How to remediate – Schneider Electric InduSoft Web Studio Detection

1. Introduction

Schneider Electric InduSoft Web Studio is software used for managing and monitoring SCADA systems. This vulnerability means a remote host has this software installed, potentially allowing unauthorised access to connected industrial control systems. A successful exploit could compromise the confidentiality, integrity, and availability of these systems.

2. Technical Explanation

InduSoft Web Studio allows remote management of SCADA systems. This creates a potential attack surface if not properly secured. An attacker could gain access to the software and then control connected industrial processes. There is no known CVE associated with this detection, but it highlights a need for review. A realistic example would be an attacker using default credentials or exploiting a vulnerability within the Web Studio interface to gain administrative control of the SCADA system.

• Root cause: The software is installed and accessible from a remote network without sufficient security measures in place.
• Exploit mechanism: An attacker attempts to connect to the InduSoft Web Studio instance, potentially using default credentials or known vulnerabilities within the application itself.
• Scope: Systems running Schneider Electric InduSoft Web Studio are affected. Specific versions were not provided.

3. Detection and Assessment

Confirming whether a system is vulnerable involves identifying if the software is installed and accessible. A quick check can determine its presence, while scanning provides more detailed information.

• Quick checks: Check for the InduSoft Web Studio service running or look for associated processes in Task Manager (Windows) or using `ps` command (Linux).
• Scanning: Nessus vulnerability scan ID 168597 can detect this software. This is an example only.
• Logs and evidence: Review application logs for connection attempts from unknown sources. Specific log paths depend on the installation location, but look in the InduSoft Web Studio program directory.

ps -ef | grep indusoft

4. Solution / Remediation Steps

Fixing this issue requires securing or removing the software. These steps aim to reduce risk and protect connected systems.

4.1 Preparation

• Ensure you have access to the original installation media or recovery options. A roll back plan involves restoring from the backup or reinstalling the software with secure settings.
• Changes should be approved by the IT security team and scheduled during a maintenance window.

4.2 Implementation

1. Step 1: Change the default password for all InduSoft Web Studio accounts to a strong, unique value.
2. Step 2: Restrict network access to the InduSoft Web Studio instance using firewalls and access control lists (ACLs). Allow only necessary connections from trusted sources.
3. Step 3: Review and update security settings within the InduSoft Web Studio application itself, disabling unnecessary features or services.

4.3 Config or Code Example

Before

Default username: admin, Default password: password

After

Username: secureadmin, Password: StrongUniquePassword123!

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue and protect connected systems. These focus on reducing the attack surface and limiting potential impact.

• Practice 1: Least privilege – grant only necessary access rights to users and services accessing SCADA systems.
• Practice 2: Network segmentation – isolate SCADA networks from other parts of the network to limit the spread of attacks.

4.5 Automation (Optional)

Automation is not directly applicable for this detection without further information on the environment.

5. Verification / Validation

Confirming the fix involves verifying updated settings and re-testing for vulnerabilities. A smoke test ensures core functionality remains operational.

• Post-fix check: Verify that the default password has been changed by attempting to log in with the old credentials – it should fail.
• Re-test: Re-run the Nessus scan (ID 168597) to confirm the vulnerability is no longer detected.
• Smoke test: Confirm you can still connect to and monitor the SCADA system using valid, updated credentials.
• Monitoring: Review InduSoft Web Studio logs for failed login attempts or unusual activity.

Attempt login with admin/password - should fail

6. Preventive Measures and Monitoring

Preventive measures focus on maintaining a secure configuration and monitoring for potential threats. For example, regular security audits and patch management can help identify and address vulnerabilities.

• Baselines: Update your security baseline to include requirements for strong passwords and network segmentation of SCADA systems.
• Asset and patch process: Implement a regular patch management cycle for all SCADA systems, including InduSoft Web Studio.

7. Risks, Side Effects, and Roll Back

Changing passwords or restricting network access could disrupt existing connections. A roll back plan is essential to restore functionality if needed.

• Risk or side effect 1: Changing the password may require updating configurations in other systems that connect to InduSoft Web Studio.
• Risk or side effect 2: Restricting network access could prevent legitimate users from connecting to the system.
• Roll back: Restore the original configuration settings and passwords from the backup created during preparation.

8. References and Resources

• Vendor advisory or bulletin: http://www.nessus.org/u?f9f62b8c