Mysterious Safety-Tampering Malware Infects Second Critical Infrastructure Site (arstechnica.com) 50
An anonymous reader quotes a report from Ars Technica: Sixteen months ago, researchers reported an unsettling escalation in hacks targeting power plants, gas refineries, and other types of critical infrastructure. Attackers who may have been working on behalf of a nation caused an operational outage at a critical-infrastructure site after deliberately targeting a system that prevented health- and life-threatening accidents. What was unprecedented in this attack -- and of considerable concern to some researchers and critical infrastructure operators -- was the use of an advanced piece of malware that targeted the unidentified site's safety processes. The malware was named Triton and Trisis, because it targeted the Triconex product line made by Schneider Electric. Its development was ultimately linked to a Russian government-backed research institute.
Now, researchers at FireEye -- the same security firm that discovered Triton and its ties to Russia -- say they have uncovered an additional intrusion that used the same malicious software framework against a different critical infrastructure site. As was the case in the first intrusion, the attackers focused most of their resources on the facility's OT, or operational technology, which are systems for monitoring and managing physical processes and devices. The discovery has unearthed a new set of never-before-seen custom tools that shows the attackers have been operational since as early as 2014. The existence of these tools, and the attackers' demonstrated interest in operational security, lead FireEye researchers to believe there may be other sites beyond the two already known where the Triton attackers were or still are present. "After establishing an initial foothold on the corporate network, the Triton actor focused most of their effort on gaining access to the OT network," FireEye researchers wrote in a report published Wednesday. "They did not exhibit activities commonly associated with espionage, such as using key loggers and screenshot grabbers, browsing files, and/or exfiltrating large amounts of information. Most of the attack tools they used were focused on network reconnaissance, lateral movement, and maintaining presence in the target environment."
Now, researchers at FireEye -- the same security firm that discovered Triton and its ties to Russia -- say they have uncovered an additional intrusion that used the same malicious software framework against a different critical infrastructure site. As was the case in the first intrusion, the attackers focused most of their resources on the facility's OT, or operational technology, which are systems for monitoring and managing physical processes and devices. The discovery has unearthed a new set of never-before-seen custom tools that shows the attackers have been operational since as early as 2014. The existence of these tools, and the attackers' demonstrated interest in operational security, lead FireEye researchers to believe there may be other sites beyond the two already known where the Triton attackers were or still are present. "After establishing an initial foothold on the corporate network, the Triton actor focused most of their effort on gaining access to the OT network," FireEye researchers wrote in a report published Wednesday. "They did not exhibit activities commonly associated with espionage, such as using key loggers and screenshot grabbers, browsing files, and/or exfiltrating large amounts of information. Most of the attack tools they used were focused on network reconnaissance, lateral movement, and maintaining presence in the target environment."
Why are these sites connected to the Internet? (Score:5, Insightful)
Re:Why are these sites connected to the Internet? (Score:4, Insightful)
I know it is inconvenient, but these sites should not be connected to the Internet
CEO: What are you talking about?? They're not -- we moved them all to the cloud!
Re:Why are these sites connected to the Internet? (Score:5, Insightful)
Except airgaps have vulnerabilities, or has Stuxnet not taught you anything?
Even isolated networks need updating - and that's where a breach of containment can take place. If your goal is to destroy protections or equipment versus exfiltrate information, that's all you need - just hop from the laptop that was internet connected to the USB drive being used to update the production network and there you go.
And because airgapped networks are a PITA to update, the software running on them is almost hilariously out of date, so finding a vulnerability so you can hop onto the network on USB insertion is laughably easy.
Unless you're a super large organization with dedicated staff who do nothing but maintain the airgapped network (like say, the military) airgapping is not a panacea.
And finally, like all factories, executives will also want some sort of feedback - production numbers and stuff. So there will need to be some sort of facility where production updates can happen in near real-time. Or perhaps some technician overseeing several facilities would like to know if some piece of equipment is failing more often than normal, or if something is approaching its end of life and needs replacement, or even better, if some common failure mode is starting to present itself. All of which are complicated if said tech has to visit every facility in question.
Re: (Score:2)
I had a governmental customer who after refusing to buy our lower cost dedicated and isolated VSAT network for their SCADA, paid for our more expensive Internet over VSAT package for "staff happiness". I am sure their staff was extremely ha
Re: (Score:2)
Re:Why are these sites connected to the Internet? (Score:5, Interesting)
I know it is inconvenient, but these sites should not be connected to the Internet.
