Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


03:05 PM
Connect Directly

Energy Sector's IT Networks in the Bulls-Eye

Attackers are actively infiltrating energy organizations and utilities for reconnaissance purposes.

Stuxnet and Triton/Trisis may have forever shaken the naive sense of security in ICS/SCADA networks, but attackers meanwhile are quietly hammering away at the IT infrastructure of energy firms and utilities in their quest for valuable intelligence on industrial systems.

Recent attack activity tracked by security threat monitoring firm Vectra Networks of more than 4 million devices and systems shows that the IT networks in energy and utilities are being hit regularly by attackers intent on blending in as they conduct deep reconnaissance on their ultimate targets: the industrial networks. From January to June of this year, for every 10,000 host systems, nearly 200 remote access hacking attempts were spotted. In addition, some 314 lateral-movement activities were detected for every 10,000 host devices and cloud application operations. Vectra's data also shows nearly 300 data exfiltration actions per 10,000 host devices and cloud app operations.

Attackers targeting energy companies and utilities increasingly hit their IT networks with stealth tactics, such as employing legitimate Windows tools, too. Chris Morales, head of security analytics at Vectra, says attackers targeting energy and utility organizations are employing the same techniques against their IT infrastructures as nonutility businesses, including phishing and so-called "living off the land" methods of attack, in which they employ legitimate software tools, such as Microsoft PowerShell and Remote Desktop Protocol (RDP), to infiltrate their victims so that their network activity doesn't raise red flags.

"So much happens on [utilities'] IT systems and IT networks," Morales says. [Attackers] are using tools already there, like PowerShell, and hooking into Windows servers, and still using phishing to access credentials to get on those IT networks."

It's a wakeup call for energy firms to better monitor and protect their IT networks. It's also an opportunity to get ahead of attacks on their industrial networks and power generation. "If at least you know what they took on the IT side, you could still adapt [defenses] before they weaponize that," Morales says.

Eddie Habibi, founder and CEO of ICS security firm PAS Global, says his firm has seen how IT network hacks can ultimately can be used to harm the human machine interfaces (HMI) of machines in the industrial network side, for example. That can allow an attacker to corrupt databases, for example, he says, or block the ICS/SCADA operator's view of a manufacturing process.

But for attackers to truly disrupt or sabotage an industrial process, stealing operator credentials from the IT network isn't enough ammo. Hacking the operational technology (OT) network requires intel about the process control network, the systems installed, and other detailed information. "Exploits on the IT side creating a denial-of-service can easily [move] to the IT side of OT systems and process control. However, those attacks generally do not go beyond the IT layer," Habibi says.

That's because most of the attackers hacking at the IT networks aren't sophisticated enough to leverage that stolen data or systems to manipulate the OT network, he says.

Even so, a sophisticated and well-resourced attacker could control the process control network if he or she can get the detailed information of the OT network, including admin passwords, network names, and IP addresses, from an IT network hack, Habibi notes.

That type of deep intelligence-gathering appears to be driving the activity Vectra spotted in its research. "They're trying to get blueprints for all ICS systems, which happen to exist on Windows file shares," Morales says.

He notes how a utility system admin told Vectra the biggest thing on the firm's radar screen is suspicious or malicious use of its administrative servers, which are mostly older Windows 7 systems. "One thing he told us is that ICS 'doesn't keep me up at night,'" but rather, his IT network being attacked, Morales says.

Microsoft Active Directory (AD) servers are becoming a juicy target as a trove of user credential and server information. Attackers have been detected running scripts on the AD server as a way to keep a low profile. "They're sitting there instead of going box to box," Morales says. "They are trying to build a user list and a server list to know what's out there" on the victim network, he says.

Hydro Ottawa, the power distribution company for Ottawa, Canada, employs some continuous network monitoring of its ICS network to spot any anomalies that could indicate malicious activity. "It's really simple to monitor because the traffic is static," says Jojo Maalouf, the utility's manager, IT security. Any deviations are relatively simple to spot, he adds, and it avoids the issue of tampered logs by an attacker.

Blind Spot
Without a detailed, updated accounting of specific equipment, systems, and software (including versions) in the OT network, an energy or industrial firm is especially vulnerable to attack. And many of these organizations have only a snapshot of their infrastructures.

Take the case of a chemical company whose board of directors requested the CIO and CISO investigate whether its OT network was vulnerable to the Triton/Trisis attack that targeted the Schneider Triconex safety instrumentation system. "Two weeks later, four of its sites said they had the same [vulnerable] Triconex system ... But [then another] two weeks later, four more plants said they had it," Habibi says. In the end, it turned out there were Triconex systems at all 12 of its manufacturing sites.

"The first step to mitigate risk is to identify the risk," he says.

Hydro Ottawa's Maalouf says his firm takes a governance approach as well. "As we are deploying systems or solutions .... what does it look like from an IT perspective? From a cybersecurity perspective? What requirements do we want to define? Do you understand what the network topology looks like, the threat landscape?" he says.

The utility uses a threat risk assessment to define its major threats and its critical areas are, and how to mitigate attacks. "We do a lot of that, with continuous improvements" to the process, he says.

There's also the usual layered security setup with firewalls, access control, segmentation, identity management, and antivirus measures. "If you have complete inventory of sensors, controllers, and HMI ... and regularly check for vulnerabilities in those systems plus implement change management, you've gone a long way in protecting your systems and assets," Maalouf says.

Related Content:


Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
What the FedEx Logo Taught Me About Cybersecurity
Matt Shea, Head of Federal @ MixMode,  6/4/2021
A View From Inside a Deception
Sara Peters, Senior Editor at Dark Reading,  6/2/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-13
The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.
PUBLISHED: 2021-06-12
Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature.
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
PUBLISHED: 2021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.