13 July 2021

KLCERT-20-025: Rockwell Automation ISaGRAF Runtime: Information Disclosure due to Hard-coded Cryptographic Key

Researcher

Alexander Nochvay, Kaspersky ICS CERT

Timeline

Timeline

  • Kaspersky ICS CERT advisory updated

    15 November 2023

  • Kaspersky ICS CERT advisory published

    13 July 2021

  • Rockwell Automation published the advisory

    08 June 2021

  • Rockwell Automation confirmed the vulnerability

    11 March 2020

  • Vulnerability reported

    21 February 2020

Description

A remote attacker is able to decrypt passwords captured during a Man-in-the-Middle attack, because the affected software uses Tiny Encryption Algorithm (TEA) algorithm with fixed keys to encrypt transmitted passwords over ISaGRAF eXchange Layer* protocol.

*ISaGRAF eXchange Layer (IXL) is Rockwell Automation's proprietary system protocol. Programming software ISaGRAF Workbench communicates over the protocol with based on ISaGRAF Runtime devices to manage program (resources) on the devices and to control the devices itself.


Exploitability

⚠ Remotely exploitable: network access to port 1131/TCP is required

Attack complexity

High skill level to exploit: an attacker must perform Man-in-the-Middle attack

Privilege required

⚠ No privileges required

User interaction

User interaction required: a user must communicates over IXL protocol

Confidentiality

⚠ Confidentiality of the system may be seriously affected

Impact

A remote attacker is able to decrypt passwords captured during Man-in-the-Middle attack.

Affected products

  • Rockwell Automation ISaGRAF Runtime Toolkit 5 before version 5.72.00
  • AADvance Controller before version 1.041.3
  • Based on ISaGRAF Runtime 5 controllers before version 5.72.00
  • ISaGRAF Runtime 5 before version 5.72.00

Mitigation

Rockwell Automation mitigation

Upgrade to ISaGRAF Runtime 5 version 5.72.00.

To reduce risk, customers should ensure they are employing proper network segmentation and security controls. Specifically, network exposure for all control system devices should be minimized, and control systems should be behind firewalls and isolated from other networks when possible. Refer to the Converged Plantwide Ethernet (CPwE) Design and Implementation Guide for best practices deploying network segmentation and broader defense-in-depth strategies.

Customers should consider using proper network infrastructure controls, such as firewalls, UTM devices, VPN, or other security appliance.

For ISaGRAF, restrict or block traffic on TCP 1131 from outside of the industrial control system network zone. For more information on the TCP/UDP ports used by ISaGRAF refer to product documentation.

Since ISaGRAF 5 Runtime is provided to a customer as a development kit, implementing least-privilege may vary from implementation to implementation based on the hardware in use.

For AADvance controllers, customers are encouraged to restrict or block traffic on TCP 1132 from outside of the industrial control system network zone.1


  1. For more information on the TCP/UDP ports used by Rockwell Automation products, see BF7490.↩︎

Kaspersky publishes information on newly identified vulnerabilities in order to raise user awareness of the IT security threats detected. Kaspersky does not make any guarantees in respect of information received from vendors of products in which vulnerabilities have been identified, which is included in the following sections of the advisory: Affected Products, Vendor Mitigation.

Timeline

  • Kaspersky ICS CERT advisory updated

    15 November 2023

  • Kaspersky ICS CERT advisory published

    13 July 2021

  • Rockwell Automation published the advisory

    08 June 2021

  • Rockwell Automation confirmed the vulnerability

    11 March 2020

  • Vulnerability reported

    21 February 2020