Court Orders ECS-CERT to Withdraw Alert

Today the 14^th US District Court ordered ECS-CERT to withdraw their CyMoTrol alert from their web site pending the final decision of the Court on the suit filed by the company. The company claims that ECS-CERT is unfairly characterizing features of their motor control systems as cybersecurity vulnerabilities and thus damaging their reputation and affecting sales of the reportedly affected devices.

Judge Phantly R. Bean wrote in the restraining order that CyMoTrol had provided prima facia evidence of damage by government claims in the alert and that justified ordering the removal of the alert from the ECS-CERT web site pending full resolution of the law suit.

Wilhelm Pieck, spokesperson for CyMoTrol, told reporters that the action taken today by the Court will ensure that ECS-CERT stops their campaign to stop the company from providing necessary services and support to their customers. “ECS-CERT has never attempted to prove the claims made by the criminal hacker cYbrg0D and does not even possess one of the devices that they reported to be defective.” Pieck said.

Reporters have not been able to identify cYbrg0D, the researcher who reported the vulnerability claims to ECS-CERT. In a TWEET® issued after the court order was released, cYbrg0D said: “Judge Bean does not understand the purpose of ECS-CERT alerts and advisories – They are designed to protect owner operators from cybersecurity vulnerabilities that were undetected when bought.”

A second TWEET from cYbrg0D contained what may have been a threat, stating: “Perhaps what Bean and his cronies need is a demonstration of the dangers of the CyMoTrol ‘feature’.”

Immanuel C. Securitage, spokesperson for ECS-CERT, reported that the alert in question had been removed from the ECS-CERT web site in accordance with the Judge’s order. In a statement released by the agency, Securitage said: “We have no comment on the ongoing litigation.”

Junior Butts, a lawyer who has successfully represented hackers before Judge Bean, told this reporter that he suspects CyMoTrol will argue that ECS-CERT has not been given specific authority by Congress to publish negative information about control system software and equipment. “Lacking specific authorization, it would be argued, that ECS-CERT will have to show that it is not protected from libel and slander suits.” Butts explained; “ECS-CERT will have to show that it took reasonable care to validate the claims by cYbrg0D and other researchers and performed their due diligence responsibilities before publishing derogatory information about CyMoTrol or its products.”

Rep Rebecca Pinter (D,MA), a Congress person with an interest in cybersecurity legislation responded to Butts comments. She said: “Junior may have a point. When we gave ECS-CERT the responsibility for coordinating disclosures of control system vulnerabilities, Congress did not provide any specific authority to publish alerts or advisories about those vulnerabilities, especially when the vendor involved did not agree that the reported vulnerabilities actually existed. Perhaps we need to look at what requirements should be applied to such situations.”

CAUTIONARY NOTE: This is a future news story –

CI-SOC Opened

Today the DHS Cybersecurity Agency (CSA) announced the opening of the National Critical Infrastructure Security Operations Center (CI-SOC) in Delano, GA. The facility is tasked with monitoring the cybersecurity of 600 critical infrastructure facilities across the United States.

Ida Long, Director of the CSA, said: “The Agency is proud to announce this important step in protecting the cyber operations of this great country. Working in partnership with the owners of these 600 facilities, we will be able to monitor operations, detect and isolate cyberattacks, and identify the attackers at any of these facilities.”

According to the CSA information packet on the CI-SOC there will be a total of 1,500 employees working out of the converted Sears store in Delano. They include 400 cybersecurity specialists who will be monitoring incoming and outgoing electronic communications at each of the 600 facilities on a continuous basis, looking for indicators of compromise.

Gen Buck Turgidson (Ret), the Director of CI-SOC, told reporters that this facility is unique in its capability for monitoring not just the information technology infrastructure at these facilities, but also the operational control systems, building control systems, and physical security control systems at each facility.

“We have 25 process experts available on the floor of the CI-SOC at all times to help the cyber-operators understand the physical system implications of attacks on the various control systems being monitored,” Turgidson told reporters: “They also help the CI response coordinators understand what outside assets may need to be sent to affected facilities to help them recover from various aspects of the attacks identified.”

The Mayor of Delano, Arrington Carter, was on hand for the opening ceremony for the new CI-SOC. She told reporters: “We are very happy to have the CI-SOC take over the old Sears store that closed a couple of years ago. The influx of new technical personnel into the city and the increase in jobs supporting their operations will be a big plus for the City of Delano for years to come.”

Sen TJ Kong (R,GA), who was responsible for the CI-SOC being located in Delano, told reporters that the new facility will bring an infusion of money, people and technology into the city and the region. “Delano has already seen a resurgence since construction and remodeling started on the facility early last year,” Kong said; “And we expect to see additional expansion as more facilities are brought under the CI-SOC umbrella.”

CAUTIONARY NOTE: This is a future news story –

US Cybersecurity Executive and Chinese CFO Both Released

Today simultaneous announcements were made by the governments of Singapore and Canada that the extradition cases against Dade Murphy of Dragonfire Cyber and Sabrina Meng of Huawei Technologies had been dismissed. Officials in both countries denied that there was any connection between the two cases. Both governments maintained that each of the cases had been dropped as a matter of local statutory requirements.

