www.darkreading.com
Open in
urlscan Pro
2606:4700::6812:6b2f
Public Scan
URL:
https://www.darkreading.com/vulnerabilities-threats/the-overlooked-problem-of-n-day-vulnerabilities
Submission: On September 15 via api from IN — Scanned from DE
Submission: On September 15 via api from IN — Scanned from DE
Form analysis
0 forms found in the DOMText Content
The Edge DR Tech Sections Close Back Sections Featured Sections The Edge Dark Reading Technology Attacks / Breaches Cloud ICS/OT Remote Workforce Perimeter Analytics Security Monitoring Security Monitoring App Sec Database Security Database Security Risk Compliance Compliance Threat Intelligence Endpoint AuthenticationMobile SecurityPrivacy AuthenticationMobile SecurityPrivacy Vulnerabilities / Threats Advanced ThreatsInsider ThreatsVulnerability Management Advanced ThreatsInsider ThreatsVulnerability Management Operations Identity & Access ManagementCareers & People Identity & Access ManagementCareers & People Physical Security IoT DR Global Middle East & Africa Middle East & Africa Black Hat news Omdia Research Events Close Back Events Events * Black Hat Europe - December 4-7 - Learn More * Black Hat Middle East and Africa - Nov 14-16 - Learn More Webinars * How Businesses Can Counterpunch against Generative AI-Powered Ransomware Sep 19, 2023 * Preventing Attackers From Navigating Your Enterprise Systems Sep 20, 2023 Resources Close Back Resources Dark Reading Library > Reports > Webinars > White Papers > Slideshows > Newsletters > Events > Partner Perspectives: Microsoft Partner Perspectives: Google Cloud Newsletter Sign-Up The Edge DR Tech Sections Close Back Sections Featured Sections The Edge Dark Reading Technology Attacks / Breaches Cloud ICS/OT Remote Workforce Perimeter Analytics Security Monitoring Security Monitoring App Sec Database Security Database Security Risk Compliance Compliance Threat Intelligence Endpoint AuthenticationMobile SecurityPrivacy AuthenticationMobile SecurityPrivacy Vulnerabilities / Threats Advanced ThreatsInsider ThreatsVulnerability Management Advanced ThreatsInsider ThreatsVulnerability Management Operations Identity & Access ManagementCareers & People Identity & Access ManagementCareers & People Physical Security IoT DR Global Middle East & Africa Middle East & Africa Black Hat news Omdia Research Events Close Back Events Events * Black Hat Europe - December 4-7 - Learn More * Black Hat Middle East and Africa - Nov 14-16 - Learn More Webinars * How Businesses Can Counterpunch against Generative AI-Powered Ransomware Sep 19, 2023 * Preventing Attackers From Navigating Your Enterprise Systems Sep 20, 2023 Resources Close Back Resources Dark Reading Library > Reports > Webinars > White Papers > Slideshows > Newsletters > Events > Partner Perspectives: Microsoft Partner Perspectives: Google Cloud The Edge DR Tech Sections Close Back Sections Featured Sections The Edge Dark Reading Technology Attacks / Breaches Cloud ICS/OT Remote Workforce Perimeter Analytics Security Monitoring Security Monitoring App Sec Database Security Database Security Risk Compliance Compliance Threat Intelligence Endpoint AuthenticationMobile SecurityPrivacy AuthenticationMobile SecurityPrivacy Vulnerabilities / Threats Advanced ThreatsInsider ThreatsVulnerability Management Advanced ThreatsInsider ThreatsVulnerability Management Operations Identity & Access ManagementCareers & People Identity & Access ManagementCareers & People Physical Security IoT DR Global Middle East & Africa Middle East & Africa Black Hat news Omdia Research Events Close Back Events Events * Black Hat Europe - December 4-7 - Learn More * Black Hat Middle East and Africa - Nov 14-16 - Learn More Webinars * How Businesses Can Counterpunch against Generative AI-Powered Ransomware Sep 19, 2023 * Preventing Attackers From Navigating Your Enterprise Systems Sep 20, 2023 Resources Close Back Resources Dark Reading Library > Reports > Webinars > White Papers > Slideshows > Newsletters > Events > Partner Perspectives: Microsoft Partner Perspectives: Google Cloud -------------------------------------------------------------------------------- Newsletter Sign-Up SEARCH A minimum of 3 characters are required to be typed in the search bar in order to perform a search. Announcements 1. 2. Event Tips for A Streamlined Transition to Zero Trust | Sept 28 LIVE Webinar <REGISTER NOW> Event The Evolution of the Vulnerability Landscape in 2023 | Sept 27 LIVE Webinar <REGISTER NOW> PreviousNext Vulnerabilities/Threats 5 MIN READ Commentary THE OVERLOOKED PROBLEM OF 'N-DAY' VULNERABILITIES N-days -- or known vulnerabilities -- are a goldmine for attackers of industrial control systems. It's time for a new defense strategy. Ang Cui Founder & CEO, Red Balloon Security March 26, 2018 PDF Security Researcher Joseph Pantoga contributed to this article. Zero-day attacks tend to steal the spotlight when it comes to cybersecurity threats, but it is actually the known vulnerability — the "N-day" — that poses a much larger problem for many organizations and particularly those in the industrial sectors. Whereas zero-days are a class of vulnerability that is unknown to a