Skip to content

CVSS 8.6 DoS Vulnerability in Mitsubishi Electric MELSEC iQ-R Series CPU

Our Researchers Discover Another Vulnerability 

As part of our mission to secure the world’s OT, IoT and Cyber Physical infrastructures, we invest resources into offensive research of vulnerabilities and attack techniques.

CVE-2020-16850 (US ICS-CERT) is a CVSS 8.6 remote CPU DoS vulnerability in Mitsubishi Electric iQ-R Series that has been discovered by SCADAfence researcher Yossi Reuven.

Mitsubishi Electric is one of the world’s leading electronics and electrical equipment manufacturing companies, and is in use by many of our customers. We have been working with Mitsubishi Electric for the last few months in handling multiple vulnerabilities, and on October 8th, Mitsubishi Electric published an official security advisory reporting this vulnerability and its mitigations.

About The Vulnerability – CVE-2020-16850

MELSEC iQ-R Series is Mitsubishi Electric flagship product line – designed for high productivity automation systems. iQ-R CPUs’ communication with GX Works 3 (Engineering software package) is done via Mitsubishi Electric proprietary protocol MELSOFT (which works on both TCP and UDP).

single specially crafted packet sent by an attacker over the MELSOFT UDP protocol on port 5006 will cause a denial-of-service (DoS) vulnerability due to uncontrolled resource consumption (CWE-400). The PLC’s CPU will get into fault mode, causing a hardware failure (error code: 0x3C00 – hardware failure). The PLC then becomes unresponsive and requires a manual restart to recover.

What SCADAfence Recommends Vendors To Do

Perform an Industrial Vulnerability Management Process

Please refer to our guide on this topic: https://www.scadafence.com/public-preview-a-comprehensive-guide-to-industrial-device-patching/

Monitor for Unauthorized Network Activity and Exploitation

Some devices will always remain unpatched. Monitoring is an early warning system that allows you to act before attackers have gained full control over your network.

Upgrade to the Latest Firmware (When Available)

Currently no firmware update is available (will be released soon by Mitsubishi Electric)

Prevent Unauthorized and Untrusted Access

– Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.

– Use within a LAN and block access from untrusted networks and hosts through firewalls.

Block UDP Port 5006 and Use MELSOFT TCP

MELSOFT is an engineering software for Mitsubishi PLCs and gives users the option to use either the (connectionless) UDP and (connection-oriented) TCP protocols for programming and configuring the devices. SCADAfence recommends to block Block UDP port 5006 since the cyberattack leverages the connectionless UDP protocol and can cause the PLCs to stop functioning and cause a denial of service. Instead, users should use the TCP protocol for communicating with devices in the shop floor or the control network.

Special Thanks & Recognition

The SCADAfence Research team would like to thank the Mitsubishi Electric team for a speedy vulnerability reporting process even during the challenging COVID-19 times.

SCADAfence is committed to continued research of offensive technologies and development of new defensive technologies.

Exploit PoC

We wrote a Python POC (GPLv3) script of the exploit in action.

Currently, there’s no patch available. As a result, we limit the access to the exploit to vetted individuals only. The exploit is only available for educational and legal research purposes.

Warning: The script will crash the PLC’s CPU – do not use it in production.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SCADAfence
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.

Safetica 9.5 – Ready for the cloud age

Download the report now!

In the next few weeks, we will be launching a brand new version of Safetica DLP. The new features allow Safetica to keep up with the undeniable trend of using cloud services for storing and working with sensitive data.

Take a quick look at our webinar recording and find out more from our Safetica Team.

E-mail DLP policies for Office 365

We’re very excited to see that so many of our customers are adopting Safetica Office 365 features to get a better picture of their cloud data. We’re also excited to let you know that Safetica 9.5 is now taking Office 365 integration to a whole new level with the introduction of e-mail DLP policies for Exchange Online! Protect your data on whichever devices your users use to communicate. In addition to auditing e-mail sent from work computers, home computers, and mobile devices, you can now enforce DLP policies over data sent from them.

Data anywhere, improved

We’re still fully committed to our ‘data anywhere’ philosophy that we introduced last autumn, and we’re pushing it even further. Safetica 9.5 improves on the previously introduced persistent file tagging with metadata technology, making it more robust and ready for wide use. If you hesitated before, now is the perfect time to embrace the new Safetica classification to ensure the audit and protection of your data anywhere.

Try Safetica with Azure SQL

Early adopters of cloud technologies will surely appreciate that Safetica can now also run on Azure SQL databases. Enjoy the benefits of hosting your data in the cloud, such as scalability of storage and performance, and easier database backup. This makes for an attractive and powerful alternative to running a limited instance of Microsoft SQL Server Express.

