REMINDER: GE-Identified Recent Protection Relay Vulnerabilities

Summary:

In the context of increased risk of cyber activity, this is a reminder of a couple of GE protection relay vulnerabilities that were identified in the recent past that should be evaluated to determine if they have been recognized and addressed if applicable to an entity's facility.

Additional Discussion:

• A team of researchers from New York University said they identified a severe flaw in some of GE’s Multilin SR protection relays, which are widely deployed in the energy sector. The experts will detail and demonstrate an exploit at the upcoming Black Hat conference in Las Vegas, but they have shared some information on their findings
  • In an advisory, ICS-CERT said the remotely exploitable vulnerability, tracked as CVE-2017-7905, is related to the use of non-random initialization vectors when encrypting passwords, which exposes them to dictionary attacks. An attacker who can obtain the password — either from the front LCD panel or via Modbus commands — can hijack the affected device.
  • ICS-CERT reported that the flaw affects the 750 and 760 Feeder Protection Systems, 369 and 469 Motor Protection Relays, 745 Transformer Protection Relays, and 489 Generator Protection Relays.
  • GE released firmware updates that address the vulnerability and patches.
• Advisories published by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and GE Grid Solutions (account required) informed customers that more than a dozen UR protection and control relays are impacted by a series of vulnerabilities to which 10 different CVE identifiers have been assigned. The vendor released firmware updates that should patch the vulnerabilities.
  • In terms of impact, experts pointed out that while the vulnerable relays are used within the energy industry, they are not limited to the “grid.” For example, a mine may be generating power, and these types of devices might be present.
  • The flaws are related to inadequate encryption of communications, exposure of potentially sensitive information, cross-site scripting (XSS) attacks, denial-of-service (DoS) attacks, unauthorized firmware uploading, the inability to disable a factory service mode, and the presence of hardcoded credentials in the bootloader. More than half of the vulnerabilities have a severity rating of high or critical.
  • Researchers from SCADA-X, Verve Industrial, VuMetric and the Department of Energy’s Cyber Testing for Resilient Industrial Control Systems (CyTRICS) program have been credited for finding the security holes.

Links:

• https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02
• https://www.cisa.gov/uscert/ics/advisories/ICSA-17-117-01B