Connecting the Dots for Connected Security

By Anonymous -

It is undeniable that organizations, government agencies, and critical infrastructure providers face evolving cyber threats with increased volume and complexity. Securing your organization's information and assets requires the right amount of effort focused on appropriate areas.


Cyber-Physical Systems Security 

According to the National Institute for Standards and Technology (NIST), "Cyber-Physical Systems (CPS) comprise interacting digital, analog, physical, and human components engineered for function through integrated physics and logic. These systems will provide the foundation of our critical infrastructure, form the basis of emerging and future smart services, and improve our quality of life in many areas."

 Automobiles, medical devices, building controls, automatic pilot avionics, and the smart grid are CPS examples. Each includes smart networked systems with embedded sensors, processors, and actuators that sense and interact with the physical world and support real-time, guaranteed performance in safety-critical applications.

While innovative, these systems also increase cybersecurity risks and malicious attacks, which is why proactive and coordinated efforts are needed to strengthen security and reliance on CPS.


Why Should Your Business Care about Cyber-Physical Security? 


While the crisis in Ukraine remains top of mind, many people remember the first-of-its-kind cyber attack on Ukraine's power grid in 2015 that set an ominous precedent for the security of power grids everywhere. 


According to U.S. reports, while the unscheduled power outages in Ukraine only lasted between one to six hours for all the areas hit, control centers were not fully operational for more than two months following the hack. 

 

In 2021 we saw rising gas prices and consumer concern following the Colonial Pipeline cyberattack. The hack, which caused chaos in the southern and eastern parts of the United States, also showed how vulnerable the U.S. energy grid is to more attacks in the future.


A few weeks later, the U.S. meat production industry came to a grinding halt due to another ransomware attack. So what do all these incidents have in common? They underscore the potential for harm when the cyber and physical worlds intersect. 


GRIMM Product Line: Train. Test. Detect. Protect.


As threats to critical assets increase, businesses need to expand security programs to encompass cyber-physical systems. 


A unique factor of the GRIMM product line is that we use real-world hardware to introduce a practical and realistic training experience to ready the workforce. Our cyber range has been built from the ground up, integrating all the required functionalities to meet different use cases, exposing all functionalities necessary to end-users.



Cyber-physical (CyPhy™) ranges built by GRIMM experts are used to demonstrate attacks on
critical infrastructure in real-time.


Contact GRIMM Experts  


Security and risk management (SRM) leaders must simultaneously expand their risk lens to support business resilience and growth goals in today's fast-evolving environments. 


At GRIMM, our experts leverage extensive research and development by using mock factory physical range and virtual cyber range capabilities to create cyber awareness solutions through testing, training, education, threat hunting and demonstrations. 


Our team can help your organization evaluate and develop a robust risk assessment program to protect your cyber-physical systems. To get in touch with a GRIMM expert or learn more, email: info@grimm-co.com.

Popular posts from this blog

New Old Bugs in the Linux Kernel

By Anonymous -
Image
  Introduction Dusting off a few new (old) vulns Have you ever been casually perusing the source code of the Linux kernel and thought to yourself "Wait a minute, that can’t be right"? That’s the position we found ourselves in when we found three bugs in a forgotten corner of the mainline Linux kernel that turned out to be about 15 years old. Unlike most things that we find gathering dust, these bugs turned out to still be good, and one turned out to be useable as a Local Privilege Escalation (LPE) in multiple Linux environments. Who you calling SCSI? The particular subsystem in question is the SCSI (Small Computer System Interface) data transport, which is a standard for transferring data made for connecting computers with peripheral devices, originally via a physical cable, like hard drives. SCSI is a venerable standard originally published in 1986 and was the go-to for server setups, and iSCSI is basically SCSI over TCP. SCSI is still in use today, especially...
Read more

Automated Struct Identification with Ghidra

By Anonymous -
Image
At GRIMM, we do a lot of vulnerability and binary analysis research. As such, we often seek to automate some of the analysis steps and ease the burden on the individual researcher. One task which can be very mundane and time consuming for certain types of programs (C++, firmware, etc), is identifying structures' fields and applying the structure types to the corresponding functions within the decompiler. Thus, this summer we gave one of our interns,  Alex Lin , the task of developing a Ghidra plugin to automatically identify a binary's structs and mark up the decompilation accordingly. Alex's writeup below describes the results of the project, GEARSHIFT, which automates struct identification of function parameters by symbolically interpreting Ghidra's P-Code to determine how each parameter is accessed. The Ghidra plugin described in this blog can be found in our GEARSHIFT repository . Background Ghidra is a binary reverse engineering tool developed by the National Sec...
Read more

SOHO Device Exploitation

By Anonymous -
Image
Netgear R7000 SOHO Device Exploitation After a long day of hard research, it’s fun to relax, kick back, and do something easy. While modern software development processes have vastly improved the quality of commercial software as compared to 10-15 years ago, consumer network devices have largely been left behind. Thus, when it’s time for some quick fun and a nice confidence boost, I like to analyze Small Office/Home Office (SOHO) devices. This blog describes one such session of auditing the Netgear R7000 router , analyzing the resulting vulnerability, and the exploit development process that followed. The write-up and code for the vulnerability described in this blog post can be found in our NotQuite0DayFriday repository. Initial Analysis The first step when analyzing a SOHO device is to obtain the firmware. Thankfully, Netgear’s support website hosts all of the firmwares for the R7000. The Netgear R7000 version 1.0.9.88 firmware used in this blog post can be downloaded from this web...
Read more