Perimeter
7/19/2012
12:31 PM
Tom Parker
Tom Parker
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Attacking SCADA And Relative Cost Of Entry

SCADA technologies have been increasingly targeted by shadowy adversaries: Does that mean impending doom?

Over the past couple of months, I’ve been asked a number of times about the use of malicious software worms to subvert (a la Stuxnet) SCADA systems, as well as the relative cost of entry into this space for a cyberadversary compared to the cost of doing business for your average spear-phisher today.

Earlier last month, a friend and industry colleague reported on a spear-phish that targeted an employee of well-known industrial control security firm Digital Bond. Like many targeted email spears, the message was generally well-written and demonstrated some domain-level experience in the arena of industrial control security. Attached to the email was a zip file containing an executable designed to masquerade as a PDF, which, when executed, downloaded a secondary payload, which, in turn, installed a RAT (remote access tool) onto the victims PC.

The modus operandi associated with the attack and technological elements (including the RAT) all point to groups of actors who have been previously suspected to be sponsored by the People’s Republic of China. This certainly isn’t the first time that similar groups have targeted individuals and organizations associated with the use of SCADA (or, more broadly, ICS or industrial control system) technologies. Among others, McAfee’s ShadyRat and NightDragon publications both alluded to the targeting of industry that relies heavily on the use of ICS technology -- and the apparent theft of documents and other intellectual property associated with the use of ICS technologies within those entities.

Although past attacks clearly demonstrate an active interest in the possible future targeting of ICS technologies by Chinese actor groups, it’s important to put this activity into the context of the overall philosophy toward intelligence held by the Chinese. Much like other targeted attacks we have seen in the past few years, the objective has more or less remained the same: data harvesting. The commonly recognized philosophy toward intelligence gathering by our friends in the Pacific is orientated around a long-term plan. In other words, the data captured today may have no immediate use or even significance to present-day activities; however, the more data, the better -- and that data may have some future use. In contrast, DuQu, which similarly sought intelligence from entities within Iran, was clearly intended to support a much nearer-term operation, which was in all likelihood directly associated with both Flame and, therefore, Stuxnet.

The bottom line here is that we should not assume that the targeting of entities using ICS technology (such as the electric and gas/oil industry) means that the individuals behind such attacks currently possess the capability or immediate desire to attack ICS-related technologies. Despite the publication of numerous security defects in ICS-related products (such as programmable logic controllers) over the past few years, the relative cost of entry into this space remains exponentially higher than engaging in many of the spear-phishing attacks that this group of actors have become so commonly associated with. ICS technologies are presently known for their lack of security features and poor implementations; from that perspective, they may be perceived as a "low-cost" attack. The sheer diversity of technology and configuration thereof within the ICS space makes it exceedingly challenging to develop an offensive technology that can be deployed with the broad brushstrokes that we’re currently seeing in the spear-phishing space. Stuxnet was a good example of this -- given its sophisticated, but highly targeted nature, which, as is, would have been ineffective against any target than that which it was originally intended for.

For those of you with an interest in this area, over the next five days Jonathan Pollet and I will be teaching our annual SCADA security class at Black Hat in Las Vegas. This year, we’ll be demonstrating the application of various vulnerability research techniques on programmable logic controllers and the subsequent exploitation of unpublished vulnerabilities that could be leveraged in a targeted scenario. Look forward to seeing you all out there!

Tom Parker is the CTO of FusionX

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2363
Published: 2014-07-26
Morpho Itemiser 3 8.17 has hardcoded administrative credentials, which makes it easier for remote attackers to obtain access via a login request.

CVE-2014-3071
Published: 2014-07-26
Cross-site scripting (XSS) vulnerability in the Data Quality Console in IBM InfoSphere Information Server 11.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL for adding a project connection.

CVE-2014-3301
Published: 2014-07-26
The ProfileAction controller in Cisco WebEx Meetings Server (CWMS) 1.5(.1.131) and earlier allows remote attackers to obtain sensitive information by reading stack traces in returned messages, aka Bug ID CSCuj81700.

CVE-2014-3305
Published: 2014-07-26
Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCuj81735.

CVE-2014-3324
Published: 2014-07-26
Multiple cross-site scripting (XSS) vulnerabilities in the login page in the administrative web interface in Cisco TelePresence Server Software 4.0(2.8) allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCup90060.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.