The problem is that the RuggedCom software, owned by Siemens, uses a single software key to decode encrypted traffic; and that this key can be easily extracted.
The ICS-CERT alert refers to Justin W. Clarke of Cylance Inc’s public report. “According to this report, the vulnerability can be used to decrypt SSL traffic between an end user and a RuggedCom network device.” It says the vulnerability is remotely exploitable and can lead to loss of system integrity; and adds that ICS-CERT “is currently coordinating with the vendor and security researcher to identify mitigations.”
According to Reuters, however, this won’t be easy. “Clarke said that [the] problem will be tough to fix because all Rugged Operating System software uses a single software ‘key’ to decode traffic that is encrypted as it travels across the network. He told Reuters that it is possible to extract that ‘key’ from any piece of RuggedCom's Rugged Operating System software.”
The problem is that once hackers can spy on encrypted RuggedCom traffic, it would be possible to steal legitimate credentials and gain access to critical systems. “If you can get to the inside, there is almost no authentication, there are almost no checks and balances to stop you,” Clarke told Reuters.
The potential damage that can be caused to critical systems if hackers can get to the inside has been a hot topic ever since Stuxnet was used to attack the Iranian nuclear program. ICS-CERT makes three interim recommendations pending a full solution to the vulnerability. These include isolating control system networks from the business network behind a firewall, minimizing contact with the internet, and where remote access is necessary “employ secure methods, such as Virtual Private Networks (VPNs).”
This is the second flaw in RuggedCom systems discovered by Clarke. In May the company had to issue an update to its software following his earlier disclosure that it contained an undisclosed backdoor account that could give hackers remote access to the equipment with an easily obtained password.