Please stay frozen! Risks in remote access to industrial equipment

What happened?

Food distribution has just experienced a relevant incident.

On October 11^th, unidentified attackers (allegedly Iranian) disrupted commercial refrigeration systems in French supermarkets. On November 1^st and 2^nd, a second wave of attacks impacted those systems in 7 additional EU countries. French blood banks were also targeted. Attackers used remote access to this equipment to gain control over their configuration and then raised refrigerators temperature to 50 º C. Food spoiled and had to be discarded. And food distribution operators’ role on maintaining food sovereignty was compromised.

Why does this happen?

In fact, this incident comes from a well-known risk in “OT Cybersecurity”; that is, Cybersecurity for Operation Technology, for equipment that supports industrial activities in many sectors.

This OT equipment has a different lifecycle to the classical IT services. It is designed for 7x24x365 operation, and thus prioritizes reliability, safety, operation and maintenance tasks over cybersecurity. Deployment may take months or years; updates may require replacement or renewal of spare parts. Designs for OT equipment can be dated years ago and include then reliable technologies that were first developed decades before and tested since then, so they are deployed outdated and remain active for decades. It is not rare to have equipment in-use deployed back in the 1970’s, 1950’s or before.

For this OT equipment, the usual patching strategy for IT assets poses several difficulties. From the availability of patches timely produced by the manufacturer, to the operational problems arising in their application, or the risks of unexpected post-patching behavior of the equipment, patching becomes a really slow process that may get delayed repeatedly.

Connectivity adds another challenge. OT equipment was usually not designed to accept remote access from external networks. But now, the benefits of remote maintenance access from suppliers, manufacturers and technical staff are clear, both reducing downtime of the equipment and cost of maintenance contracts. Thus, many companies have decided to provide remote access to this equipment. Their operational criteria favor flexibility instead of minimizing who can access what. Identity checks may be superficial for automating connections and speeding up login time. Temporary access is not reviewed and become permanent. Some connections are not properly encrypted. Flexible access from anywhere is prioritized over geographical restriction criteria. 

So, these misconfigurations make this equipment available on the internet via remote insecure connections and provide easy paths for successful attacks. Attackers love it.

Could it happen again?

We can expect more incidents like this. In fact, we cannot rule out a 3^rd wave of attacks in the upcoming weeks. And food refrigeration just posed as an example of a shared challenge for industrial sectors such as manufacturing, water management, energy, transportation, space, and others that use OT equipment. Impacts will be different, but relevant in any case. 

While this does not mean every connected installation is vulnerable, organizations should take action asap, before an incident forces to do so WHILE recovering operations.

What can companies do?

In the short term, companies should focus on reducing their chances of getting attacked. 

First and foremost, it is time to cut known unneeded access to OT equipment. While “unplugging” the equipment from the internet looks like a seductive short immediate action, companies may be cutting also some connections that are required for monitoring or coordination of this equipment from global corporate systems. Analyzing all existing connections before deciding is mandatory. But please, do it asap. Ask OT manufacturers or a skilled provider to help you with this task.

Meanwhile, companies need to be sure of their complete exposure surface, that is, each equipment that is accessible from external networks. Don’t be surprised if there are identified, existing non-approved, non-inventoried connections for maintenance purposes. Both known and still-to-know connections must be inventoried and assessed to be sure there are no uncontrolled backdoors to OT equipment. Establish who and why each connection is required, and their applicable security measures.

Then it is time to patch OT equipment following manufacturer’s instructions, assuring those updates and protective measures respect operational constraints and safety requirements. Companies should first patch that equipment that needs internet access and other intermediate and proxy services used for this purpose.

Companies must also be ready to face incidents and disruptions. Pentest identified remote access to assess their security. Develop an incident management plan to guide actions through the incident. Conduct exercises to simulate operation under an attack, or if some equipment needs to be stopped or isolated. If possible, test the restoration of services or the recovery of trusted configurations to maintain minimum essential operations. Train employees in these procedures. Establish periodic review of these measures. Of course, the sooner this starts, the better.

In the long term, companies need to assess current OT architecture to deploy isolated and secure-by-design networks. 

GMV's cybersecurity professionals are successfully addressing these challenges in space, transport and industrial sectors, helping organizations understand their exposure and protect their equipment and operations. They can provide you with both technical expertise and practical experience to face this challenge

Author: Mariano Benito