of the connected service is lower than the potential risk it introduces.”
Publisher