software developer or hardware manufacturer, an N-day is a flaw that is already publicly known but may or may not have a security patch available. There are countless known vulnerabilities in existence today, and many large commercial and governmental entities will find they have significant exposure within their broad network footprints. However, the problem is far more acute for organizations that rely on industrial control systems (ICS) such as the energy, manufacturing, and infrastructure sectors. This is because ICS equipment can be extremely difficult to update and patch. To make matters worse, ICS firmware is often developed with insufficient built-in security controls, and product manufacturers can be slow to fix newly discovered vulnerabilities and threats. For more than a year, our team analyzed unpatched N-day vulnerabilities in the firmware of widely used ICS devices in order to gain a better understanding of the problem. Some of these findings were recently presented at the S4x18 security conference in Miami. We found that N-days are extremely common in the ICS environment. Nearly all the operators who read this article are likely to have numerous N-days in their systems. N-Days vs. Zero-Days N-day vulnerabilities are a goldmine for attackers because the hard work has already been done. In certain cases, active exploits may already exist and be readily available from public disclosure documents. Compare this with zero-days, which are time-consuming and expensive to find and exploit — the reason why their use is declining among criminal groups. . While N-days pose a threat to any large network, industrial users are at an especially high risk because of specific circumstances unique to those environments: 1. Systems must always be available. 2. No standardization. For example, in an ICS, as opposed to a standard computing environment, patching is often a manual proprietary process that requires unique software and knowledge for each vendor. 3. Patches rarely propagate between vendors that use shared code. This highlights an example we outlined at S4, where a vulnerability was reported to a vendor in the telecom sector, was patched by the software vendor (Intel/Windriver), but patches were not applied by a number of other large vendors in ICS. 4. Extended lifetime. Systems are typically deployed in the field for over a decade and well past their support period. Vendors who desire to sell new products are disincentivized to routinely patch and support older products with security updates, even if they are still commonly found in the field. Real-World Cases Illustrate the Risks The industry has already seen a number of attacks on industrial targets that have exploited N-day vulnerabilities in ICS devices and protocols. Some examples include: * CrashOverride or Industroyer: This malware was used in a December 2016 attack that disrupted operations at a Ukrainian electrical transmission substation. It exploited the known CVE-2015-5374 Denial of Service condition to the Siemens SIPROTEC relays. * TRITON or HatMan: Discovered in 2017, the ICS malware targets Schneider Electric's Triconex Safety Instrumented System (SIS) controllers' emergency shutdown capability. * BlackEnergy: This malware contained exploits for specific types of HMI applications, including Siemens SIMATIC, GE CIMPLICITY, and Advantech WebAccess. High-Risk Vulnerabilities Many of the N-days we discovered in ICS firmware are critical in nature and could allow a hacker to gain remote access and total control over parts of an industrial operator's network or facility. These N-days could allow attackers to replicate the effects of CrashOverride, TRITON, BlackEnergy, or even Stuxnet much more easily, and at a much wider scale. For example, in our research into the VxWorks 5.5.1 vulnerability (discussed above), we found that every major manufacturer had a product that remains unpatched against this N-day. In no case was this vulnerability listed for the individual ICS products, so vendors may not even know these vulnerabilities exist. The vulnerabilities can be exploited for such malicious purposes as manipulating settings and controls, physically damaging or destroying equipment, disrupting key operations, and stealing sensitive information. Due to the large number of vulnerabilities we discovered and the long lead time on ICS patching (as well as the low patch penetration rate), we decided not to disclose individual vulnerabilities against named devices for fear of arming attackers while device operators would be unable to respond. Patching Is Not the Answer ICS N-days are not an easy problem to fix. Solutions are limited by technical complications and a slow-to-act supply chain. Nonetheless, there is a lot the industry can do to address the problem. To start, the current reactive approach of patching known vulnerabilities is no longer tenable. Every component of the ICS environment should have strong security baked into the software, firmware, and hardware from the very start in order to lower the overall risk of N-days and other problems, and to mitigate or prevent damage from their exploitation. The