Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×
Security Power

Forget Stuxnet: Banking Trojans Attacking Power Plants 34

New submitter PLAR writes: Everyone's worried about the next Stuxnet sabotaging the power grid, but a security researcher says there's been a spike in traditional banking Trojan attacks against plant floor networks. The malware poses as legitimate ICS/SCADA software updates from Siemens, GE and Advantech. Kyle Wilhoit, the researcher who discovered the attacks, says the attackers appear to be after credentials and other financial information, so it looks like pure cybercrime, not nation-state activity.
This discussion has been archived. No new comments can be posted.

Forget Stuxnet: Banking Trojans Attacking Power Plants

Comments Filter:
  • by fustakrakich ( 1673220 ) on Friday January 09, 2015 @02:29PM (#48777237) Journal

    How do you distinguish the two?

  • by 140Mandak262Jamuna ( 970587 ) on Friday January 09, 2015 @02:42PM (#48777339) Journal
    Diebold is the ATM maker with near monopoly marketshare. They also make voting machines. There were lots of conspiracy theories from the left that there are backdoors and secret keys that could be used to remotely steal an election. Mostly based on tenuous facts, like the top managers of Diebold donated (caution pun ahead) liberally to conservatives. So they might believe there are secret backdoors to all Diebold machines, including ATMs.

    There are lots of stories of how bad Diebold is in upgrades and that most ATMs are running on WinXP and how they can be made to dispense cash with remote exploits. Though it all requires physical access to the usb ports inside the machine first.

    • by Firethorn ( 177587 ) on Friday January 09, 2015 @02:45PM (#48777363) Homepage Journal

      Though it all requires physical access to the usb ports inside the machine first.

      The ones protected by armor plate? That's a bit like complaining that safes aren't safe because they can be drilled.

      Not only do you need to know how to do the hack, you have to know where to drill and how far.

      If they're showing up with that much invested in it they're getting the money out of the ATM/Safe no matter what.

      • Re: (Score:2, Interesting)

        by Anonymous Coward
        Actually, the money is in a safe behind a combination lock. The computery bits are often behind a single, 4 pin tumbler lock. If you're ballsy to take the time to pick a lock in a high traffic area with 2-3 cameras pointed at you, then you could easily pull this off. If you're in a hurry, I bet you could find a bump key that would work too.
        • by Anonymous Coward

          Or you bring it back to your house and break it open with a sledgehammer. If all else fails, try to find the weak spot on the bottom; just don't call your girlfriend a skank while you're under there looking for it.

      • by 140Mandak262Jamuna ( 970587 ) on Friday January 09, 2015 @03:05PM (#48777509) Journal
        Bribe the low paid worker who services the machine to plug in a usb fob for a few minutes, unplug the device and walk away. There were some ATM machines where if you use a coat hanger to snag the edge of the plastic cover and pull, you could expose a usb port under the screen. Once the malware is uploaded into the machine, then it can be made to remotely dispense cash. Again they recruit low paid mules to actually pick the cash.
        • by hitmark ( 640295 )

          Complete with giving said mules a one time code over the phone before the cash comes out.

          This way they don't get any fancy ideas.

  • by ErichTheRed ( 39327 ) on Friday January 09, 2015 @03:26PM (#48777671)

    SCADA and the like are the worst things to have available on an accessible network. Vendors never update their software, everything's insecure by default, etc.

    I've worked in environments like this, and some of the equipment is just not possible to secure without leaving it on its own network. It makes maintenance a nightmare -- sneakernetting patches, software updates, AV signatures, etc. I know an air gap isn't a guarantee of security, but it at least prevents dumb things like drive by downloads on someone's computer affecting production equipment.

    Working with vendors of some of this stuff is equally bad...most of them deny a problem exists. And even if they acknowledge a problem, they won't lift a finger to fix it because they just have to say it's secure if installed as per our instructions. I've seen lots of software for control systems, etc. with 15 or 20 year old software libraries gluing everything together. (Using the 15 year old version now, I mean.) The vendor knows they're one of a handful of firms providing stuff like this, and they know that companies don't care about information security anyway. (One example of this from outside of the manufacturing industry -- I was integrating a very specific peripheral for a customer, and the vendor absolutely refused to digitally sign the Windows drivers, rendering it nearly impossible to install on 64-bit Windows. A lot of people might say "that's what you get with closed source," but open source libraries and other code have their problems as well.

