FireEye reveals 1,600 industrial vulnerabilities since 2000

The flaws affect the reliable operation of sensors, programmable controllers, software and networking equipment of industry

FireEye has revealed there have been 1,600 vulnerabilities impacting industrial control systems (ICS) since 2000, potentially preventing the manufacturing business from running smoothly.

These vulnerabilities have affected a range of ICS components including sensors, programmable controllers, software and networking equipment used to automate and monitor the physical processes of industry.

The report released by FireEye described the lessons learnt in the last 15 years, which exposed many of the vulnerabilities uncovered cannot be fixed or patched because they are using outdated technology. Of the 1,600 flaws, a third are zero-days and have no vendor fixes, presenting a big opportunity for criminals to break in.

Additionally, the report revealed more than half of the flaws since 2013 are 'level 2' compromises, which relate to the operation of machinery. Hacks into these systems could result in the modification of controlled processes.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"To make matters worse, many of these vulnerabilities are left unpatched and some are simply unpatchable due to outdated technology, thus increasing the attack surface for potential adversaries," FireEye researchers Sean McBride, Jeffrey Ashcraft and Nathan Belk said in a blog post. "In fact, nation-state cyber threat actors have exploited five of these vulnerabilities in attacks since 2009."

FireEye said that 90 per cent of the vulnerabilities tracked appeared in the last five years and the company thinks this will grow as more ICS become the target of vulnerabilities.

"Unfortunately, security personnel from manufacturing, energy, water and other industries are often unaware of their own control system assets, not to mention the vulnerabilities that affect them," FireEye continued. "As a result, organisations operating these systems are missing the warnings and leaving their industrial environments exposed to potential threats."

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now
Advertisement

Recommended

Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/security/identity-and-access-management-iam/354289/44-million-microsoft-customers-found-using
identity and access management (IAM)

44 million Microsoft customers found using compromised passwords

6 Dec 2019
Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/hardware/354237/five-signs-that-its-time-to-retire-it-kit
Sponsored

Five signs that it’s time to retire IT kit

29 Nov 2019
Visit/business/business-strategy/354195/where-modernisation-and-sustainability-meet-a-tale-of-two
Sponsored

Where modernisation and sustainability meet: A tale of two benefits

25 Nov 2019