Data Info

Ilya Karpov, a Positive Technologies expert, detected vulnerabilities in products intended for building automation systems in various industries — from petrochemical to power plants.

Ilya found a problem related to clear-text password storage in Schneider Electric systems — InTouch Machine Edition 2014 (version 7.1, Service Pack 3, Patch 4) and InduSoft Web Studio (7.1.3.4), as well as in their previous builds. The vulnerability that got the CVE-2015-1009 identifier and 6.4 base mark though cannot be exploited remotely requires only a low-qualified internal attacker.

Schneider Electric specialists recommend users to install new security updates as soon as possible (a patch for InTouch Machine Edition 2014 and a patch for InduSoft Web Studio) and restrict physical access of the personnel to these systems in order to decrease a potential risk of confidential information disclosure by internal attackers.

In July, Siemens issued a special update for the April note, where it thanked Ilya Karpov for detecting a dangerous and easy-to-use vulnerability that was threatening security of quite a few Siemens SIMATIC-based solutions:

• SIMATIC HMI Basic Panels 2nd Generation — all the versions up to WinCC (TIA Portal) V13 SP1 Upd2;
• SIMATIC HMI Comfort Panels — all the versions up to WinCC (TIA Portal) V13 SP1 Upd2;
• SIMATIC WinCC Runtime Advanced — all the versions up to WinCC (TIA Portal) V13 SP1 Upd2;
• SIMATIC WinCC Runtime Professional — all the versions up to WinCC (TIA Portal) V13 SP1 Upd2;
• SIMATIC WinCC Runtime Professional — all the versions up to WinCC (TIA Portal) V13 SP1 Upd2;
• SIMATIC HMI Mobile Panel 277 (WinCC TIA Portal) — all the versions up to WinCC (TIA Portal) V13 SP1 Upd4;
• SIMATIC HMI Multi Panels (WinCC TIA Portal) — all the versions up to WinCC (TIA Portal) V13 SP1 Upd4;
• SIMATIC WinCC V7.X — all the versions up to V7.3 Upd4;
• SIMATIC PCS 7 — all the versions up to V8.1 SP1.

The CVE-2015-2823 error rated 6.8 allows using user password hash function in order to authenticate locally and remotely at the server. You dont even have to know the password.

All necessary tests for security issues detected in Siemens SIMATIC software have been added to the knowledge base of the PT MaxPatrol vulnerability and compliance control management system.

Positive Technologies started to cooperate with leading ICS vendors long ago. The large-scale study “SCADA safety in Numbers” was presented on 2012. A year later, PT experts created Choo Choo Pwn — an up-to-date large-scale railway model, whose components (trains, railroad crossing gates, and traffic lights) are controlled by an ICS based on three real SCADA systems. The model was used for SCADA security contest at Positive Hack Days, the annual international conference on information security.

In 2014, the contest infrastructure was significantly changed to allow detection of zero-day vulnerabilities within a wider range of systems and industrial protocols including: transport, city lighting system, power plants and various robots. The contest’s winner Alisa Shevchenko was thanked by Schneider Electric for the vulnerabilities she identified.  

This years Choo Choo Pwn was even more realistic: the participants couldnt send a command leading to a failure because the traffic security logic wouldnt let that happen. So, the goal of the challenge was to break the transport security means.

Huawei thanked the Positive Technologies experts Timur Yunusov and Kirill Nesterov and the information security specialist Alexey Osipov, who detected a harmful vulnerability in Huawei 4G USB modems (E3272s) and helped to fix it.


Upon the research, the Chinese telecommunications equipment company issued a software update for the device.

According to the Huawei PSIRT bulletin, a potential intruder can block the device by sending a malicious packet. The Positive Technologies researchers claim that the vulnerability may lead to a DOS attack and remote arbitrary code execution via an XSS attack or stack overflow.

In late 2014, Positive Technologies specialists carried out a large-scale research on vulnerabilities in 4G USB modems, which included investigation of six different series of devices (including Huawei E3272s) with 30 various types of firmware.

By exploiting detected flaws, an intruder can gain rights on a remote modem, take control over the computer connected to the vulnerable modem, and obtain access to the subscribers account in the mobile operators portal. Moreover, attacks on SIM cards via binary SMS messages allow an attacker to intercept and decrypt a subscribers traffic, track his or her location, and block the SIM card. Timur Yunusov covered attacks on 4G network equipment in his speech at PHDays V in May 2015. You can watch his presentation Bootkit via SMS: 4G Access Level Security Assessment on Positive Technologies page on YouTube.

This is not the first research on the safety of telecommunications equipment and mobile network conducted by Positive Technologies experts. In January 2015, Evgeny Stroev issued a report on severe SNMP vulnerabilities in network equipment produced by Huawei and H3C. Those vulnerabilities allowed penetrating a corporate network of any company, including a technological network of a mobile carrier.

A research, carried out by Dmitry Kurbatov, Sergey Puzankov, and Pavel Novikov in February 2015, revealed that a good few of 2G and 3G mobile networks can be accessed via the internet because of open GTP ports and other open data transfer protocols (FTP, Telnet, HTTP). An attacker can connect to the node of a mobile network operator by exploiting vulnerabilities (for example, default passwords) in these interfaces.