Attacking SCADA And Relative Cost Of Entry

Over the past couple of months, I’ve been asked a number of times about the use of malicious software worms to subvert (a la Stuxnet) SCADA systems, as well as the relative cost of entry into this space for a cyberadversary compared to the cost of doing business for your average spear-phisher today.

Earlier last month, a friend and industry colleague reported on a spear-phish that targeted an employee of well-known industrial control security firm Digital Bond. Like many targeted email spears, the message was generally well-written and demonstrated some domain-level experience in the arena of industrial control security. Attached to the email was a zip file containing an executable designed to masquerade as a PDF, which, when executed, downloaded a secondary payload, which, in turn, installed a RAT (remote access tool) onto the victims PC.

The modus operandi associated with the attack and technological elements (including the RAT) all point to groups of actors who have been previously suspected to be sponsored by the People’s Republic of China. This certainly isn’t the first time that similar groups have targeted individuals and organizations associated with the use of SCADA (or, more broadly, ICS or industrial control system) technologies. Among others, McAfee’s ShadyRat and NightDragon publications both alluded to the targeting of industry that relies heavily on the use of ICS technology -- and the apparent theft of documents and other intellectual property associated with the use of ICS technologies within those entities.

Although past attacks clearly demonstrate an active interest in the possible future targeting of ICS technologies by Chinese actor groups, it’s important to put this activity into the context of the overall philosophy toward intelligence held by the Chinese. Much like other targeted attacks we have seen in the past few years, the objective has more or less remained the same: data harvesting. The commonly recognized philosophy toward intelligence gathering by our friends in the Pacific is orientated around a long-term plan. In other words, the data captured today may have no immediate use or even significance to present-day activities; however, the more data, the better -- and that data may have some future use. In contrast, DuQu, which similarly sought intelligence from entities within Iran, was clearly intended to support a much nearer-term operation, which was in all likelihood directly associated with both Flame and, therefore, Stuxnet.

The bottom line here is that we should not assume that the targeting of entities using ICS technology (such as the electric and gas/oil industry) means that the individuals behind such attacks currently possess the capability or immediate desire to attack ICS-related technologies. Despite the publication of numerous security defects in ICS-related products (such as programmable logic controllers) over the past few years, the relative cost of entry into this space remains exponentially higher than engaging in many of the spear-phishing attacks that this group of actors have become so commonly associated with. ICS technologies are presently known for their lack of security features and poor implementations; from that perspective, they may be perceived as a "low-cost" attack. The sheer diversity of technology and configuration thereof within the ICS space makes it exceedingly challenging to develop an offensive technology that can be deployed with the broad brushstrokes that we’re currently seeing in the spear-phishing space. Stuxnet was a good example of this -- given its sophisticated, but highly targeted nature, which, as is, would have been ineffective against any target than that which it was originally intended for.

For those of you with an interest in this area, over the next five days Jonathan Pollet and I will be teaching our annual SCADA security class at Black Hat in Las Vegas. This year, we’ll be demonstrating the application of various vulnerability research techniques on programmable logic controllers and the subsequent exploitation of unpublished vulnerabilities that could be leveraged in a targeted scenario. Look forward to seeing you all out there!

Tom Parker is the CTO of FusionX