How to remediate – 7-Technologies TERMIS Detection

1. Introduction

7-Technologies TERMIS Detection indicates that a SCADA application, TERMIS, is installed on a remote Windows host. TERMIS is a hydraulic modeling tool used for energy networks and its presence introduces potential risks associated with SCADA systems. A successful exploit could compromise the confidentiality, integrity, and availability of the energy network it models.

2. Technical Explanation

TERMIS is installed on Windows hosts to model hydraulic networks. The vulnerability lies in the presence of this application itself, as it represents a potential attack surface. An attacker gaining access to a system with TERMIS installed could leverage its functionality for malicious purposes. There are no known CVEs associated directly with TERMIS detection; however, SCADA applications generally present high-risk targets. A realistic example is an attacker using TERMIS to manipulate network models, causing disruptions or providing false data.

• Root cause: The presence of the TERMIS application introduces a potential attack surface on the Windows host.
• Exploit mechanism: An attacker could exploit vulnerabilities within the TERMIS software itself, or use it as a pivot point to compromise other systems on the network.
• Scope: Affected platforms are Windows hosts running the TERMIS application.

3. Detection and Assessment

Confirming whether a system is vulnerable involves identifying if TERMIS is installed. A quick check can be performed by examining installed programs, while a thorough method includes searching for specific files or registry entries associated with TERMIS.

• Quick checks: Check the “Programs and Features” control panel to see if TERMIS is listed.
• Scanning: Standard vulnerability scanners may not specifically detect TERMIS; however, they can identify SCADA applications in general.
• Logs and evidence: Look for TERMIS-related processes or files in system logs and file system directories.

wmic product get name | findstr "TERMIS"

4. Solution / Remediation Steps

The primary solution is to assess the necessity of TERMIS and, if possible, remove it from the system. If TERMIS is required, ensure it’s properly secured and isolated.

4.1 Preparation

• Services: Stop any related services if possible.
• Roll back plan: Re-install TERMIS from known good media if removal causes issues.

4.2 Implementation

1. Step 1: Uninstall TERMIS through the “Programs and Features” control panel.
2. Step 3: Verify that no TERMIS-related files or processes remain on the system.

4.3 Config or Code Example

Before

TERMIS application is present in Programs and Features

After

TERMIS application is not listed in Programs and Features. No TERMIS files or processes are found on the system.

4.4 Security Practices Relevant to This Vulnerability

Practices that directly address this vulnerability type include least privilege, network segmentation, and a robust patch management process.

• Practice 1: Least privilege – limit user access to only the necessary resources to reduce impact if TERMIS is compromised.
• Practice 2: Network segmentation – isolate SCADA systems from other networks to prevent lateral movement in case of an attack.

4.5 Automation (Optional)

Automation scripts are not recommended for this specific vulnerability due to the complexity and potential impact of removing critical SCADA applications.

5. Verification / Validation

Confirming the fix involves verifying that TERMIS is no longer installed on the system. Re-run the earlier detection method, and perform a basic service smoke test to ensure core functionality remains operational if TERMIS was essential.

• Post-fix check: Run `wmic product get name | findstr “TERMIS”` – expected output should be empty.
• Re-test: Check the “Programs and Features” control panel again to confirm TERMIS is not listed.
• Smoke test: Verify that any dependent services or applications still function as expected.

wmic product get name | findstr "TERMIS"

6. Preventive Measures and Monitoring

Preventive measures include maintaining a security baseline, implementing application whitelisting, and regularly reviewing installed software for unauthorized applications.

• Baselines: Update your security baseline to disallow the installation of unapproved SCADA applications like TERMIS.
• Pipelines: Implement application control solutions to prevent the installation of unauthorized software.
• Asset and patch process: Regularly review installed software inventories for unexpected or unauthorized applications.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Disruption of energy network modeling if TERMIS is essential. Mitigation: Thoroughly assess dependencies and plan for potential downtime.
• Roll back: Restore the system from the pre-uninstall snapshot or backup.

8. References and Resources

Links only to sources that match this exact vulnerability. Use official advisories and trusted documentation. Do not include generic links.

• Vendor advisory or bulletin: https://www.schneider-electric.com/en/all-products