A vulnerability discovered in Delta’s popular enteliBUS Manager (eBMGR) highlights the importance of scrutinising digital infrastructure to the same degree as its physical counterparts.
Delta Control’s eBMGR is used across a range of facilities as a single-point solution for controlling everything from temperature to alarm systems and access control with little to no human interaction.
In December of 2018, a team from the McAfee Labs Advanced Research team uncovered a critical exploit in the system. This exploit would allow malicious external parties to take complete control of the system and, as a result, the facility.
Put simply, the team used a technique called ‘fuzzing’ to test the unit’s ability to handle the kind of varied network traffic that such a highly customisable system is expected to deal with. Eventually they found a flaw that seemed innocuous on the surface, but actually allowed them to manipulate the system to their whim, provided they were connected to the same network. Worse, if hackers discovered the IP address for the device, they could take control without having to know where it was located, or what kind of facility it was being used in. McAfee estimated that 1600 devices worldwide were exposed in this fashion, including some in Australia.
“Consider for a moment a positive pressure room in a hospital, the kind typically used to keep out contaminants during surgeries,” writes McAfee Security Researcher Mark Bereza.
“Managing rooms such as these is a typical application for the eBMGR and it does not take an overactive imagination to envision what kind of damage a bad actor could cause if they disrupted such a sensitive environment.”
The eBMGR vulnerability was patched out in late June 2019.
The situation highlights how important it is for facility managers to be vigilant about the security of the digital systems operating on site. Based on the nature of the devices, central control systems generally don’t receive the same level of technical support as other network elements such as servers or routers. That means it’s up to facility managers to understand the risks associated with them as well as they understand the benefits.
“A principle of least privilege policy may be appropriate, and a network isolation or protected network segment may help provide boundaries of access to adversaries,” says Senior Security Researcher Douglass McKee in a blog that breaks down the technical elements of the hack.
“An awareness of security research and an appropriate patching strategy can minimise exposure time for known vulnerabilities. We recommend a thorough review and validation of each of these important security tenants to bring these critical assets under the same scrutiny as other infrastructure.”
For an overview of how the McAfee team discovered and analysed the eBMGR bug, see the video below.
Image: 123RF’s fotogestoeber © 123RF.com
