How to remediate – Advantech WebAccess/SCADA Network Service Detection

1. Introduction

Advantech WebAccess/SCADA Network Service Detection identifies instances of Advantech WebAccess running on a remote host. This SCADA application is used for runtime data acquisition and communications, making it a critical component in industrial control systems. A successful exploit could lead to loss of confidentiality, integrity, or availability of the system.

2. Technical Explanation

The vulnerability lies in the presence of Advantech WebAccess/SCADA Network Service running on the host. This service is a common target for attackers seeking to compromise industrial control systems. Exploitation typically involves gaining access to the SCADA node and leveraging vulnerabilities within the WebAccess application itself. While this detection doesn’t represent an active exploit, it indicates a potential entry point for malicious activity.

• Root cause: The presence of the Advantech WebAccess/SCADA Network Service on the host.
• Exploit mechanism: An attacker could attempt to exploit known vulnerabilities within the WebAccess application to gain control of the SCADA node.
• Scope: Systems running Advantech WebAccess/SCADA Network Service are affected.

3. Detection and Assessment

Confirming the presence of the service is the primary assessment step. A quick check can be performed via process listing, while a more thorough method involves checking for specific network services.

• Quick checks: Use the following command to list running processes and identify WebAccess/SCADA Network Service: ps -ef | grep webaccess
• Scanning: Nessus vulnerability ID 8f12227b can be used to detect this service. This is an example only, other scanners may also provide detection capabilities.
• Logs and evidence: System logs should be reviewed for any entries related to the Advantech WebAccess/SCADA Network Service. Specific log files will vary depending on the operating system and configuration.

ps -ef | grep webaccess

4. Solution / Remediation Steps

The primary solution is to secure or remove the Advantech WebAccess/SCADA Network Service, based on business needs.

4.1 Preparation

• Services: Stop the Advantech WebAccess/SCADA Network Service if possible.
• Roll back plan: Restore from backup if issues occur during remediation.

4.2 Implementation

1. Step 1: Evaluate whether the service is required for business operations. If not, uninstall it.
2. Step 2: If the service is required, ensure it’s patched to the latest version and properly configured with strong security settings.
3. Step 3: Implement network segmentation to isolate the SCADA node from other networks.

4.3 Config or Code Example

This vulnerability does not involve a specific configuration change, but rather the presence of a service that requires securing.

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help mitigate risks associated with SCADA systems.

• Least privilege: Ensure only authorized users have access to the SCADA node and WebAccess application.
• Network segmentation: Isolate the SCADA network from other networks to limit the impact of a potential breach.

4.5 Automation (Optional)

Automation is not directly applicable for this vulnerability, as it focuses on identifying and securing an existing service.

5. Verification / Validation

• Post-fix check: Run ps -ef | grep webaccess again. The command should return no results if the service was uninstalled.
• Re-test: Re-run the Nessus scan (ID 8f12227b) to confirm that the vulnerability is no longer detected.

ps -ef | grep webaccess

6. Preventive Measures and Monitoring

Regular security assessments and patch management are crucial for preventing similar vulnerabilities.

• Baselines: Implement a security baseline that includes regular vulnerability scanning of all SCADA systems.
• Asset and patch process: Establish a regular patch management cycle for all SCADA components, including WebAccess.

7. Risks, Side Effects, and Roll Back

Removing or securing the Advantech WebAccess/SCADA Network Service may impact dependent systems or applications.

• Roll back: Restore from backup if issues occur during remediation.

8. References and Resources

Links to relevant resources for this vulnerability.

• Vendor advisory or bulletin: http://www.nessus.org/u?8f12227b