Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

11/5/2018
03:05 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Energy Sector's IT Networks in the Bulls-Eye

Attackers are actively infiltrating energy organizations and utilities for reconnaissance purposes.

Stuxnet and Triton/Trisis may have forever shaken the naive sense of security in ICS/SCADA networks, but attackers meanwhile are quietly hammering away at the IT infrastructure of energy firms and utilities in their quest for valuable intelligence on industrial systems.

Recent attack activity tracked by security threat monitoring firm Vectra Networks of more than 4 million devices and systems shows that the IT networks in energy and utilities are being hit regularly by attackers intent on blending in as they conduct deep reconnaissance on their ultimate targets: the industrial networks. From January to June of this year, for every 10,000 host systems, nearly 200 remote access hacking attempts were spotted. In addition, some 314 lateral-movement activities were detected for every 10,000 host devices and cloud application operations. Vectra's data also shows nearly 300 data exfiltration actions per 10,000 host devices and cloud app operations.

Attackers targeting energy companies and utilities increasingly hit their IT networks with stealth tactics, such as employing legitimate Windows tools, too. Chris Morales, head of security analytics at Vectra, says attackers targeting energy and utility organizations are employing the same techniques against their IT infrastructures as nonutility businesses, including phishing and so-called "living off the land" methods of attack, in which they employ legitimate software tools, such as Microsoft PowerShell and Remote Desktop Protocol (RDP), to infiltrate their victims so that their network activity doesn't raise red flags.

"So much happens on [utilities'] IT systems and IT networks," Morales says. [Attackers] are using tools already there, like PowerShell, and hooking into Windows servers, and still using phishing to access credentials to get on those IT networks."

It's a wakeup call for energy firms to better monitor and protect their IT networks. It's also an opportunity to get ahead of attacks on their industrial networks and power generation. "If at least you know what they took on the IT side, you could still adapt [defenses] before they weaponize that," Morales says.

Eddie Habibi, founder and CEO of ICS security firm PAS Global, says his firm has seen how IT network hacks can ultimately can be used to harm the human machine interfaces (HMI) of machines in the industrial network side, for example. That can allow an attacker to corrupt databases, for example, he says, or block the ICS/SCADA operator's view of a manufacturing process.

But for attackers to truly disrupt or sabotage an industrial process, stealing operator credentials from the IT network isn't enough ammo. Hacking the operational technology (OT) network requires intel about the process control network, the systems installed, and other detailed information. "Exploits on the IT side creating a denial-of-service can easily [move] to the IT side of OT systems and process control. However, those attacks generally do not go beyond the IT layer," Habibi says.

That's because most of the attackers hacking at the IT networks aren't sophisticated enough to leverage that stolen data or systems to manipulate the OT network, he says.

Even so, a sophisticated and well-resourced attacker could control the process control network if he or she can get the detailed information of the OT network, including admin passwords, network names, and IP addresses, from an IT network hack, Habibi notes.

That type of deep intelligence-gathering appears to be driving the activity Vectra spotted in its research. "They're trying to get blueprints for all ICS systems, which happen to exist on Windows file shares," Morales says.

He notes how a utility system admin told Vectra the biggest thing on the firm's radar screen is suspicious or malicious use of its administrative servers, which are mostly older Windows 7 systems. "One thing he told us is that ICS 'doesn't keep me up at night,'" but rather, his IT network being attacked, Morales says.

Microsoft Active Directory (AD) servers are becoming a juicy target as a trove of user credential and server information. Attackers have been detected running scripts on the AD server as a way to keep a low profile. "They're sitting there instead of going box to box," Morales says. "They are trying to build a user list and a server list to know what's out there" on the victim network, he says.

Hydro Ottawa, the power distribution company for Ottawa, Canada, employs some continuous network monitoring of its ICS network to spot any anomalies that could indicate malicious activity. "It's really simple to monitor because the traffic is static," says Jojo Maalouf, the utility's manager, IT security. Any deviations are relatively simple to spot, he adds, and it avoids the issue of tampered logs by an attacker.

Blind Spot
Without a detailed, updated accounting of specific equipment, systems, and software (including versions) in the OT network, an energy or industrial firm is especially vulnerable to attack. And many of these organizations have only a snapshot of their infrastructures.

Take the case of a chemical company whose board of directors requested the CIO and CISO investigate whether its OT network was vulnerable to the Triton/Trisis attack that targeted the Schneider Triconex safety instrumentation system. "Two weeks later, four of its sites said they had the same [vulnerable] Triconex system ... But [then another] two weeks later, four more plants said they had it," Habibi says. In the end, it turned out there were Triconex systems at all 12 of its manufacturing sites.

"The first step to mitigate risk is to identify the risk," he says.

Hydro Ottawa's Maalouf says his firm takes a governance approach as well. "As we are deploying systems or solutions .... what does it look like from an IT perspective? From a cybersecurity perspective? What requirements do we want to define? Do you understand what the network topology looks like, the threat landscape?" he says.

The utility uses a threat risk assessment to define its major threats and its critical areas are, and how to mitigate attacks. "We do a lot of that, with continuous improvements" to the process, he says.

There's also the usual layered security setup with firewalls, access control, segmentation, identity management, and antivirus measures. "If you have complete inventory of sensors, controllers, and HMI ... and regularly check for vulnerabilities in those systems plus implement change management, you've gone a long way in protecting your systems and assets," Maalouf says.

Related Content:

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19619
PUBLISHED: 2019-12-06
domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed by adding the bluemonday HTML sanitizer to defend against XSS.
CVE-2019-19616
PUBLISHED: 2019-12-06
An Insecure Direct Object Reference (IDOR) vulnerability in the Xtivia Web Time and Expense (WebTE) interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment fun...
CVE-2019-19617
PUBLISHED: 2019-12-06
phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.
CVE-2012-1114
PUBLISHED: 2019-12-05
A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and exporter_id action. and the filteruid parameter to list.php.
CVE-2012-1115
PUBLISHED: 2019-12-05
A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add_value_form, and dn parameters to cmd.php.