    • by AHuxley ( 892839 )
      Support and a lack of on site skilled staff? Some companies, countries, mil and govs are just buying up dual use heavy equipment globally for local prototyping and limited mil grade production runs.
      A company sends out staff to help install a system and then offers ongoing help for educational engineering courses. As soon as the expert company staff are gone its back to a secret mil or gov project.
      Networking might allow work on some very exotic materials :)
      The vendors staff know that are not at a n
    • You hit the nail on the head. The vendors don't care because their customers don't care. Security is an added cost, and even to the degree they take it seriously, my experience has been that the moment security runs into anything else - cost, ease of use, etc - it's security that gets cut. When their customers start demanding secure ICS/SCADA (actually reasonably secure, not just slapping AV onto it or something), only then will you see the vendor market respond to it. Unfortunately I don't think the cust
  • by Virtucon ( 127420 ) on Friday January 09, 2015 @03:28PM (#48777687)

    The malware poses as legitimate ICS/SCADA software updates from Siemens, GE and Advantech.

    Okay, but considering we're dealing with control systems, why the hell isn't somebody verifying the updates are valid? The distribution channel and validation apparently is the cause here. I still advocate air gaps between Intranet and Internet connectivity in SCADA environments and the controls on updates of any software should be verified as to authenticity prior to deployment. It should be easy for somebody to contact GE and ask for the MD5 for the update or check it out on their portal first.

  • by Ravaldy ( 2621787 ) on Friday January 09, 2015 @03:29PM (#48777693)

    SCADA was rarely required to run outside the building. Most SCADA systems I've seen are isolated just because there's no need for them to be given access to anything else than the content it will run. For this reason SCADA systems have not been exposed and their team most probably lacks the security experience. MS, Apple and Linux all suffered when they first got hooked up to the internet. Today these company have tones of experience and react fairly quickly to security holes.

    As for power plants, most of them (if not all) are still operated manually using hard buttons. The only connection there is to the plant is connection to the monitoring of sensors.

    • by nurbles ( 801091 )

      As for power plants, most of them (if not all) are still operated manually using hard buttons. The only connection there is to the plant is connection to the monitoring of sensors.

      That is becoming less and less true as hardware and software evolves and possibly as industry's comfort level increases. I'm not sure that is a good thing, but I've worked with some systems that have software that could potentially trigger plant trip if the software determines that a dangerous enough condition exists. That is probably a good thing -- unless someone is dumb enough to connect that software to a network and allow it to automatically update.

      After all, none of us have ever has an operating sys

      • I have a family member that works high up at the biggest electricity provider in Canada and he told me when I had the same argument with him that there is no plan to automate this. It will remain hard buttons for a long time.

  • Inconceivable! (Score:5, Insightful)

    by nurbles ( 801091 ) on Friday January 09, 2015 @03:49PM (#48777833) Homepage

    Any company that has a SCADA system that is allowed to automatically install any sort of update needs new management. I write software for industrial SCADA systems (many of them nuclear, but some not) and absolutely NONE of them have any form of automatic update enabled. That goes for the operating system platform, even anti-virus packages (when they are used) must be manually updated after the update has been tested in a sandbox lab system. Even a well intentioned update may disrupt a SCADA system's operation, so why would anyone in their right mind allow a SCADA system or the operating system it runs on, or any other software running on the same machine automatically update itself? Sorry, but that's just insane.. At best, SCADA systems should have a one-way data flow (preferably on a serial link with the receive line physically CUT) but none of them should accept input from outside their physically controlled environments.

    Except for toys and things like that.

  • Just who in their right mind connects a ICS/SCADA unit directly to the Internet. Go and read up on VPN [webopedia.com] – virtual private network.

In the long run, every program becomes rococco, and then rubble. -- Alan Perlis

Working...