Trend Micro Incorporated today announced new research highlighting design flaws in legacy languages and released new secure coding guidelines to help Industry 4.0 developers greatly reduce the software attack surface. And with this decrease business disruption in operational technology (OT) environments.
Conducted jointly with Politecnico di Milano, the research details how design flaws in legacy programming languages could lead to vulnerable automation programs. These insecurities could enable attackers to hijack industrial robots and automation machines to disrupt production lines or steal intellectual property. According to the research, the industrial automation world may be unprepared to detect and prevent the exploitation of the issues found. Therefore, it is imperative that the industry start embracing and establishing network-security best practices and secure-coding practices, which have been updated with industry leaders as a result of this research.
Legacy proprietary programming languages such as RAPID, KRL, AS, PDL2, and PacScript were designed without an active attacker model in mind. Developed decades ago, they are now essential to critical automation tasks on the factory floor, but can’t themselves be fixed easily.
Not only are vulnerabilities a concern in the automation programs written using these proprietary languages, but researchers demonstrate how a new kind of self-propagating malware could be created using one of the legacy programming languages as an example.
Trend Micro Research has worked closely with The Robotic Operating System Industrial Consortium to establish recommendations to reduce the exploitability of the identified issues[1].
As these new guidelines demonstrate, the task programs that rely on these languages and govern the automatic movements of industrial robots can be written in a more secure manner to mitigate Industry 4.0 risk. The essential checklist for writing secure task programs includes the following:
- Treat industrial machines as computers and task programs as powerful code
- Authenticate every communication
- Implement access control policies
- Always perform input validation
- Always perform output sanitization
- Implement proper error handling without exposing details
- Put proper configuration and deployment procedures in places
In addition, Trend Micro Research and Politecnico di Milano have also developed a patent-pending tool to detect vulnerable or malicious code in task programs, thus preventing damage at runtime.
As a result of this research, security-sensitive features were identified in the eight most popular industrial robotic programming platforms, and a total of 40 instances of vulnerable open source code have been found. One vendor has removed the automation program affected by a vulnerability from its application store for industrial software, and two more have been acknowledged by the maintainer, leading to fruitful discussion. Details of the vulnerability disclosures have also been shared by ICS-CERT in an alert to their community.
The results of this research will be presented at Black Hat USA on August 5, and at the ACM AsiaCCS conference in October in Taipei.
To find out more, please find the complete research report here: https://www.trendmicro.com/vinfo/us/security/news/internet-of-things/unveiling-the-hidden-risks-of-industrial-automation-programming.
Like this:
Like Loading...
Related
This entry was posted on August 6, 2020 at 9:54 am and is filed under Commentary with tags Trend Micro. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Trend Micro Research Reveals Dangerous Design Flaws and Vulnerabilities In Legacy Programming Languages
Trend Micro Incorporated today announced new research highlighting design flaws in legacy languages and released new secure coding guidelines to help Industry 4.0 developers greatly reduce the software attack surface. And with this decrease business disruption in operational technology (OT) environments.
Conducted jointly with Politecnico di Milano, the research details how design flaws in legacy programming languages could lead to vulnerable automation programs. These insecurities could enable attackers to hijack industrial robots and automation machines to disrupt production lines or steal intellectual property. According to the research, the industrial automation world may be unprepared to detect and prevent the exploitation of the issues found. Therefore, it is imperative that the industry start embracing and establishing network-security best practices and secure-coding practices, which have been updated with industry leaders as a result of this research.
Legacy proprietary programming languages such as RAPID, KRL, AS, PDL2, and PacScript were designed without an active attacker model in mind. Developed decades ago, they are now essential to critical automation tasks on the factory floor, but can’t themselves be fixed easily.
Not only are vulnerabilities a concern in the automation programs written using these proprietary languages, but researchers demonstrate how a new kind of self-propagating malware could be created using one of the legacy programming languages as an example.
Trend Micro Research has worked closely with The Robotic Operating System Industrial Consortium to establish recommendations to reduce the exploitability of the identified issues[1].
As these new guidelines demonstrate, the task programs that rely on these languages and govern the automatic movements of industrial robots can be written in a more secure manner to mitigate Industry 4.0 risk. The essential checklist for writing secure task programs includes the following:
In addition, Trend Micro Research and Politecnico di Milano have also developed a patent-pending tool to detect vulnerable or malicious code in task programs, thus preventing damage at runtime.
As a result of this research, security-sensitive features were identified in the eight most popular industrial robotic programming platforms, and a total of 40 instances of vulnerable open source code have been found. One vendor has removed the automation program affected by a vulnerability from its application store for industrial software, and two more have been acknowledged by the maintainer, leading to fruitful discussion. Details of the vulnerability disclosures have also been shared by ICS-CERT in an alert to their community.
The results of this research will be presented at Black Hat USA on August 5, and at the ACM AsiaCCS conference in October in Taipei.
To find out more, please find the complete research report here: https://www.trendmicro.com/vinfo/us/security/news/internet-of-things/unveiling-the-hidden-risks-of-industrial-automation-programming.
Share this:
Like this:
Related
This entry was posted on August 6, 2020 at 9:54 am and is filed under Commentary with tags Trend Micro. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.