Object Management Group (OMG) Data-Distribution Service (DDS) implementation issues exposing numerous vendor systems. Some patches are available. CISA recommends to
- Minimize network exposure for all control system devices and/or systems, and ensure that they are not accessible from the Internet.
- Locate control system networks and remote devices behind firewalls, and isolate them from the business network.
- When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.
The following vendors are affected:
- Eclipse CycloneDDS: All versions prior to 0.8.0
- eProsima Fast DDS: All versions prior to 2.4.0 (#2269)
- GurumNetworks GurumDDS: All versions
- Object Computing, Inc. (OCI) OpenDDS: All versions prior to 3.18.1
- Real-Time Innovations (RTI) Connext DDS Professional and Connext DDS Secure: Versions 4.2x to 6.1.0
- RTI Connext DDS Micro: Versions 3.0.0 and later
- TwinOaks Computing CoreDX DDS: All versions prior to 5.9.1
Siemens Nucleus RTOS TCP/IP Stack exposes Nucleus Net, Nucleus ReadyStart, and Capital VSTAR equipment.
Siemens has released updates for several of the affected products and recommends updating to the latest versions. Siemens recommends countermeasures for products where updates are not available. Siemens has not identified any additional specific workarounds or mitigations.
US CISA issues ICS ransomware factsheet. Recommendations include:
- ID critical processes & equipment
- Develop and test response plan
- Ensure adequate backups in place
- Practice cyber hygiene (patching, whitelisting, user management, MFA etc)
- Network segmentation
- Vigilent network monitoring
- Isolate impacted systems
- Power down where isolation is not possible
- Triage and restore impacted systems
- Obtain specialist third party assistance
- Take a forensic image
- Obtain decryptors via legal routes