Perimeter
7/19/2012
12:31 PM
Tom Parker
Tom Parker
Commentary
50%
50%

Attacking SCADA And Relative Cost Of Entry

SCADA technologies have been increasingly targeted by shadowy adversaries: Does that mean impending doom?

Over the past couple of months, I’ve been asked a number of times about the use of malicious software worms to subvert (a la Stuxnet) SCADA systems, as well as the relative cost of entry into this space for a cyberadversary compared to the cost of doing business for your average spear-phisher today.

Earlier last month, a friend and industry colleague reported on a spear-phish that targeted an employee of well-known industrial control security firm Digital Bond. Like many targeted email spears, the message was generally well-written and demonstrated some domain-level experience in the arena of industrial control security. Attached to the email was a zip file containing an executable designed to masquerade as a PDF, which, when executed, downloaded a secondary payload, which, in turn, installed a RAT (remote access tool) onto the victims PC.

The modus operandi associated with the attack and technological elements (including the RAT) all point to groups of actors who have been previously suspected to be sponsored by the People’s Republic of China. This certainly isn’t the first time that similar groups have targeted individuals and organizations associated with the use of SCADA (or, more broadly, ICS or industrial control system) technologies. Among others, McAfee’s ShadyRat and NightDragon publications both alluded to the targeting of industry that relies heavily on the use of ICS technology -- and the apparent theft of documents and other intellectual property associated with the use of ICS technologies within those entities.

Although past attacks clearly demonstrate an active interest in the possible future targeting of ICS technologies by Chinese actor groups, it’s important to put this activity into the context of the overall philosophy toward intelligence held by the Chinese. Much like other targeted attacks we have seen in the past few years, the objective has more or less remained the same: data harvesting. The commonly recognized philosophy toward intelligence gathering by our friends in the Pacific is orientated around a long-term plan. In other words, the data captured today may have no immediate use or even significance to present-day activities; however, the more data, the better -- and that data may have some future use. In contrast, DuQu, which similarly sought intelligence from entities within Iran, was clearly intended to support a much nearer-term operation, which was in all likelihood directly associated with both Flame and, therefore, Stuxnet.

The bottom line here is that we should not assume that the targeting of entities using ICS technology (such as the electric and gas/oil industry) means that the individuals behind such attacks currently possess the capability or immediate desire to attack ICS-related technologies. Despite the publication of numerous security defects in ICS-related products (such as programmable logic controllers) over the past few years, the relative cost of entry into this space remains exponentially higher than engaging in many of the spear-phishing attacks that this group of actors have become so commonly associated with. ICS technologies are presently known for their lack of security features and poor implementations; from that perspective, they may be perceived as a "low-cost" attack. The sheer diversity of technology and configuration thereof within the ICS space makes it exceedingly challenging to develop an offensive technology that can be deployed with the broad brushstrokes that we’re currently seeing in the spear-phishing space. Stuxnet was a good example of this -- given its sophisticated, but highly targeted nature, which, as is, would have been ineffective against any target than that which it was originally intended for.

For those of you with an interest in this area, over the next five days Jonathan Pollet and I will be teaching our annual SCADA security class at Black Hat in Las Vegas. This year, we’ll be demonstrating the application of various vulnerability research techniques on programmable logic controllers and the subsequent exploitation of unpublished vulnerabilities that could be leveraged in a targeted scenario. Look forward to seeing you all out there!

Tom Parker is the CTO of FusionX

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Security Technologies to Watch in 2017
Emerging tools and services promise to make a difference this year. Are they on your company's list?
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.