best solutions will combine intrusion detection and mitigation techniques to protect against known and unknown attacks without relying on continuous updates. By and large, these features do not exist, so it is incumbent upon manufacturers to develop or source this technology as quickly as possible. Related Content: * The Case for Integrating Physical Security & Cybersecurity * Anatomy of an Attack on the Industrial IoT * Zero-Day Attacks Major Concern in Hybrid Cloud * 7 Key Stats that Size Up the Cybercrime Deluge Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here. Use Promo Code DR200 to register and save $200. RiskOperationsAttacks/BreachesEndpointVulnerability ManagementAdvanced Threats Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox. Subscribe More Insights White Papers * Threat Intelligence: Data, People and Processes * Global Perspectives on Threat Intelligence More White Papers Webinars * How Businesses Can Counterpunch against Generative AI-Powered Ransomware * Preventing Attackers From Navigating Your Enterprise Systems More Webinars Reports * Passwords Are Passe: Next Gen Authentication Addresses Today's Threats * How to Deploy Zero Trust for Remote Workforce Security More Reports Editors' Choice Microsoft Patches a Pair of Actively Exploited Zero-Days Tara Seals, Managing Editor, News, Dark Reading Critical Google Chrome Zero-Day Bug Exploited in the Wild Dark Reading Staff, Dark Reading Cybersecurity Skills Gap: Roadies & Gamers Are Untapped Talent Jim Broome, President & CTO, DirectDefense ChatGPT Jailbreaking Forums Proliferate in Dark Web Communities Nate Nelson, Contributing Writer, Dark Reading Webinars * How Businesses Can Counterpunch against Generative AI-Powered Ransomware * Preventing Attackers From Navigating Your Enterprise Systems * Passwords Are Passe: Next Gen Authentication for Today's Threats * Cyber Risk Assessment Secrets From the Pros * The Evolution of the Vulnerability Landscape in 2023 More Webinars Reports * Passwords Are Passe: Next Gen Authentication Addresses Today's Threats * How to Deploy Zero Trust for Remote Workforce Security * What Ransomware Groups Look for in Enterprise Victims * How to Use Threat Intelligence to Mitigate Third-Party Risk * Everything You Need to Know About DNS Attacks More Reports White Papers * Threat Intelligence: Data, People and Processes * Global Perspectives on Threat Intelligence * Mandiant Threat Intelligence at Penn State Health * Digital Transformation and Connected Systems Have Opened the Door to New Threat Vectors * Evaluating SASE for the Work-From-Anywhere Era More White Papers Events * Black Hat Europe - December 4-7 - Learn More * Black Hat Middle East and Africa - Nov 14-16 - Learn More * Black Hat Japan Trainings - Nov 13-14 - Learn More * SecTor - Canada's IT Security Conference Oct 23-26 - Learn More More Events More Insights White Papers * Threat Intelligence: Data, People and Processes * Global Perspectives on Threat Intelligence More White Papers Webinars * How Businesses Can Counterpunch against Generative AI-Powered Ransomware * Preventing Attackers From Navigating Your Enterprise Systems More Webinars Reports * Passwords Are Passe: Next Gen Authentication Addresses Today's Threats * How to Deploy Zero Trust for Remote Workforce Security More Reports DISCOVER MORE FROM INFORMA TECH * Interop * InformationWeek * Network Computing * ITPro Today * Data Center Knowledge * Black Hat * Omdia WORKING WITH US * About Us * Advertise * Reprints FOLLOW DARK READING ON SOCIAL * * * * * * * Home * Cookies * Privacy * Terms Copyright © 2023 Informa PLC Informa UK Limited is a company registered in England and Wales with company number 1072954 whose registered office is 5 Howick Place, London, SW1P 1WG. Cookies Button ABOUT COOKIES ON THIS SITE We and our partners use cookies to enhance your website experience, learn how our site is used, offer personalised features, measure the effectiveness of our services, and tailor content and ads to your interests while you navigate on the web or interact with us across devices. You can choose to accept all of these cookies or only essential cookies. To learn more or manage your preferences, click “Settings”. For further information about the data we collect from you, please see our Privacy Policy Accept All Settings COOKIE PREFERENCE CENTER When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer. More information Allow All MANAGE CONSENT PREFERENCES STRICTLY NECESSARY COOKIES Always Active These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information. Cookies Details PERFORMANCE COOKIES Performance Cookies These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance. Cookies Details FUNCTIONAL COOKIES Functional Cookies These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly. Cookies Details TARGETING COOKIES Targeting Cookies These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising. Cookies Details Back Button BACK Search Icon Filter Icon Clear checkbox label label Apply Cancel Consent Leg.Interest checkbox label label checkbox label label checkbox label label * View Cookies * Name cookie name Confirm My Choices