Perimeter
7/19/2012
12:31 PM
Tom Parker
Tom Parker
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Attacking SCADA And Relative Cost Of Entry

SCADA technologies have been increasingly targeted by shadowy adversaries: Does that mean impending doom?

Over the past couple of months, I’ve been asked a number of times about the use of malicious software worms to subvert (a la Stuxnet) SCADA systems, as well as the relative cost of entry into this space for a cyberadversary compared to the cost of doing business for your average spear-phisher today.

Earlier last month, a friend and industry colleague reported on a spear-phish that targeted an employee of well-known industrial control security firm Digital Bond. Like many targeted email spears, the message was generally well-written and demonstrated some domain-level experience in the arena of industrial control security. Attached to the email was a zip file containing an executable designed to masquerade as a PDF, which, when executed, downloaded a secondary payload, which, in turn, installed a RAT (remote access tool) onto the victims PC.

The modus operandi associated with the attack and technological elements (including the RAT) all point to groups of actors who have been previously suspected to be sponsored by the People’s Republic of China. This certainly isn’t the first time that similar groups have targeted individuals and organizations associated with the use of SCADA (or, more broadly, ICS or industrial control system) technologies. Among others, McAfee’s ShadyRat and NightDragon publications both alluded to the targeting of industry that relies heavily on the use of ICS technology -- and the apparent theft of documents and other intellectual property associated with the use of ICS technologies within those entities.

Although past attacks clearly demonstrate an active interest in the possible future targeting of ICS technologies by Chinese actor groups, it’s important to put this activity into the context of the overall philosophy toward intelligence held by the Chinese. Much like other targeted attacks we have seen in the past few years, the objective has more or less remained the same: data harvesting. The commonly recognized philosophy toward intelligence gathering by our friends in the Pacific is orientated around a long-term plan. In other words, the data captured today may have no immediate use or even significance to present-day activities; however, the more data, the better -- and that data may have some future use. In contrast, DuQu, which similarly sought intelligence from entities within Iran, was clearly intended to support a much nearer-term operation, which was in all likelihood directly associated with both Flame and, therefore, Stuxnet.

The bottom line here is that we should not assume that the targeting of entities using ICS technology (such as the electric and gas/oil industry) means that the individuals behind such attacks currently possess the capability or immediate desire to attack ICS-related technologies. Despite the publication of numerous security defects in ICS-related products (such as programmable logic controllers) over the past few years, the relative cost of entry into this space remains exponentially higher than engaging in many of the spear-phishing attacks that this group of actors have become so commonly associated with. ICS technologies are presently known for their lack of security features and poor implementations; from that perspective, they may be perceived as a "low-cost" attack. The sheer diversity of technology and configuration thereof within the ICS space makes it exceedingly challenging to develop an offensive technology that can be deployed with the broad brushstrokes that we’re currently seeing in the spear-phishing space. Stuxnet was a good example of this -- given its sophisticated, but highly targeted nature, which, as is, would have been ineffective against any target than that which it was originally intended for.

For those of you with an interest in this area, over the next five days Jonathan Pollet and I will be teaching our annual SCADA security class at Black Hat in Las Vegas. This year, we’ll be demonstrating the application of various vulnerability research techniques on programmable logic controllers and the subsequent exploitation of unpublished vulnerabilities that could be leveraged in a targeted scenario. Look forward to seeing you all out there!

Tom Parker is the CTO of FusionX

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7407
Published: 2014-10-22
Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2014-3675
Published: 2014-10-22
Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.

CVE-2014-3676
Published: 2014-10-22
Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHCPv6 boot option."

CVE-2014-3677
Published: 2014-10-22
Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.

CVE-2014-4448
Published: 2014-10-22
House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information from a Documents directory by obtaining this UID.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.