Safetica 9.5 – The most important changes

  • Email DLP policies for Office 365 / Exchange Online
  • Revamped automatic Office 365 integration configuration
  • Enhanced persistent file tagging using metadata-based context DLP technology
  • Support for Azure SQL database hosting
  • New built-in sensitive content templates for Brazil, Ecuador, Singapore
  • Improved support of security groups and large Active Directory structures
  • Improved support for end-to-end encrypted web sites, e.g. Telegram, WhatsApp, etc.
  • Revised security issues, charts and summaries in the Security Audit report
  • macOS device control in non-restrictive, alert-only mode
  • Improved file audit and Safetica client management on macOS
  • Coronavirus and home office

Author Ján Lakatoš

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Safetica
Safetica is to provide small and mid-sized companies with the same quality data protection that corporations have – affordably, and without any additional IT administration or disruptions in operation.

Nobel laureate Kip Thorne chairs the ESET Science Award International jury in 2020

BRATISLAVA – The laureates of this year’s ESET Science Award will be decided by the International jury chaired by a Nobel laureate, Kip Thorne. An American physicist known for his work in gravitational physics and astrophysics, Thorne is one of the three scientists who were awarded the 2017 Nobel Prize in Physics. He entered the world of science fiction as an executive producer and scientific advisor on the movie Interstellar. Together with other members of the jury, he will select the laureates in two categories of the ESET Science Award: Outstanding Individual Contributor to Slovak Science and Exceptional Young Scientist in Slovakia under the Age of 35.

The International jury of renowned scientists is one of the pillars of the ESET Science Award. When evaluating finalists and selecting laureates, they assess various parameters of scientific work, such as current scientific research results and publications, measurable scientometric data, involvement in international scientific projects, communication and popularization, cooperation with other scientific disciplines, the principles of scientific ethics, the potential impact of scientific work on other areas of life, and as reference point for close collaborators or students.

The chair of the International jury in 2019 was the German biophysicist Erwin Neher, laureate of the Nobel Prize in Physiology or Medicine in 1991 for his development of the patch-clamp technique for detection of ion activity in the cell membrane. Kip Thorne will fill the role of chair on the International jury in 2020. He is known for his work in gravitational physics and astrophysics, with an emphasis on relativistic stars, black holes and gravitational waves. He and two other scientists were awarded the 2017 Nobel Prize in Physics for the first direct detection and observation of gravitational waves. Since his retirement, Thorne has taken new directions in his career, including film, where he was not only a consultant on the blockbuster movie Interstellar but also a co-author of its original concept.

The International jury consists of the following renowned scientists:

Hana Dvořaková is a Czech chemist and philanthropist who has dedicated her scientific career to the development of substances that can be used against the HIV virus. In 2013, she and her husband Dalimil founded the Experientia Foundation, which focuses on supporting young scientists in the field of organic, bioorganic and medicinal chemistry with the aim of making Czech chemistry among the world’s best.

Rolf-Dieter Heuer is an experimental particle physicist. Most of his scientific work is related to the study of electron-positron reactions, the development of experimental techniques, and the construction and operation of large detection systems. Professor Heuer was the Director-General of CERN from 2009 to 2015. More recently, he has served as the chair of the European Commission’s Group of Chief Scientific Advisors.

Ralf Riedel focuses on two main areas – molecular synthesis of advanced ceramics at ultra-high temperatures and their energy-related applications, and ultra-high-pressure synthesis of new materials.

Fiona Watt is a British scientist, internationally known for her work in stem cell research. She has explored the role of stem cells in maintaining the skin, which is constantly repaired and replaced throughout our lifetime. She has discovered factors that control how stem cells differentiate, shedding light on how this process might be disrupted in mouth and skin cancer.

Tibor Krisztin is a Hungarian mathematician working on dynamical systems and differential equations. Since 2000, he has been a professor at the Bolyai Institute of the University of Szeged, where he was also the director from 2011 to 2014.

The third category of the ESET Science Award, Outstanding Academic, is decided by a committee composed of representatives of Slovak universities. The award laureates will be announced via an online event on the ESET Science Award Facebook profile on Wednesday, October 14, at 1:30 pm (CEST).

Further information is available at www.esetscienceaward.sk.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Network Authentication & Portnox CLEAR

Traditionally, enterprises have enabled network authentication via usernames and passwords. As we now know today, this method of network authentication can be easily compromised by bad actors, making it no longer sufficiently secure for enforcing network access control. As a means of elevating and strengthening network authentication, Portnox has introduced several new and powerful certificate authority services within Portnox CLEAR, our cloud-delivered network access control solution.

Types of Network Authentication with Portnox CLEAR

Self-Onboarding (Agent-Based)

When an endpoint enrolls using AgentP, Portnox CLEAR will automatically generate a supplicant certificate for the endpoint. This is true for all supported operating systems (Windows, OSX, Linux, etc.), and for all AgentP enrollment methods.

Self-Onboarding (Agentless)

For those not using AgentP, Portnox CLEAR generates an organizational root certificate upon org creation in the system and adds the root certificate to its list of trusted root certificates.

Simple Certificate Enrollment Protocol (SCEP)

To make certificate issuance easier for our customers, Portnox CLEAR also supports SCEP, the open-source protocol, which issues a one-time password to the user transmitted out-of-band.