 

Meng had been arrested in December of 2018 on a US extradition warrant. Murphy was arrested in June of this year on a Chinese warrant for computer hacking.

 

Johnathan Quest, spokesperson for the Federal Bureau of Inquiry, said that there is still an active warrant out for the arrest of Meng. He refused to comment on the Canadian denial of extradition.

 

A spokesman for the Chinese Ministry of Justice refused to comment on the case against Murphy.

 

Nelson T. Johnson, spokesperson for the US State Department told reporters in today’s daily briefing that there had been no negotiations with the Chinese about the two cases.

 

Kate Libby at Dragonfire Cyber issued a corporate statement that said: “We are happy to hear that the extradition proceedings in Singapore have ended and look forward to having Dade return home. We expect for him to arrive here on a private jet from Singapore tomorrow or the next day.”

 

CAUTIONARY NOTE: This is a future news story –

Ransomware Re-infected from Sensor

Dragonfire Cyber published a report today on a recent ransomware attack on a PLC being used in a safety system at a Louisiana chemical manufacturing plant. There were two unique things about this ransomware attack, the report states. First the ransomware did not encrypt system files, it simply shutdown the safety system and demanded a 100-bitcoin ransom. The second item of interest is that the system was re-infected as soon as the affected PLC was released.

 

The active portion of the ransomware reset the Robotron SicherheitsKontrolle PLC to factory default settings, erasing the programming designed to ensure that the styrene storage tank remained in an inherently safe state. It also erased the control screen on the HMI used by the safety system, replacing the virtual system diagram with the ransomware message.

 

Since the affected system was a safety system, the facility had a preprogramed replacement on hand for both the PLC and the HMI. As soon as the ransomware message was reported, maintenance personnel were contacted and the two devices were replaced within an hour.

 

“The attackers understood how easy it was to replace the affected devices without resorting to paying the ransom,” Kate Libby, spokesperson for Dragonfire, told this reporter; “So they designed their ransomware system so that it would immediately infect the replaced equipment.”

 

The local control system maintenance personnel were not able to find the initial source of the infection or the re-infection. In order to ensure the safety of the facility, the company paid the ransomware and the system was immediately returned to its pre-infection state.

 

Dragonfire was retained to discover the source of the infection, determine how the system was re-infected, and ensure that there were no other problems with the system. The source of the initial infection was the USB that was used to apply the annual system updates for the safety system. The USB, sent from Robotron offices in Germany, was apparently intercepted at the local delivery company office and the infected with the ĀnquánShújīn worm.

 

The USB device was erased when it was removed from the laptop used to update the PLC, but the technician who performed the update copied the update to a backup drive for record keeping purposes. The drive erase program was not transferred as it was hidden USB firmware. The malware programming on the laptop was automatically erased and overwritten with the original update after the safety system was updated.

 

“With a copy of the actual ransomware code on hand, it was easy enough to track down the source of the re-infection,” Libby told me; “A copy of the worm was moved to one of the smart sensors attached to the safety system, in this case a Robotron DSensor”.

 

When the new PLC made initial contact with the infected sensor, the worm reinstalled the malware on the PLC, restarting the whole process.

 

Immanuel C. Securitage, spokesperson for ECS-CERT, said that the malware seen in this attack was much more sophisticated that the GUMMI BAREN ransomware that was seen in earlier attacks on Robotron PLC’s. “Two years allows for a lot of malware advancement,” IC Securitage told this reporter; “We also suspect that there may be a State actor involved which also allows for an entirely different level of sophistication.”

 

The Federal Bureau of Inquiry is reportedly investigating if this incident is the work of the NoReturn group that has been causing problems at a number of chemical companies in the United States. Johnathan Quest refused to comment on that portion of the ongoing investigation, saying: “We are continuing to work with the facility owner, ECS-CERT and Dragonfire on the incident investigation. We currently have no suspects, but we are talking with persons of interest at the GHB Air facility in Shreveport about the Robotron USB delivery.

 

CAUTIONARY NOTE: This is a future news story –

CyMoTrol Sues ECS-CERT for Libel and Slander

It was announced today that CyMoTrol, a German manufacturer of industrial motor controllers, had filed a libel and slander suit against ECS-CERT for information included in a recent control system cybersecurity alert published by the agency. They are asking for treble damages and punitive damages for publicly disparaging the cybersecurity measures used to protect their motor controllers. The suit also demands that ECS-CERT disclose the identity of the anonymous researcher, cYbrg0D, named in the Alert as the researcher who identified the multiple vulnerabilities so that charges of theft of intellectual property, unlawful access, and industrial espionage can filed on that individual.

