Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

11/5/2018
03:05 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Energy Sector's IT Networks in the Bulls-Eye

Attackers are actively infiltrating energy organizations and utilities for reconnaissance purposes.

Stuxnet and Triton/Trisis may have forever shaken the naive sense of security in ICS/SCADA networks, but attackers meanwhile are quietly hammering away at the IT infrastructure of energy firms and utilities in their quest for valuable intelligence on industrial systems.

Recent attack activity tracked by security threat monitoring firm Vectra Networks of more than 4 million devices and systems shows that the IT networks in energy and utilities are being hit regularly by attackers intent on blending in as they conduct deep reconnaissance on their ultimate targets: the industrial networks. From January to June of this year, for every 10,000 host systems, nearly 200 remote access hacking attempts were spotted. In addition, some 314 lateral-movement activities were detected for every 10,000 host devices and cloud application operations. Vectra's data also shows nearly 300 data exfiltration actions per 10,000 host devices and cloud app operations.

Attackers targeting energy companies and utilities increasingly hit their IT networks with stealth tactics, such as employing legitimate Windows tools, too. Chris Morales, head of security analytics at Vectra, says attackers targeting energy and utility organizations are employing the same techniques against their IT infrastructures as nonutility businesses, including phishing and so-called "living off the land" methods of attack, in which they employ legitimate software tools, such as Microsoft PowerShell and Remote Desktop Protocol (RDP), to infiltrate their victims so that their network activity doesn't raise red flags.

"So much happens on [utilities'] IT systems and IT networks," Morales says. [Attackers] are using tools already there, like PowerShell, and hooking into Windows servers, and still using phishing to access credentials to get on those IT networks."

It's a wakeup call for energy firms to better monitor and protect their IT networks. It's also an opportunity to get ahead of attacks on their industrial networks and power generation. "If at least you know what they took on the IT side, you could still adapt [defenses] before they weaponize that," Morales says.

Eddie Habibi, founder and CEO of ICS security firm PAS Global, says his firm has seen how IT network hacks can ultimately can be used to harm the human machine interfaces (HMI) of machines in the industrial network side, for example. That can allow an attacker to corrupt databases, for example, he says, or block the ICS/SCADA operator's view of a manufacturing process.

But for attackers to truly disrupt or sabotage an industrial process, stealing operator credentials from the IT network isn't enough ammo. Hacking the operational technology (OT) network requires intel about the process control network, the systems installed, and other detailed information. "Exploits on the IT side creating a denial-of-service can easily [move] to the IT side of OT systems and process control. However, those attacks generally do not go beyond the IT layer," Habibi says.

That's because most of the attackers hacking at the IT networks aren't sophisticated enough to leverage that stolen data or systems to manipulate the OT network, he says.

Even so, a sophisticated and well-resourced attacker could control the process control network if he or she can get the detailed information of the OT network, including admin passwords, network names, and IP addresses, from an IT network hack, Habibi notes.

That type of deep intelligence-gathering appears to be driving the activity Vectra spotted in its research. "They're trying to get blueprints for all ICS systems, which happen to exist on Windows file shares," Morales says.

He notes how a utility system admin told Vectra the biggest thing on the firm's radar screen is suspicious or malicious use of its administrative servers, which are mostly older Windows 7 systems. "One thing he told us is that ICS 'doesn't keep me up at night,'" but rather, his IT network being attacked, Morales says.

Microsoft Active Directory (AD) servers are becoming a juicy target as a trove of user credential and server information. Attackers have been detected running scripts on the AD server as a way to keep a low profile. "They're sitting there instead of going box to box," Morales says. "They are trying to build a user list and a server list to know what's out there" on the victim network, he says.

Hydro Ottawa, the power distribution company for Ottawa, Canada, employs some continuous network monitoring of its ICS network to spot any anomalies that could indicate malicious activity. "It's really simple to monitor because the traffic is static," says Jojo Maalouf, the utility's manager, IT security. Any deviations are relatively simple to spot, he adds, and it avoids the issue of tampered logs by an attacker.

Blind Spot
Without a detailed, updated accounting of specific equipment, systems, and software (including versions) in the OT network, an energy or industrial firm is especially vulnerable to attack. And many of these organizations have only a snapshot of their infrastructures.

Take the case of a chemical company whose board of directors requested the CIO and CISO investigate whether its OT network was vulnerable to the Triton/Trisis attack that targeted the Schneider Triconex safety instrumentation system. "Two weeks later, four of its sites said they had the same [vulnerable] Triconex system ... But [then another] two weeks later, four more plants said they had it," Habibi says. In the end, it turned out there were Triconex systems at all 12 of its manufacturing sites.

"The first step to mitigate risk is to identify the risk," he says.

Hydro Ottawa's Maalouf says his firm takes a governance approach as well. "As we are deploying systems or solutions .... what does it look like from an IT perspective? From a cybersecurity perspective? What requirements do we want to define? Do you understand what the network topology looks like, the threat landscape?" he says.

The utility uses a threat risk assessment to define its major threats and its critical areas are, and how to mitigate attacks. "We do a lot of that, with continuous improvements" to the process, he says.

There's also the usual layered security setup with firewalls, access control, segmentation, identity management, and antivirus measures. "If you have complete inventory of sensors, controllers, and HMI ... and regularly check for vulnerabilities in those systems plus implement change management, you've gone a long way in protecting your systems and assets," Maalouf says.

Related Content:

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Windows 10 Migration: Getting It Right
Kevin Alexandra, Principal Solutions Engineer at BeyondTrust,  5/15/2019
Artist Uses Malware in Installation
Dark Reading Staff 5/17/2019
Baltimore Ransomware Attack Takes Strange Twist
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12184
PUBLISHED: 2019-05-19
There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart, as demonstrated by a crafted SRC attribute of an IFRAME element, a different vulnerability than CVE-2019-12136.
CVE-2019-12173
PUBLISHED: 2019-05-18
MacDown 0.7.1 (870) allows remote code execution via a file:\\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138.
CVE-2019-12172
PUBLISHED: 2019-05-17
Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137.
CVE-2019-12168
PUBLISHED: 2019-05-17
Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow remote code execution via the Command Shell (aka Administration > Commands) screen.
CVE-2019-12170
PUBLISHED: 2019-05-17
ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PH...