Microsoft InTune

Portnox CLEAR customers utilizing our MS InTune integration can use InTune to authenticate devices to the network as an alternative to Portnox’s agent-based or agentless options.

EAP-TLS 802.1X

EAP-TLS is considered by many to be the gold standard when it comes to network authentication. EAP-TLS 802.1X authentication is available with Portnox CLEAR out of the box.

Simple, Secure Certificate Authority Services

With Portnox’s ability to offer companies an easy and secure certificate authority services, each customer can leverage its own certificate authority in the cloud, allowing for simpler, more seamless and secure user onboarding. Once configured, Portnox CLEAR will issue every user an identity certificate for self-enrollment via the portal. Once the user has a certificate, he/she will then be granted password-less authentication.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

How to Manage Your Evolving Edge Computing Needs With Hyperconvergence

Over the past ten years, hyperconvergence transformed IT infrastructure by uniting server, storage, and hypervisors. This led to significant reduction in costs and complexity for many enterprise companies, but due to limitations in the ability to reduce the size of nodes, many small and medium-sized businesses were unable to achieve the same efficiencies. In this blog, we explain how HCI has evolved over the past ten years, and why Scale Computing built the first system that helps SMBs scale their IT infrastructure down, in order to scale their businesses up. Two Types of Hyperconverged Solutions There are two types of ways in which hyperconverged solutions handle storage management. The first one is to create a virtual machine dedicated to managing all of the storage resources on a local node. This is called a virtual storage appliance or VSA. This type of solution is generally more inefficient and requires more overhead because the virtual machine is in the data path for all I/O operations that take place on the host and betweens hosts in the cluster. The second option is to use a hypervisor operating system to handle storage operations. Rather than a controller virtual machine, this module is the key player in the data path to handle storage operations. This is how we architect our solutions at Scale Computing due to improved performance and integration with the rest of the I/O stack. Evolution of Storage Locations Most organizations start out very small, often in a single location. Managing IT infrastructure in one location, with IT on-site, is fairly easy. However, as companies grow and require new locations to manage customer service, distribution, additional franchises, etc. it traditionally required IT to build complex systems where on-premises hardware was housed at each building, but managed in the central office. Predictably, this created issues with lack of support since it would be costly to have dedicated support staff at satellite offices; IT organizations struggled to find space and cooling systems for servers; and increased costs because this approach required multiple, expensive multi-tier IT deployments. Supplying Affordable, Dependable IT Infrastructure Solutions at the Edge The collection of use cases and computing needs in satellite locations (like security and point of sale systems) are collectively called the edge, and edge computing is what powers these use functions. Often, edge computing requirements are lesser than what is needed at the primary data center, so nodes can be smaller yet they still need to be highly available, all while being cost-effective and simple to use. Historically, finding this type of a solution for small and medium-sized businesses was difficult because hyperconverged solutions were generally built for enterprise companies where cost is less of a concern. In addition, most hyperconverged solutions are incapable of making nodes smaller, so storage becomes a resource sinkhole. Scaling Down So Businesses Can Scale Up To solve these problems, we launched our HE150 and HE500 series of appliances that consumes a fraction of the processing overhead of other solutions. The Scale Computing Reliable Independent Block Engine (SCRIBE) storage engine is purpose-built to provide highly available, scalable compute and storage services at the core and at the edge with as little overhead as possible. And, the reduced complexity of our solution means that even a store manager or IT generalist can perform maintenance on the cluster, including replacing failed drives, rebooting virtual machines, and rebooting nodes. Avoiding Hardware Vendor Lock-In With Scale Computing Another advantage of our hyperconverged solution is that you are not locked into a specific vendor’s hardware as you scale. The hardware you start with is not what you have to evolve with, and that the mixing and matching avoids large “forklift” upgrades in the future. For edge computing or distributed enterprise, you may start small with Intel NUC and progress to fully racked server clusters (or vice versa). In fact, our customers often mix hardware to match use cases (for example, IntelNUC at edge sites with other brands at core datacenter), or are mixing Scale-on-new appliances with Scale Computing software on older gear, in which case the hardware doesn’t even match within a single cluster. All of this means that you can build the most reliable, flexible, and affordable infrastructure for your business. To learn more about our hyperconverged infrastructure solutions, check out this new whitepaper: Going Small to Get Big: Why SMB and the Edge Have Emerged as Pivotal Use Cases for Hyperconverged Infrastructure.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Scale Computing 
Scale Computing is a leader in edge computing, virtualization, and hyperconverged solutions. Scale Computing HC3 software eliminates the need for traditional virtualization software, disaster recovery software, servers, and shared storage, replacing these with a fully integrated, highly available system for running applications. Using patented HyperCore™ technology, the HC3 self-healing platform automatically identifies, mitigates, and corrects infrastructure problems in real-time, enabling applications to achieve maximum uptime. When ease-of-use, high availability, and TCO matter, Scale Computing HC3 is the ideal infrastructure platform. Read what our customers have to say on Gartner Peer Insights, Spiceworks, TechValidate and TrustRadius.

×

Hello!

Click one of our contacts below to chat on WhatsApp

×