Causal says its system, Cipher, found and confirmed all four flaws on its own, and CISA rated one of them Critical.
Causal Security, a cybersecurity company, said its AI system found four serious security flaws in EPICS, open-source software that runs control systems at particle accelerators, telescopes and fusion experiments, in 3 hours and 49 minutes.
Causal said the system, called Cipher, worked autonomously, starting from code it had never seen. The only human step was an instruction approving tests in a sealed-off environment to see how much damage the flaws could do.
The Cybersecurity and Infrastructure Security Agency (CISA) published an advisory on the flaws on Oct. 27, the same day the EPICS maintainers released a fixed version. CISA rated one flaw Critical, 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS), the scale security teams use to rank how dangerous a flaw is. It rated the other three High. CISA said it has not received reports of attacks exploiting the flaws.
CISA’s advisory confirms all four flaws and credits Causal Security with reporting them.
An attacker on the network could crash the computers that run major scientific facilities
Operators use EPICS to monitor and control the equipment at their facilities. It is used at particle accelerators, major telescopes, and fusion experiments, including ITER, the international fusion energy project.
At each facility, operators rely on computers running EPICS to stay connected to the equipment. Exploiting the flaws would be relatively easy. A hacker could send one of these computers a single malformed message (one that carries false information about its size or contents), and the computer would crash.
After finding the flaws, Cipher created its own copy of EPICS in its sealed-off test environment. To test the flaws, it sent one malformed message per flaw to its copy of EPICS, and each message crashed the system. The messages reached the copy over an ordinary network connection, with no password or login. Cipher also sent normal messages to show that the flaw, not ordinary behavior, caused the crash.
Causal said a crash could leave operators or automated systems without readings or control. What happens then depends on the facility’s own backup and safety systems.
The Critical flaw is more serious. An attacker could use it to plant their own data in the computer’s memory, which Causal said could let them take over the computer and whatever equipment it controls. Cipher did not attempt a takeover.
AI has been finding serious flaws in widely used software
In October, researchers using AI found flaws in PHP, the programming language behind about 70% of websites, and governments in Europe and Australia took sites offline before a fix arrived. In June, the UK government said it found 407 security flaws using the most powerful AI models.
Facilities need to install the EPICS fix, including in products bought from vendors
EPICS versions 7.0.10 and earlier are affected, and version 7.0.11 includes the fix. Causal reported the flaws to the EPICS maintainers on June 9, and the maintainers finished their fixes in July and August before releasing them on Oct. 27.
Some facilities get EPICS inside equipment or software from vendors. Causal advised them to ask those vendors for fixed versions.
Causal warned that the fix may stop some older software from working with EPICS. It recommended that facilities test that software before installing the fix on systems in daily use.
CISA advised keeping control systems off the internet, behind firewalls, and separated from business networks.
