Critical Infrastructure Security: Over 145,000 ICS Systems Exposed Online

New research highlights a major cybersecurity concern: over 145,000 Industrial Control Systems (ICS) are currently exposed to the internet across 175 countries. These systems, vital to critical infrastructure operations, represent a growing attack surface for cybercriminals. The United States leads the list, accounting for more than one-third of these exposures, according to findings by Censys, an attack surface management company.

This alarming discovery underscores the need for proactive measures to secure these systems, many of which utilize outdated protocols and configurations that remain vulnerable to exploitation. Below, we explore the scope of this issue, its implications, and actionable steps to mitigate the risk.

Regional Distribution of Exposed Devices

The study found significant geographical disparities in exposure:

• North America: 38% of exposed devices, with the U.S. alone accounting for over 48,000 systems.
• Europe: 35.4% of exposures, showcasing significant vulnerabilities in countries like Germany, Italy, and Spain.
• Asia: 22.9% of exposures, including notable instances in South Korea and China.
• Other Regions: Oceania (1.7%), South America (1.2%), and Africa (0.5%) had comparatively lower exposure levels.

Key protocols, such as Modbus, IEC 60870-5-104, and OPC UA, remain foundational despite their aging security frameworks. The study also revealed that the usage of these protocols varies by region. For example, Modbus and IEC 60870-5-104 dominate in Europe, while North America leans on protocols like BACnet and Fox.

Critical Risks and Real-World Incidents

Exposed systems present a broad attack surface, enabling malicious actors to disrupt operations or access sensitive data. For instance:

1. ICS-Specific Malware: The rise of malware targeting ICS, such as FrostyGoop (also known as BUSTLEBERM), demonstrates the increasing sophistication of threats. This malware exploits the Modbus TCP protocol to disrupt operational technology (OT) networks. A recent attack in Ukraine targeted an energy company using this method, showcasing the geopolitical dimensions of vulnerabilities.
2. Water Infrastructure Breaches: In 2023, the Municipal Water Authority of Aliquippa, Pennsylvania, suffered a breach via exposed Unitronics programmable logic controllers (PLCs), resulting in system defacement with anti-Israel messages.
3. Botnet Activity: Malware such as Aisuru and Kaiten exploit default credentials, not only for distributed denial-of-service (DDoS) attacks but also to delete critical data.

Sector-Specific Challenges

Certain industries face unique risks. Censys noted that 34% of exposed C-more human-machine interfaces (HMIs) are related to water and wastewater management, while 23% pertain to agricultural processes. The healthcare sector, too, grapples with vulnerabilities in medical devices like Digital Imaging and Communications in Medicine (DICOM) workstations, as highlighted by Forescout. These devices are often outdated, making them attractive targets for attackers seeking to access sensitive patient data.

Contributing Factors to Exposure

The widespread exposure of ICS systems can be attributed to several factors:

• Legacy Protocols: Many ICS protocols, dating back to the 1970s, were designed without modern cybersecurity considerations.
• Remote Access Needs: The increasing use of HMIs for remote monitoring has inadvertently widened the attack surface.
• Lack of Metadata: Identifying the ownership of exposed systems is challenging, as ICS protocols seldom provide details like company names or logos.
• ISP Vulnerabilities: Business-grade internet service providers, including Verizon and Deutsche Telekom, host many exposed devices, complicating efforts to pinpoint responsibility.