CVE-2019-9569 and the Real Danger of HVACking
CYBER NEWS

CVE-2019-9569 and the Real Danger of HVACking

1 Star2 Stars3 Stars4 Stars5 Stars (1 stemmer, gennemsnit: 4.00 ud af 5)
Loading ...

There’s a new potential threat endangering our physical security, and it’s known as HVACking.

The term was coined by McAfee Labs researchers who discovered a zero-day security flaw in a widely used building controller designed to manage various systems. These systems include HVAC (heating, ventilation, and air conditioning), alarms, and pressure level in controlled environments. The vulnerability is tracked under the CVE-2019-9569 advisory.




Ifølge forskernes rapport, they recently investigated an industrial control system (ICS) produced by Delta Controls:

The product, called “enteliBUS Manager”, is used for several applications, including building management. Our research into the Delta controller led to the discovery of an unreported buffer overflow in the “main.so” library. This flaw, identified by CVE-2019-9569, ultimately allows for remote code execution, which could be used by a malicious attacker to manipulate access control, pressure rooms, HVAC and more.

The researchers reported their findings to Delta Controls on December 7th, 2018. "Within just a few weeks, Delta responded, and we began an ongoing dialog while a security fix was built, tested and rolled out in late June of 2019. We commend Delta for their efforts and partnership throughout the entire process", eksperterne sagde.

More about CVE-2019-9569

Kort, CVE-2019-9569 is a buffer overflow that can lead to remote code execution when it is exploited sufficiently. It took some time for the research team to collect enough data and create a working exploit. One of the peculiar discoveries based on the attack attempts is that an attack can happen even when the location of the targeted system on the network is not known.

Relaterede:
Ifølge en ny rapport fra Anvendt Risiko foretaget af sikkerhed forsker Alexandru Ariciu, ?multiple vulnerabilities were found in MOXA E1242 Ethernet remote I/O series used in factory automation.? The vulnerabilities can trigger code injection in the web application, and...Read more
Factory Automation Sårbarheder kunne udløse Code Injection

For this to be possible, the attack uses the so-called broadcast traffic, meaning that the attack can be launched without knowing the location of the targets on the network.

Men, if the attacker knows the IP address of the device, the exploit can be carried out over the Internet, increasing its impact exponentially, noted Mark Bereza of McAfee in et blogindlæg summarizing the vulnerability. Full technical disclosure is also available.

Avatar

Milena Dimitrova

En inspireret forfatter og indhold leder, der har været med SensorsTechForum for 4 år. Nyder ’Mr. Robot’og frygt’1984’. Fokuseret på brugernes privatliv og malware udvikling, hun tror stærkt på en verden, hvor cybersikkerhed spiller en central rolle. Hvis almindelig sund fornuft giver ingen mening, hun vil være der til at tage noter. Disse noter senere kan blive til artikler!

Flere indlæg

Efterlad en kommentar

Din e-mail-adresse vil ikke blive offentliggjort. Krævede felter er markeret *

Frist er opbrugt. Venligst genindlæse CAPTCHA.

Del på Facebook Del
Loading ...
Del på Twitter Tweet
Loading ...
Del på Google Plus Del
Loading ...
Del på Linkedin Del
Loading ...
Del på Digg Del
Del på Reddit Del
Loading ...
Del på Stumbleupon Del
Loading ...