October 26, 2016 By Larry Loeb 2 min read

Pagers don’t get much attention in this era of smartphones and tablets. They are, however, still widely used in industrial control systems (ICS). Pagers are also good backup for everyday communication since they are functional in areas that have poor cellphone signals.

Pagers Keep on Beeping

Pagers came onto the scene during a time when security threats were not as broadly defined as they are today. Back then, security meant simply locking the gate around the facility, not securing radio transmissions.

For this reason, there is simply no such thing as pager security. Messages they receive are rarely encrypted, for example. That means any cybercriminal with a bit of technical knowledge can intercept messages sent to a pager.

That’s just what Trend Micro did. The security firm obtained more than 54 million pages over a four-month span using inexpensive hardware.

No Such Thing as Pager Security

The researchers found messages from nuclear plants, power substations, chemical companies and defense contractors. Semiconductor producers, commercial printing facilities and HVAC companies also leaked what could be sensitive data through pagers, according to the report.

Some messages were indications of malfunctioning critical systems. For example, the researchers intercepted overflow information an HVAC company sent to a hospital on an unencrypted pager.

Passive Intelligence

This type of data collection is known as passive intelligence (PI). PI is information gathering as opposed to active intelligence. PI-rich situations would not require an attacker to make contact with the target’s network to get useful information. Attackers using PI would rather wait and listen to the target, gleaning whatever information they can and then analyzing it before an active penetration test or attack can occur.

Some PI information Trend Micro found included alarm or event notifications, diagnostics information, status updates for a facility, employee names and email addresses, phone numbers and even some IP addresses.

This kind of information is invaluable to a social engineering scammer. SecurityWeek noted that an attacker might use it to move laterally inside a compromised network.

Spoofing Messages

Ars Technica reported that the researchers also found it “trivial to inject counterfeit messages into the paging systems” they had monitored. These fake messages were accepted by systems using both the Post Office Code Standardization Advisory Group protocol and another protocol known as FLEX.

All this goes to show that security leaders of industrial organizations should rethink their assumptions about what actually constitutes security, especially with regard to ICS. Opening up a critical infrastructure system to either PI or spoofing doesn’t seem like the safest approach.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today