The US Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Energy this week issued guidance on mitigating attacks against uninterruptible power supply (UPS) devices.
The two government organizations are aware of threat actors targeting internet-connected UPS devices – often abusing default login credentials – and they recommend immediately removing internet access to the management interface of these devices.
Designed to provide emergency power when normal power sources are lost, UPS devices are attached to networks for power monitoring and routine maintenance, or simply for convenience.
To prevent potential attacks targeting UPSs, organizations are advised to enumerate all such devices within their environments and make sure they are not accessible from the internet.
[ READ: CISA Releases Final IPv6 Security Guidance for Federal Agencies ]
If a UPS device must be accessible from the internet, organizations should employ protections such as multifactor authentication, the use of a virtual private network (VPN), and strong, difficult-to-guess passwords.
Furthermore, organizations should check their UPS devices for default usernames and passwords and change those.
CISA also recommends that organizations adopt login timeout/lockout features, in addition to adhering to strong password requirements for UPS devices and similar systems.
UPS devices are also prone to vulnerabilities that threat actors may try to exploit in attacks. Earlier this month, details were released on vulnerabilities affecting millions of UPSs from Schneider Electric subsidiary APC, which could be exploited remotely to alter device operations and cause physical damage.
Another security hole in the same devices could allow attackers to alter the firmware of the UPS and achieve long-lasting persistence on the network.
Related: CISA Warns Critical Infrastructure Organizations of Foreign Influence Operations
Related: CISA Releases Guidance on Securing Enterprise Mobile Devices
Related: NSA, CISA Issue Guidance on Selecting and Securing VPNs
More from Ionut Arghire
- Software Supply Chain Security Firm Lineaje Raises $7 Million
- Vulnerability Provided Access to Toyota Supplier Management Network
- Linux Variant of Cl0p Ransomware Emerges
- New York Attorney General Fines Vendor for Illegally Promoting Spyware
- 20 Million Users Impacted by Data Breach at Instant Checkmate, TruthFinder
- Florida Hospital Cancels Procedures, Diverts Patients Following Cyberattack
- Former Ubiquiti Employee Who Posed as Hacker Pleads Guilty
- Atlassian Warns of Critical Jira Service Management Vulnerability
Latest News
- Software Supply Chain Security Firm Lineaje Raises $7 Million
- ICS Cybersecurity Firm Opscura Launches With $9.4 Million in Series A Funding
- Vulnerability Provided Access to Toyota Supplier Management Network
- Patch Released for Actively Exploited GoAnywhere MFT Zero-Day
- Linux Variant of Cl0p Ransomware Emerges
- VMware Says No Evidence of Zero-Day Exploitation in ESXiArgs Ransomware Attacks
- Comcast Wants a Slice of the Enterprise Cybersecurity Business
- Critical Baicells Device Vulnerability Can Expose Telecoms Networks to Snooping
