14 vulnerabilidades críticas en pila TCP/IP NicheStack exponen dispositivos OT a ataques remotos

14 vulnerabilidades críticas en pila TCP/IP NicheStack exponen dispositivos OT a ataques remotos

En agosto 2021, Forescout Research Labs y JFrog Security Research descubrieron 14 fallos serios en la pila TCP/IP NicheStack, a los que nombraron INFRA:HALT.

La pila NicheStack impulsa una amplia gama de dispositivos operational-technology (OT) across critical infrastructure sectors —manufacturing, water treatment, power generation y más— convirtiéndola en target de alto perfil para adversarios.

Estos defectos permiten a atacantes realizar remote code execution, lanzar denial-of-service attacks, robar sensitive information, spoof TCP connections y poison DNS caches.

Sistemas de control industrial bajo amenaza

Los hallazgos subrayan cómo aging, Internet-connected OT systems remain vulnerable. "Es un unfortunate example de la huge vulnerability de una aging infrastructure que ha sido connected, directly or indirectly, to the Internet", dice Curtis Simpson, CISO en Armis.

Brian Kim de Forrester Research aconseja a critical-infrastructure operators primero map their OT assets, then adopt a zero-trust posture que enforce least privilege, network segmentation y strict allow-lists.

"Una de las best ways we can reduce the impact of a breach is a zero-trust strategy by limiting the communications of these industrial control systems", explica Kim. "Podemos crear una allow list que solo permita communications con control systems that run a process —allowing least privilege for network connections— y ideally place a barrier between IT and OT, segmenting each facility into its own network."

JFrog y Forescout presentarán un webinar el 19 de agosto para detallar cómo las vulnerabilidades fueron descubiertas y los mitigation steps que operators pueden tomar.

Ataques crecientes en infraestructura crítica

Recorded Future reported roughly 65,000 ransomware attacks last year alone.

Atacantes son drawn to OT devices porque a menudo lack modern security controls. Compromise of a single device can cripple operations, prompting organizations to consider paying ransom to restore services.

"La naturaleza de estas vulnerabilidades could lead to heightened risk y expose national critical infrastructure at a time when the industry is seeing an increase in OT attacks against global utilities, oil and gas pipeline operators, as well as healthcare and the supply chain", advirtió Forescout Research Labs.

Una vez un device is compromised, la vulnerable stack puede servir as an entry point para malware to spread throughout an organization's IT network.

Brian Kim highlighted the Colonial Pipeline incident as a stark reminder que critical infrastructure systems are not isolated; they are interconnected "systems of systems" that can propagate attacks across supply chains.

"Ultimately, operators must shift their perspective toward comprehensive resilience", concluyó Kim. "A strong focus on security and resilience is essential for protecting the critical infrastructure they manage."