Tens of thousands of SCADA devices exposed to security incidents

According to a recent A&O IT Group report, the number of IoT/SCADA devices connected to the public Internet without the right security measures is growing. This practice leaves these devices exposed to potential cybersecurity campaigns.

“Throughout 2020, the number of unprotected SCADA devices has increased,” specialists say. This is a widespread practice, so experts fear that a large-scale attack could compromise the operations of thousands of organizations, especially in the context of the pandemic.

La imagen tiene un atributo ALT vacío; su nombre de archivo es ProxyM-un-nuevo-malware-que-afecta-a-dispositivos-IoT.jpg

Using the Shodan search tool, experts analyzed six groups of SCADA devices, detecting at least 43,500 exposed systems:

  • Tridium (15.706)
  • BACnet (12.648)
  • IP Ethernet (7.237)
  • Modbus (5.958)
  • S7 (1.480)
  • DNP (517)

Researchers also detected some interesting trends. For example, some users of protocols such as Modbus and S7 have demonstrated the adoption of best security practices, while other protocols do not have any kind of security: “Modbus and S7 are extremely mature technologies that have spent a lot of time in the public eye, so they are subject to greater scrutiny from specialists”.

This analysis also shows that the United States has established itself as the largest area of IoT attacks, with the largest number of unsecured devices in this territory: “Critical infrastructure operates on legacy networks. Now, due to the growing need to work remotely, these networks become increasingly obsolete, resulting in the recurrence of vulnerabilities that had already been fixed.”

As a protective measure, researchers recommend that organizations perform network mapping to identify all vulnerable devices and make all available updates. Network administrators should not underestimate the importance of network mapping to realize a complete security environment.

Finally, potentially vulnerable devices must remain isolated from the company’s overall IT network in order to prevent the infection spreading in the event of a security incident.