Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


03:05 PM
Connect Directly

Energy Sector's IT Networks in the Bulls-Eye

Attackers are actively infiltrating energy organizations and utilities for reconnaissance purposes.

Stuxnet and Triton/Trisis may have forever shaken the naive sense of security in ICS/SCADA networks, but attackers meanwhile are quietly hammering away at the IT infrastructure of energy firms and utilities in their quest for valuable intelligence on industrial systems.

Recent attack activity tracked by security threat monitoring firm Vectra Networks of more than 4 million devices and systems shows that the IT networks in energy and utilities are being hit regularly by attackers intent on blending in as they conduct deep reconnaissance on their ultimate targets: the industrial networks. From January to June of this year, for every 10,000 host systems, nearly 200 remote access hacking attempts were spotted. In addition, some 314 lateral-movement activities were detected for every 10,000 host devices and cloud application operations. Vectra's data also shows nearly 300 data exfiltration actions per 10,000 host devices and cloud app operations.

Attackers targeting energy companies and utilities increasingly hit their IT networks with stealth tactics, such as employing legitimate Windows tools, too. Chris Morales, head of security analytics at Vectra, says attackers targeting energy and utility organizations are employing the same techniques against their IT infrastructures as nonutility businesses, including phishing and so-called "living off the land" methods of attack, in which they employ legitimate software tools, such as Microsoft PowerShell and Remote Desktop Protocol (RDP), to infiltrate their victims so that their network activity doesn't raise red flags.

"So much happens on [utilities'] IT systems and IT networks," Morales says. [Attackers] are using tools already there, like PowerShell, and hooking into Windows servers, and still using phishing to access credentials to get on those IT networks."

It's a wakeup call for energy firms to better monitor and protect their IT networks. It's also an opportunity to get ahead of attacks on their industrial networks and power generation. "If at least you know what they took on the IT side, you could still adapt [defenses] before they weaponize that," Morales says.

Eddie Habibi, founder and CEO of ICS security firm PAS Global, says his firm has seen how IT network hacks can ultimately can be used to harm the human machine interfaces (HMI) of machines in the industrial network side, for example. That can allow an attacker to corrupt databases, for example, he says, or block the ICS/SCADA operator's view of a manufacturing process.

But for attackers to truly disrupt or sabotage an industrial process, stealing operator credentials from the IT network isn't enough ammo. Hacking the operational technology (OT) network requires intel about the process control network, the systems installed, and other detailed information. "Exploits on the IT side creating a denial-of-service can easily [move] to the IT side of OT systems and process control. However, those attacks generally do not go beyond the IT layer," Habibi says.

That's because most of the attackers hacking at the IT networks aren't sophisticated enough to leverage that stolen data or systems to manipulate the OT network, he says.

Even so, a sophisticated and well-resourced attacker could control the process control network if he or she can get the detailed information of the OT network, including admin passwords, network names, and IP addresses, from an IT network hack, Habibi notes.

That type of deep intelligence-gathering appears to be driving the activity Vectra spotted in its research. "They're trying to get blueprints for all ICS systems, which happen to exist on Windows file shares," Morales says.

He notes how a utility system admin told Vectra the biggest thing on the firm's radar screen is suspicious or malicious use of its administrative servers, which are mostly older Windows 7 systems. "One thing he told us is that ICS 'doesn't keep me up at night,'" but rather, his IT network being attacked, Morales says.

Microsoft Active Directory (AD) servers are becoming a juicy target as a trove of user credential and server information. Attackers have been detected running scripts on the AD server as a way to keep a low profile. "They're sitting there instead of going box to box," Morales says. "They are trying to build a user list and a server list to know what's out there" on the victim network, he says.

Hydro Ottawa, the power distribution company for Ottawa, Canada, employs some continuous network monitoring of its ICS network to spot any anomalies that could indicate malicious activity. "It's really simple to monitor because the traffic is static," says Jojo Maalouf, the utility's manager, IT security. Any deviations are relatively simple to spot, he adds, and it avoids the issue of tampered logs by an attacker.

Blind Spot
Without a detailed, updated accounting of specific equipment, systems, and software (including versions) in the OT network, an energy or industrial firm is especially vulnerable to attack. And many of these organizations have only a snapshot of their infrastructures.

Take the case of a chemical company whose board of directors requested the CIO and CISO investigate whether its OT network was vulnerable to the Triton/Trisis attack that targeted the Schneider Triconex safety instrumentation system. "Two weeks later, four of its sites said they had the same [vulnerable] Triconex system ... But [then another] two weeks later, four more plants said they had it," Habibi says. In the end, it turned out there were Triconex systems at all 12 of its manufacturing sites.

"The first step to mitigate risk is to identify the risk," he says.

Hydro Ottawa's Maalouf says his firm takes a governance approach as well. "As we are deploying systems or solutions .... what does it look like from an IT perspective? From a cybersecurity perspective? What requirements do we want to define? Do you understand what the network topology looks like, the threat landscape?" he says.

The utility uses a threat risk assessment to define its major threats and its critical areas are, and how to mitigate attacks. "We do a lot of that, with continuous improvements" to the process, he says.

There's also the usual layered security setup with firewalls, access control, segmentation, identity management, and antivirus measures. "If you have complete inventory of sensors, controllers, and HMI ... and regularly check for vulnerabilities in those systems plus implement change management, you've gone a long way in protecting your systems and assets," Maalouf says.

Related Content:


Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Mobile App Fraud Jumped in Q1 as Attackers Pivot from Browsers
Jai Vijayan, Contributing Writer,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...