ICS Devices Online: Critical Infrastructure Vulnerable to Cyber Attacks

In late 2023 and early 2024, state-sponsored cyber actors compromised critical infrastructure in the United States. 

The Iranian CyberAv3ngers exploited default credentials on a publicly accessible Unitronics PLC at a Pennsylvania water facility, defacing the system. 

Subsequently, the Russia-linked Cyber Army of Russia Reborn manipulated human-machine interfaces at Texas water facilities, causing temporary operational disruptions and tank overflows, highlighting the vulnerability of critical infrastructure to cyberattacks targeting industrial control systems. 

Recent cyber incidents underscore the vulnerability of critical infrastructure due to exposed industrial control systems (ICS). While prior research focused on automation protocol exposure, the study expands the analysis to include human-machine interfaces (HMIs) and web administration interfaces. 

The elements often reveal location and ownership data, enabling threat actors to identify and potentially compromise critical systems. By examining the networks hosting these components, researchers aim to understand system ownership and operation. 

Researchers discovered over 40,000 internet-exposed Industrial Control Systems (ICS) devices in the U.S., with a significant portion linked to building automation. Excluding these, approximately 18,000 devices likely control industrial processes. 

Over half of systems using low-level automation protocols and 80% of exposed Human-Machine Interfaces (HMIs) reside on wireless networks operated by major ISPs, including Verizon, Comcast, and AT&T, indicating widespread exposure of critical infrastructure to potential cyber threats. 

Censys discovered 1,500 control systems exposed to the public internet using 18 automation protocols. Additionally, 1,700 publicly accessible HTTP devices associated with 26 OT vendors were found, many likely using default credentials. Over 80% of these interfaces manage building controls, presenting a potential attack vector. 

They investigated the internet accessibility of Industrial Control System (ICS) devices in the U.S. and U.K., focusing on low-level automation protocols. 

These protocols, used for communication between PLCs, RTUs, HMIs, and SCADA systems, are typically near real-time, binary, and lack essential security features like authentication, presenting significant vulnerabilities to critical infrastructure. 

HMIs, the primary interface for operators to monitor and control industrial systems, present a significant attack surface due to their user-friendly design and increasing remote accessibility. 

Threat actors exploit these vulnerabilities to disrupt operations and often gather sensitive information about system owners. 

Beyond HMIs, SCADA systems possess additional attack vectors in the form of web-based administration interfaces found on PLCs, RTUs, and other components, many of which ship with easily guessable default credentials, expanding the attack surface and compromising system security. 

Quantifying exposed automation protocols alone is insufficient; Internet-accessible administrative interfaces for these devices pose significant risks. Recent attacks demonstrate the ease with which malicious actors can exploit these interfaces, often without in-depth system knowledge. 

Many devices operate on cellular networks or commercial ISPs, lacking ownership identifiers within automation protocols, hindering notification of vulnerabilities. 

Also Read:

North Korea’s Kimusky Hackers Targeting University Professors

See more