Perimeter
7/19/2012
12:31 PM
Tom Parker
Tom Parker
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Attacking SCADA And Relative Cost Of Entry

SCADA technologies have been increasingly targeted by shadowy adversaries: Does that mean impending doom?

Over the past couple of months, I’ve been asked a number of times about the use of malicious software worms to subvert (a la Stuxnet) SCADA systems, as well as the relative cost of entry into this space for a cyberadversary compared to the cost of doing business for your average spear-phisher today.

Earlier last month, a friend and industry colleague reported on a spear-phish that targeted an employee of well-known industrial control security firm Digital Bond. Like many targeted email spears, the message was generally well-written and demonstrated some domain-level experience in the arena of industrial control security. Attached to the email was a zip file containing an executable designed to masquerade as a PDF, which, when executed, downloaded a secondary payload, which, in turn, installed a RAT (remote access tool) onto the victims PC.

The modus operandi associated with the attack and technological elements (including the RAT) all point to groups of actors who have been previously suspected to be sponsored by the People’s Republic of China. This certainly isn’t the first time that similar groups have targeted individuals and organizations associated with the use of SCADA (or, more broadly, ICS or industrial control system) technologies. Among others, McAfee’s ShadyRat and NightDragon publications both alluded to the targeting of industry that relies heavily on the use of ICS technology -- and the apparent theft of documents and other intellectual property associated with the use of ICS technologies within those entities.

Although past attacks clearly demonstrate an active interest in the possible future targeting of ICS technologies by Chinese actor groups, it’s important to put this activity into the context of the overall philosophy toward intelligence held by the Chinese. Much like other targeted attacks we have seen in the past few years, the objective has more or less remained the same: data harvesting. The commonly recognized philosophy toward intelligence gathering by our friends in the Pacific is orientated around a long-term plan. In other words, the data captured today may have no immediate use or even significance to present-day activities; however, the more data, the better -- and that data may have some future use. In contrast, DuQu, which similarly sought intelligence from entities within Iran, was clearly intended to support a much nearer-term operation, which was in all likelihood directly associated with both Flame and, therefore, Stuxnet.

The bottom line here is that we should not assume that the targeting of entities using ICS technology (such as the electric and gas/oil industry) means that the individuals behind such attacks currently possess the capability or immediate desire to attack ICS-related technologies. Despite the publication of numerous security defects in ICS-related products (such as programmable logic controllers) over the past few years, the relative cost of entry into this space remains exponentially higher than engaging in many of the spear-phishing attacks that this group of actors have become so commonly associated with. ICS technologies are presently known for their lack of security features and poor implementations; from that perspective, they may be perceived as a "low-cost" attack. The sheer diversity of technology and configuration thereof within the ICS space makes it exceedingly challenging to develop an offensive technology that can be deployed with the broad brushstrokes that we’re currently seeing in the spear-phishing space. Stuxnet was a good example of this -- given its sophisticated, but highly targeted nature, which, as is, would have been ineffective against any target than that which it was originally intended for.

For those of you with an interest in this area, over the next five days Jonathan Pollet and I will be teaching our annual SCADA security class at Black Hat in Las Vegas. This year, we’ll be demonstrating the application of various vulnerability research techniques on programmable logic controllers and the subsequent exploitation of unpublished vulnerabilities that could be leveraged in a targeted scenario. Look forward to seeing you all out there!

Tom Parker is the CTO of FusionX

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4262
Published: 2014-07-28
svnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option and running in foreground mode, allows local users to gain privileges via a symlink attack on the pid file. NOTE: this issue was SPLIT due to different affected versions (ADT3). The irkerbridge.py issue is covered by CVE-...

CVE-2013-4840
Published: 2014-07-28
Unspecified vulnerability in HP and H3C VPN Firewall Module products SECPATH1000FE before 5.20.R3177 and SECBLADEFW before 5.20.R3177 allows remote attackers to cause a denial of service via unknown vectors.

CVE-2013-7393
Published: 2014-07-28
The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2) irkerbridge.py when the --pidfile option is used. NOTE: this issue was SPLIT from CVE-2013-4262 based on different affected versions...

CVE-2014-2974
Published: 2014-07-28
Cross-site request forgery (CSRF) vulnerability in php/user_account.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.

CVE-2014-2975
Published: 2014-07-28
Cross-site scripting (XSS) vulnerability in php/user_account.php in Silver Peak VX before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.