Threat Intelligence

3/21/2017
09:02 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

3,000 Industrial Plants Per Year Infected with Malware

Targeted industrial control systems-themed malware is less prevalent yet persistent, including one variant posing as Siemens PLC firmware that has been in action since 2013, researchers find.

A piece of crimeware posing as legitimate Siemens PLC software has been in circulation for four years by an unknown attack group attempting to infect industrial networks mainly in the US.

The backdoor malware is packaged to appear as a Siemens programmable logic controller installer file, and around 10 industrial sites have reported coming across the targeted attack campaign, seven of which are located in the US as well as some in Europe and China, according to new research from Dragos.

"It tries to fool operators into installing what they expect to be files related to their PLCs, but in fact, it's a backdoor," says Robert M. Lee, founder and CEO of Dragos, a critical infrastructure security firm that today at the SANS ICS Summit released findings from its study of malware found in ICS networks.

Lee and his colleague Ben Miller, director of the Dragos Threat Operations Center, identified and analyzed malware cases associated with ICS networks, studying 15,000 malware samples from ICS environments over a three-month period. The researchers studied malware culled from public databases such as VirusTotal, where malware gets uploaded and tested against anti-malware products, as well as from Google searches and Doman Name Service (DNS) data.

Dragos' so-called Malware in Modern ICS (MIMICS) project was meant to provide a gut-check on the actual types of malware hitting ICS environments today. The researchers were able to identify mostly everyday malware: no new Stuxnet-type targeted malware attacks. Even the Siemens-themed malware, while targeting ICS networks, still uses a crimeware-type backdoor piece of malware: nothing destructive or customized like Stuxnet, Havex, or BlackEnergy2.

The researchers found mostly common and easily spreadable malware samples had hit ICS networks: Sivis was by far the most prolific, with 15,863 detections, followed by Lamer (6,830), Ramnit (3,716), Sinwal (2,909), and other common malware families including Virut (1,814) and Sality (1,225). The researchers calculate that some 3,000 industrial sites per year get infected with this type of non-targeted, everyday malware, a figure they consider conservative since not all infected sites necessarily submit their malware to VirusTotal, for instance.

"People expect Stuxnet 2.0 instead of obvious things [malware infections] happening," Lee says. "Our hypothesis is that it doesn't take Stuxnet 2.0 to get into [industrial] facilities. It's more impactful if you can show traditional malware used to target ICS."

The targeted attacks they found besides the Siemens PLC-poser malware were not as widespread as the non-targeted malware. There were around 10 other such ICS-themed malware cases, Lee says. One such attack, dating back to 2011, was a phishing email targeting multiple nuclear sites in the West, but mainly in the US. "We can't tell who was actually affected" from the data set, Lee says. "But we saw it did occur."

Lee says that the presence of any of this malware on ICS systems doesn't mean a manufacturing facility was shut down, or there was a nuclear meltdown. MIMICS' findings shows actual data on what type of malware and attacks are hitting ICS plants. "A lot of [plant owners] want to make user cases for security," he says. "The hope is that this will cut through the hype and show that there are issues." 

More unnerving, however, was how many legitimate ICS files MIMICS discovered incorrectly flagged as malware in VirusTotal and other public sites, leaving those files exposed to abuse by cybercriminals or other threat actors looking for that type of intel to wage a targeted attack on an industrial site. They discovered thousands of legit ICS software programs including human machine interface installers, data historian installers, and key generators for the software, all up for grabs by bad guys.

Lee and Miller found some 120 project files that had been flagged as malicious and submitted to those public databases, including a Nuclear Regulatory Commission report, substation layout specifics and maintenance reports, and other types of sensitive information inadvertently posted publicly.

Pulling off a targeted and destructive attack on an ICS system in an industrial plant isn't so simple. It takes a fair amount of knowledge and understanding of the physical layout of the plant, as well as some knowledge of the industrial processes there. ICS security experts such as Ralph Langner of Langner Communications have argued that in order to execute a "cyber-physical" attack that causes damage to the plant or its processes, the attacker needs knowledge of the physical and engineering aspects of the targeted site. That's a skillset that goes beyond malware and hacking, according to Langner.

But the legitimate files the Dragos team found online could be used as part of an intel- and reconnaissance operation by malicious attackers. "They could get information on where the site was, what the asset owner was, the configuration and layout of the process, what equipment they are using, what software they have," for instance, Lee says. "They could get a lot of information. It wouldn't necessarily give them the physical engineering" information, but it would provide a good amount of information, he says.

An attacker would need to do a large amount of research to hack a plant, but finding this type of legitimate data as well as files on VirusTotal, for example, would shorten that research process by the attacker, Lee notes.

ICS security expert Joseph Weiss this week in a blog post pointed out that malware indeed is resident in ICS systems, so plant operators must "focus on resilience and recovery" from potential cyberattacks. Ensuring that critical control systems are not available on the Internet, as well as establishing secure software updates and limiting access to trusted users are among some of the protections these sites should employ, he noted.

Related Content:

 

 

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
1.9 Billion Data Records Exposed in First Half of 2017
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/20/2017
To Be Ready for the Security Future, Pay Attention to the Security Past
Liz Maida, Co-founder, CEO & CTO, Uplevel Security,  9/18/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Jan, check this out! I found an unhackable PC.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.