 

Wilhelm Pieck, spokesperson for CyMoTrol, said that last week’s alert published by ECS-CERT contained out right lies, fabrications and mischaracterization of device features that had already led to one customer canceling a large order for the CyMo One motor controllers mentioned in the Alert and calls from many irate customers. “ECS-CERT never talked with us about the supposed vulnerabilities,” Pieck told reporters; “If they had we would have explained that the supposed vulnerabilities were carefully controlled features of the devices that improved service and increased production reliability when used in a properly protected industrial environment.”

 

Immanuel C. Securitage, spokesperson for ECS-CERT refused to talk about the pending litigation. He did, however, explain that the agency stood behind the information in the Alert. “Based upon extensive information provided by cYbrg0D, we stand behind the identification of the three vulnerabilities outlined in our Alert,” Securitage told reporters; “And we continue to suggest that device owners face the potential consequences we described for a potential exploit of those vulnerabilities in a production environment.”

 

Shortly after the announcement of the law suit became public cYbrg0D tweeted “CyMoTrol has hard coded backdoors in all of their products and software includes phone-home code to provide info to manufacturer.”

 

When asked about the TWEET® Pieck said “CyMoTrol maintains remote access capabilities in their products for maintenance purposes as part of our customer service program. This includes device reporting of anomalous conditions. These are carefully controlled processes and are an integral part of the service we sell. They are not vulnerabilities and do not provide access to the devices to anyone outside of our organization.”

 

CAUTIONARY NOTE: This is a future news story –

Control System Ransomware Attack Shuts Down Chem Plant

Blew Bayou Chemical Company announced that it had shut down its Shreveport, LA facility due to a ransomware attack on a control system at the facility. Only one storage tank safety system is currently affected, but the decision was made to shut down the entire plant as a precautionary measure. The Federal Bureau of Inquiry and the ECS-CERT are conducting a joint investigation.

Johnathan Quest, FBI spokesperson, told reporters that since the facility is considered critical infrastructure, a ransomware attack is considered to be a federal crime. “We are working closely with ECS-CERT and the facility owners to determine who is behind this attack;” Quest said.

Immanuel C. Securitage, ECS-CER spokesperson, confirmed that it had investigators onsite.

Issac B Kaghun, CEO of Blew Bayou Chemical, told reporters that the company became aware of the problem when a screen for the safety control system for the styrene monomer tank turned red and an announcement was printed on the screen that said a ransom would have to be paid to regain control of the system. The attackers asked for a ransom of 100 bitcoin for the return of control of the system.

Securitage told reporters: “The screen claimed that the safety PLC for the system was under the control of ‘ĀnquánShújīn’, Chinese for ‘safety ransom’. We have never seen this type of ransomware before.”

An investigator from Dragonfire Cyber working with the ECS-CERT team speaking anonymously said that, instead of encrypting files as is seen in most normal ransomware, the AS ransomware reprogramed the PLC to shutdown all sensors and valve controllers associated with the system.”

Securitage confirmed that the company had removed the affected PLC from the system and replaced it with a preprogramed substitute that was kept on hand for emergency situations. “The replacement worked properly for about five minutes and then it was corrupted as well,” he explained; “That caused us to assume that there was some sort of worm in the system that caused the reinfection. We recommended that the company under take a shutdown of all control systems pending further investigations.”

The company is currently running all safety systems in manual mode.

CAUTIONARY NOTE: This is a future news story –

Army ROWPU Hacked in Iraq

A thread on a logistics discussion board on REDDIT about a water supply issue for a US Army unit in Iraq claims that a cyberattack on a reverse osmosis water purification unity (ROWPU) employed by the 248^th Composite Supply Company caused it to stop functioning. Reportedly the Army has had to provide emergency water supplies to the unnamed unit. The Army has refused to comment on the reported incident.

 

The ROWPU is supposed to be a slightly modified version of Robotron Wasseraufbereitungsanlage (WABA) unit. Robotron recently released a security advisory for their WABA unit. According to that advisory there are multiple vulnerabilities in the unit that could be remotely exploited. The advisory explains that exploits could allow the unit to become over pressurized and damage the filtration cartridges.

 

Robotron spokesman Erich Mielke confirmed that the WABA advisory had recently been published on their web site. “The advisory includes mitigation measures to address the vulnerabilities and Robotron continues to work on updated firmware for the equipment,” Mielke said.

 

When asked if the US Army had been notified of the vulnerabilities, Mielke told this reporter: “We published the advisory on our web site. System owners are responsible for monitoring that site and taking appropriate actions.”

 

Kate Libby, a spokesperson for Dragonfire Cyber, confirmed that the Robotron disclosure process was fairly common in the industry. “I am surprised that a military contract would not include a vulnerability disclosure requirement for the vendor, but it could certainly happen,” Libby said.

 

When asked about the mitigation measures outlined in the Robotron advisory, Ms. Libby explained that the generic mitigation measures included not using the remote operation capabilities provided with the unit. She noted: “It would be impracticable to stop using the remote operation controls on a unit employed in Iraq. It would require keeping a person stationed at the unit during routine operations in 120˚ daytime temperatures.”

 

CAUTIONARY NOTE: This is a future news story –