Simatic

And well, maybe we can get in touch and then get some data that helps us emulate these devices.

And sticking here with an industrial control system and Honeypot story, there is evidence as presented by WarnCheck that the recently patched vulnerability in SIMATIC equipment that's running Node-REP, which is essentially their admin API, is being exploited now so again this was a patched in august but now is actively being exploited the exploit here is i would say almost not so terribly spectacular in that they just run some standard linux scripts wget download additional malware to the system to gain persistent remote access to these controllers so definitely something to look out for and yes make sure your industrial control systems are patched and properly locked down and in case you're running cp guard cp guard is an endpoint protection anti-malware product it's often used sort of in shared hosting environments like if you're using cpanel i think it integrates quite well with that well ops shield the company behind cp guard did announce that their update channel was compromised.

So essentially, Tacker was able to gain access to the server they stored their updates on, was able to add a malicious script.

And yes, that script does have the usual credential exfiltration and the like.

One entry requires, um, uh, particular attention before the others, uh, and let's talk about that one.

Siemens publishing seventeen new advisories covering products including SIMATIC S7-1500 CPUs, industrial edge devices, and Ruggedcom Crossbow station access controller.

The SIMATIC S7-1500 advisory alone covers more than four hundred vulnerabilities in the GNU/Linux subsystem, high-severity issues affecting Ruggedcom Crossbow, uh, vulner-- um, SIMATIC, uh, IPCs, PSS, CYNICAL, and the .NET client library for SIMATIC S7 Web Server API, Industrial Edge App Publisher, and SIMATIC WinCC, among others.

Siemens has released patches for some vulnerabilities and provided mitigation for others pending permanent fixes.

Rockwell's advisory for, uh, 1732E ArmorBlock I/O modules covers a critical flaw allowing an unauthenticated attacker to change the device web server password, taking over an admin account without any credentials.