Claroty launches Team82, its new research arm that provides vulnerability and threat research to customers and defenders of industrial networks.
Team82 recently released a report on critical vulnerabilities found in cloud-based management platforms for industrial control systems (ICS). The report highlighted the rise of ICS in the cloud and the growing need to secure cloud implementations in industrial environments.
Team82, in its latest report, Top-Down and Bottom-Up: Exploiting Vulnerabilities in the OT Cloud Era, researched the exploitability of cloud-based management platforms responsible for monitoring ICS, and developed techniques to exploit vulnerabilities in automation vendor Codesys’ Automation Server and vulnerabilities in the Wago PLC platform.
Claroty says Team82’s research mimics the top-down and bottom-up paths an attacker would take to either control a Level 1 device to compromise the cloud-based management console, or the reverse: commandeer the cloud in order to manipulate all networked field devices.
“Team82’s research was motivated by how organisations are incorporating cloud technology into their OT and IIoT for simplified management, better business continuity, and improved performance analytics,” explains Claroty vice president of research Amir Preminger.
Preminger suggests: “In order to fully reap these rewards, organisations must implement stringent security measures to secure data in transit and at rest, and lock down permissions. We thank the Codesys and Wago teams for their swift response, updates, and mitigations that benefit their customers and the ICS domain.”
The new Team82 Research Hub offers new research reports, a vulnerability dashboard for tracking the latest disclosures, a coordinated disclosure policy for working with affected vendors, its public PGP Key for securely and safely exchanging vulnerability and research information, and other resources.
Team82, formerly known as The Claroty Research Team, is known for its rapid development of industrial threat signatures, proprietary protocol analysis, and discovery of ICS vulnerabilities.
The team is proud to disclose a total of 146 vulnerability discoveries and disclosures to date, and was the first to develop and release signatures for Ripple20 and Wibu-Systems CodeMeter vulnerabilities and the threat actors that target them.
The team works closely with leading industrial automation vendors to evaluate the security of their products.