No it's not inconvenient. It's not actually possible to operate them efficiently anymore. Heck it may not be possible to legally operate them without external connection to push off data in realtime.
Another poster has already told you an airgap is not a panacea. I would argue worse than that, an airgap is effectively bad for security as it leads to incredible overconfidence. Give me a well designed network monitored by a security team over "airgap is our security why try harder" any day, which is ultimately what any airgapped network will reduce to.
Re: (Score:2)
I'm not convinced with the whole anti-airgap argument. In the past news they were compromised because someone brought a USB from the parking lot to that network.
What airgapped networks need is a strict as hell policy that only allows fresh from a package USB drives to move data between networks. Or write only DVDs. Or something equally simple, but strict as hell, like that. If you can't enforce those rules easily, then you have 2 people who are the only ones with access/passwords, and they follow those rule
Re: (Score:2)
Do you really think that a company that cannot maintain the simpler level of security necessary for a system with an airgap is going to be up to the immensely more complicated security needed for a system connected to the Internet?
Re: (Score:2)
I know it is inconvenient, but these sites should not be connected to the Internet.
Hell, they shouldn't even be running off-the-shelf software in the first place.
I remember the first time I saw an airplane's video system rebooting. Seeing all of the text messages and various clunky graphical transitions was ... painful. I mean, yes, it is a challenge to get that kind of thing right, but when you're flying on a $50M airplane which is part of a fleet of hundreds of the same, I honestly don't think it's a big deal to pay someone an extra $25k to put in a few nights or weekends to sanitize
Re: (Score:3)
Not everything has to be reported with breathless end-of-the-world doom and gloom just to be the best click-bait.
Once in a while it's nice to give the hyperbole and bullshit a rest. However, this is a serious issue that needs to be addressed quickly. Isolation from the internet is probably the best solution, but even that is not idiot-proof (think USB drives in parking lot) and it's massively inconvenient, but until we can develop remote access systems that are truly bulletproof, then we shouldn't be risk
Time to have two operational technology systems (Score:4, Interesting)
One, that is modern and feature-rich, and a second one that is very simple, maybe even analog, well-understood, reliable systems which will provide protection when the main system isn't working.
I'll use brakes in trains as a comparison:
You can have a modern system where automated train controls can cause the train to speed up or slow down, but you still have 19th century air brakes connected to some very simple but very reliable sensors. These sensors would detect "critical" things like the train moving too fast around a curve or moving too fast downhill, among other things. If the air-brake line is damaged and loses pressure, the train stops. If any of the simple sensors detect a problem, the trains stops. To get the train going again, a human being has to go to the train and fix the problem with the air brake system or manually reset the sensors.
Apply this design philosophy to any system where you absolutely positively do not want certain bad things to happen without corrective action being taken and/or an alarm sounding, and you'll have at least some minimum level of safety even when your modern technology fails or is compromised.
Re:Time to have two operational technology systems (Score:5, Informative)
Re: (Score:2)
This layered approach exists. The bottom level is inherently safer design. The next level up is pressure relief. Only after those two do you get to instrumented safety systems.
The problem you have focusing on offline mechanical safety features is that unlike your train example in the process industry they are incredibly unreliable and have no diagnostics meaning you can't identify problems with them until they actually fail.
As a basic example take a check valve (mechanical valve with a spring loaded return
Reichstag fire (Score:2)
False flag or not, your gas prices are going up.
I know this is a stupid question but (Score:3)
It's 2019, why the F*CK are ANY systems designated as critical infrastructure still connected to the GD internet.
Lease a private line FFS and air-gap the head end systems.
Yes, it's expensive.
Yes, it's not very convenient.
Yes, it's NECESSARY.
GDMIT.
Until we start throwing CEO's in prison for significant amounts of time when their incompetence results in epic level WTF, this sh*t will never get fixed.
Another Windows Omission (Score:1)
It seems that every malware article goes out of the way to avoid using the word WINDOWS. In practically every reported instance of remote infection, the initial vector is WINDOWS.
Regarding Triton:
Security firm Symantec said that Triton has been active since August and works by infecting a Windows computer attached to the safety system. It said: “While there have been a small number previous cases of malware designed to attack industrial control systems (ICS), Triton is the first to attack safety instrumented system devices.”
https://www.theguardian.com/technology/2017/dec/15/triton-hackers-malware-attack-safety-systems-energy-plant
Here we go (Score:5, Insightful)
Re: Here we go (Score:1)
Re: (Score:1)
Sure, it is much more likely, that Tsar-KGB is finally taking a nap.
Re: (Score:1)