FireEye reveals 1,600 industrial vulnerabilities since 2000

The flaws affect the reliable operation of sensors, programmable controllers, software and networking equipment of industry

FireEye has revealed there have been 1,600 vulnerabilities impacting industrial control systems (ICS) since 2000, potentially preventing the manufacturing business from running smoothly.

These vulnerabilities have affected a range of ICS components including sensors, programmable controllers, software and networking equipment used to automate and monitor the physical processes of industry.

The report released by FireEye described the lessons learnt in the last 15 years, which exposed many of the vulnerabilities uncovered cannot be fixed or patched because they are using outdated technology. Of the 1,600 flaws, a third are zero-days and have no vendor fixes, presenting a big opportunity for criminals to break in.

Additionally, the report revealed more than half of the flaws since 2013 are 'level 2' compromises, which relate to the operation of machinery. Hacks into these systems could result in the modification of controlled processes.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"To make matters worse, many of these vulnerabilities are left unpatched and some are simply unpatchable due to outdated technology, thus increasing the attack surface for potential adversaries," FireEye researchers Sean McBride, Jeffrey Ashcraft and Nathan Belk said in a blog post. "In fact, nation-state cyber threat actors have exploited five of these vulnerabilities in attacks since 2009."

FireEye said that 90 per cent of the vulnerabilities tracked appeared in the last five years and the company thinks this will grow as more ICS become the target of vulnerabilities.

"Unfortunately, security personnel from manufacturing, energy, water and other industries are often unaware of their own control system assets, not to mention the vulnerabilities that affect them," FireEye continued. "As a result, organisations operating these systems are missing the warnings and leaving their industrial environments exposed to potential threats."

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now
Advertisement

Recommended

Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/policy-legislation/data-governance/354496/brexit-security-talks-under-threat-after-uk-accused-of
data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
Visit/security/cyber-security/354468/if-not-passwords-then-what
cyber security

If not passwords then what?

8 Jan 2020
Visit/web-browser/30394/what-is-http-error-503-and-how-do-you-fix-it
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020
Visit/policy-legislation/31772/gdpr-and-brexit-how-will-one-affect-the-other
Policy & legislation

GDPR and Brexit: How will one affect the other?

9 Jan 2020