SynSaber: Only 41% of ICS vulnerabilities require attention

Exploitation is unlikely

The biggest reason that not every alert requires a response is a low probability of exploitation. SynSaber researchers determined that 29% of reported CVEs required user interaction for exploitation to occur. In addition, more than 22% required local or physical access to the system in order to exploit.

"It comes down to this idea that ICS were not secured by design when they were implemented three or four decades ago," Fabela said. "They were serial components, not built to be on an IP network, let alone connected to enterprises and third parties. They did not have built-in security controls like authentication or a lot of things these CVEs still talk about, including hardcoded passwords."

Rather, ICS was designed for efficiency, safety and reliability. Fabela emphasized that there are many advisories related to security protocols that essentially cannot be fixed in ICS environments because of the way those systems were designed. One example was encryption, which ICS designers feared would slow down processes. In addition, fixing flaws can require more complicated communications between asset owners and the original equipment manufacturer (OEM).

Another factor that makes a vast majority -- nearly 70% -- of CVEs unlikely to be exploited is a concept Fabela referred to as "access equals control." For some systems, there are no access controls or protocols preventing unauthorized use, he said. If a threat actor gets onto a network segment and can physically communicate with the programmable logic controller or relay, they can just send a command. The threat actor doesn't need to exploit a vulnerability to obtain control because the system was designed to be broadly accessible.

"It doesn't mean you shouldn't patch," he said, "but there's this weird tension between not wanting to overtly downplay the importance of patching and vulnerabilities while still having a contextual lens."

One example he provided was cross-site scripting, a type of attack young hackers often learn because it doesn't require a high level of sophistication. Fabela said there's no practical application in a control environment, but if someone wanted to send the device a command, they could. This is where having a contextual lens comes into play in recognizing that security teams do not have to prioritize cross-site scripting bugs, which could amount to thousands of fixes.

Another example Fabela provided was a CISA advisory on Inkscape that hit some of the key areas of what's practically exploitable. For one, it required a high level of human interaction. While examining the Inkscape flaw, which was reported by a researcher working with Trend Micro's Zero Day Initiative (ZDI), SynSaber researchers discovered that it affected a little-known plugin for engineers to create animated icons for their screens.

"It's so far removed from operations, and there are so many complicated steps to exploit it," Fabela said. "But if you look at it at face value, CISA put out an advisory, and it's rated 7.8."

OEMs come out on top

While security vendors and researchers, like those with ZDI and Claroty, accounted for 42% of total reported ICS vulnerabilities during the first half of 2022, the majority was generated by OEMs. The largest contributor was Siemens, which disclosed 230 CVEs, according to the research.

While Fabela said that could be interpreted as Siemens having insecure products, it's actually the opposite. He applauded the industrial manufacturing company for its transparency.

"They actually have a really good product security team, and finding their own bugs in house and going that extra step to report this is a huge sign of maturity. No other vendors are really doing that," he said.

Other generators include independent researchers and consultants who find bugs and disclose them to vendors or third-party organizations like ZDI. Fabela said there's an increased interest in industrial flaws, with more people hacking and analyzing ICS and OT, looking for high-profile vulnerabilities.

"There is a significant barrier to entry with bug hunting and research in industrial because sometimes you have to get your hands on the actual software or hardware, which is more difficult than enterprise," he said.

Though this was the inaugural report, Fabela said it is something SynSaber will continue to analyze. For the second half review, he said SynSaber will seek to gain additional insights in order to provide a different view of CVEs to the industrial community.