Nozomi Networks Labs

Defending Critical Infrastructure Against Cyber Risk

ABOUT LABS

Nozomi Networks Labs is dedicated to reducing cyber risk for the world’s industrial and critical infrastructure organizations.

Through our cyber security research, and collaboration with industry and institutions, we’re helping defend the industrial systems that support everyday life.

Collaborating to Reduce ICS Cyber Risk

Nozomi Networks Labs is working with a broad range of experts, industry leaders and institutions to improve industrial cyber security.

If you’d like to work together, we’d love to hear from you!

[NEW] URGENT/11 Threat Signatures and Vulnerability Detection Tool BLOG GITHUB

[NEW] SIEMENS SCALANCE X Switches – Advisory (ICSA-19-225-03)  NCCIC ICS-CERT BLOG

Threat Advisories

Labs Blogs

URGENT/11 – New ICS Threat Signatures by Nozomi Networks Labs

A well-known RTOS (Real-Time Operating System), widely used in industrial sectors, is at risk from a series of 11 vulnerabilities dubbed URGENT/11.

Nozomi Networks Labs conducted research on the vulnerable devices and has released threat signatures for URGENT/11 that identify threats in typical industrial networks without generating high numbers of false positive alerts.

read more

Tools

URGENT/11 Nmap NSE Script for Detecting Vulnerabilities

  • Our Nmap NSE script for detecting URGENT/11 vulnerabilities is a research tool for quickly checking industrial systems for vulnerable assets based on the version of VxWorks exposed within the FTP service.
  • Due the fact that is not always possible to detect the running version, we recommend that industrial operators use full featured security products for effective vulnerability assessment.

Radamsa Enhancement, Introducing PCAPNG Awareness

  • Our contribution allows Radamsa to mutate PCAPNG files focusing only on the packets themselves, eliminating the bytes and data structures used by the PCAPNG format itself. It is useful for testing the robustness of protocol stacks, helping to improve the quality of OT-device software.

Reports

TRITON: The First ICS Cyber Attack on Safety Instrument Systems, Understanding the Malware, Its Communications and Its OT Payload

How to turn an undocumented ICS device into malicious code, starting from creating a working system and followed by reverse engineering and malware analysis. While the TRITON malware attack failed to deliver a malevolent OT payload to the Triconex controller, our researchers succeeded. Two new tools were released to help the ICS community secure Triconex SIS.

 Research Projects

OT ThreatFeed

Click to enlarge.

Curated and maintained by Nozomi Networks Labs, the OT ThreatFeed™ provides threat and vulnerability updates to Guardian, making it easy for IT/OT professionals to stay on top of current ICS risks.

“Threat actors love finding new ways to attack critical infrastructure. We love finding new ways to detect their malware before damage occurs.”

ANDREA CARCANO & MORENO CARULLO

Co-founders, Nozomi Networks

© 2019 Nozomi Networks, Inc.
All Rights Reserved.