# Chernovite - Pipedream **URL:** \ **Category:** Ignition\ **Created:** [April 14, 2022, 8:30pm UTC](https://forum.inductiveautomation.com/t/chernovite-pipedream/58490 "2022-04-14T20:30:36Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![robwarren](https://avatars.discourse-cdn.com/v4/letter/r/7cd45c/32.png) [@robwarren](https://forum.inductiveautomation.com/u/robwarren)\ **Post date:** [April 14, 2022, 8:30pm UTC](https://forum.inductiveautomation.com/t/chernovite-pipedream/58490/1 "2022-04-14T20:30:36Z")
I saw an article today talking about exploits specifically targeting Omron and Schneider Electric, but more generally targeting Codesys and OPC-UA. Inductive, when you get a little more grasp on this situation, could you respond to potential vulnerability and mitigation strategies for the OPC-UA portion of this ICS hacking software? It looks like a brute force OPC-UA attack, so perhaps if our OPC-UA connections are all using certificates and not usernames/passwords we will be less susceptible to the attacks. Thanks for any feedback, and I’m also curious of other users’ thoughts regarding this new ICS hacking suite. All the best, -Rob W. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [April 14, 2022, 8:33pm UTC](https://forum.inductiveautomation.com/t/chernovite-pipedream/58490/2 "2022-04-14T20:33:51Z")
Ignition 8 is safe in its default configuration, which doesn’t allow unsecured connections, so there’s no possibility for an attacker to even attempt to establish a session unless you go in and trust the certificate. Beyond that, you can and certainly should change the default credentials used by the server’s default user profile. If you’re still using 7.9 or prior then changing the credentials should be very high priority if your server may be accessible to an adversary, as it doesn’t have the same default security configuration nor does it have the OPC UA certificate validation and management facilities Ignition 8 does. ---
**Author:** ![peter](https://avatars.discourse-cdn.com/v4/letter/p/278dde/32.png) [@peter](https://forum.inductiveautomation.com/u/peter)\ **Post date:** [April 14, 2022, 8:42pm UTC](https://forum.inductiveautomation.com/t/chernovite-pipedream/58490/3 "2022-04-14T20:42:10Z")
Perhaps you should once again be plugging the hardening guide. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [April 14, 2022, 8:43pm UTC](https://forum.inductiveautomation.com/t/chernovite-pipedream/58490/4 "2022-04-14T20:43:11Z")
Check out the security hardening guide! 🙂 > **[Ignition Security Hardening Guide](https://www.inductiveautomation.com/resources/article/ignition-security-hardening-guide)** > > Included in this document are guidelines specifically for the Ignition software, as well as general suggestions regarding the hardware and network where Ignition is installed. The steps provided are recommendations rather than requirements and should... it does mention, among a bunch of other stuff, OPC UA security/certificates and recommends setting and rotating passwords. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [April 14, 2022, 8:53pm UTC](https://forum.inductiveautomation.com/t/chernovite-pipedream/58490/5 "2022-04-14T20:53:21Z")
For anyone missing the context: [APT Cyber Tools Targeting ICS/SCADA Devices | CISA](https://www.cisa.gov/uscert/ncas/alerts/aa22-103a) ---
**Author:** ![peter](https://avatars.discourse-cdn.com/v4/letter/p/278dde/32.png) [@peter](https://forum.inductiveautomation.com/u/peter)\ **Post date:** [April 14, 2022, 9:05pm UTC](https://forum.inductiveautomation.com/t/chernovite-pipedream/58490/6 "2022-04-14T21:05:52Z")
Also for a more general overview [US uncovers “Swiss Army knife” for hacking industrial control systems](https://arstechnica.com/information-technology/2022/04/us-uncovers-swiss-army-knife-for-hacking-industrial-control-systems/) ---
**Author:** ![robwarren](https://avatars.discourse-cdn.com/v4/letter/r/7cd45c/32.png) [@robwarren](https://forum.inductiveautomation.com/u/robwarren)\ **Post date:** [April 14, 2022, 9:49pm UTC](https://forum.inductiveautomation.com/t/chernovite-pipedream/58490/7 "2022-04-14T21:49:09Z")
I should have included a link to the story in my original post. Thanks for adding that. I guess what I was getting at were your thoughts about specific things to check in the system or potential security blunders which would put one at risk from this specific “swiss army knife”. It sounds like you don’t have any other recommendations aside from “make sure you don’t have user name and password OPC security validation enabled”. Is that correct? What if one upgraded their system from 7.9 to v8.x? Would any of those 7.9 security configuration defaults or OPC UA certificate validation facilities be carried forward? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [April 14, 2022, 9:58pm UTC](https://forum.inductiveautomation.com/t/chernovite-pipedream/58490/8 "2022-04-14T21:58:30Z")
> [@robwarren](#): > > It sounds like you don’t have any other recommendations aside from “make sure you don’t have user name and password OPC security validation enabled”. Is that correct? No, it's make "make sure you change the default credentials". > [@robwarren](#): > > What if one upgraded their system from 7.9 to v8.x? Would any of those 7.9 security configuration defaults or OPC UA certificate validation facilities be carried forward? Everyone should upgrade to 8.x regardless. 7.9 is currently in a courtesy extension to its original EOL of Dec 2021 that will last through June 2022. If you upgrade from 7.9 to 8.x you'll get all the certificate management stuff I'm talking about. The only change you might want to make (aside from credentials if you haven't) is to disable access via the "None" SecurityPolicy, which I think will be allowed if you're doing an upgrade from 7.9 vs a fresh install of 8.x. ---
**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\ **Post date:** [April 26, 2022, 4:35am UTC](https://forum.inductiveautomation.com/t/chernovite-pipedream/58490/9 "2022-04-26T04:35:35Z")
Hey @Kevin.Herron, is there an official response to this somewhere / will there be? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [April 26, 2022, 12:17pm UTC](https://forum.inductiveautomation.com/t/chernovite-pipedream/58490/10 "2022-04-26T12:17:06Z")
> **[Regarding CISA AA22-103A](https://support.inductiveautomation.com/hc/en-us/articles/5775477023757-Regarding-CISA-AA22-103A)** > > On April 13, 2022, Cybersecurity and Infrastructure Security Agency (CISA) published  National Cyber Awareness System (NCAS) Alert AA22-103A. >   > As mentioned in the OPC UA Foundation’s response to A... ---
**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\ **Post date:** [April 26, 2022, 12:22pm UTC](https://forum.inductiveautomation.com/t/chernovite-pipedream/58490/11 "2022-04-26T12:22:55Z")
Thanks Kevin 👍