Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

3/21/2017
09:02 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

3,000 Industrial Plants Per Year Infected with Malware

Targeted industrial control systems-themed malware is less prevalent yet persistent, including one variant posing as Siemens PLC firmware that has been in action since 2013, researchers find.

A piece of crimeware posing as legitimate Siemens PLC software has been in circulation for four years by an unknown attack group attempting to infect industrial networks mainly in the US.

The backdoor malware is packaged to appear as a Siemens programmable logic controller installer file, and around 10 industrial sites have reported coming across the targeted attack campaign, seven of which are located in the US as well as some in Europe and China, according to new research from Dragos.

"It tries to fool operators into installing what they expect to be files related to their PLCs, but in fact, it's a backdoor," says Robert M. Lee, founder and CEO of Dragos, a critical infrastructure security firm that today at the SANS ICS Summit released findings from its study of malware found in ICS networks.

Lee and his colleague Ben Miller, director of the Dragos Threat Operations Center, identified and analyzed malware cases associated with ICS networks, studying 15,000 malware samples from ICS environments over a three-month period. The researchers studied malware culled from public databases such as VirusTotal, where malware gets uploaded and tested against anti-malware products, as well as from Google searches and Doman Name Service (DNS) data.

Dragos' so-called Malware in Modern ICS (MIMICS) project was meant to provide a gut-check on the actual types of malware hitting ICS environments today. The researchers were able to identify mostly everyday malware: no new Stuxnet-type targeted malware attacks. Even the Siemens-themed malware, while targeting ICS networks, still uses a crimeware-type backdoor piece of malware: nothing destructive or customized like Stuxnet, Havex, or BlackEnergy2.

The researchers found mostly common and easily spreadable malware samples had hit ICS networks: Sivis was by far the most prolific, with 15,863 detections, followed by Lamer (6,830), Ramnit (3,716), Sinwal (2,909), and other common malware families including Virut (1,814) and Sality (1,225). The researchers calculate that some 3,000 industrial sites per year get infected with this type of non-targeted, everyday malware, a figure they consider conservative since not all infected sites necessarily submit their malware to VirusTotal, for instance.

"People expect Stuxnet 2.0 instead of obvious things [malware infections] happening," Lee says. "Our hypothesis is that it doesn't take Stuxnet 2.0 to get into [industrial] facilities. It's more impactful if you can show traditional malware used to target ICS."

The targeted attacks they found besides the Siemens PLC-poser malware were not as widespread as the non-targeted malware. There were around 10 other such ICS-themed malware cases, Lee says. One such attack, dating back to 2011, was a phishing email targeting multiple nuclear sites in the West, but mainly in the US. "We can't tell who was actually affected" from the data set, Lee says. "But we saw it did occur."

Lee says that the presence of any of this malware on ICS systems doesn't mean a manufacturing facility was shut down, or there was a nuclear meltdown. MIMICS' findings shows actual data on what type of malware and attacks are hitting ICS plants. "A lot of [plant owners] want to make user cases for security," he says. "The hope is that this will cut through the hype and show that there are issues." 

More unnerving, however, was how many legitimate ICS files MIMICS discovered incorrectly flagged as malware in VirusTotal and other public sites, leaving those files exposed to abuse by cybercriminals or other threat actors looking for that type of intel to wage a targeted attack on an industrial site. They discovered thousands of legit ICS software programs including human machine interface installers, data historian installers, and key generators for the software, all up for grabs by bad guys.

Lee and Miller found some 120 project files that had been flagged as malicious and submitted to those public databases, including a Nuclear Regulatory Commission report, substation layout specifics and maintenance reports, and other types of sensitive information inadvertently posted publicly.

Pulling off a targeted and destructive attack on an ICS system in an industrial plant isn't so simple. It takes a fair amount of knowledge and understanding of the physical layout of the plant, as well as some knowledge of the industrial processes there. ICS security experts such as Ralph Langner of Langner Communications have argued that in order to execute a "cyber-physical" attack that causes damage to the plant or its processes, the attacker needs knowledge of the physical and engineering aspects of the targeted site. That's a skillset that goes beyond malware and hacking, according to Langner.

But the legitimate files the Dragos team found online could be used as part of an intel- and reconnaissance operation by malicious attackers. "They could get information on where the site was, what the asset owner was, the configuration and layout of the process, what equipment they are using, what software they have," for instance, Lee says. "They could get a lot of information. It wouldn't necessarily give them the physical engineering" information, but it would provide a good amount of information, he says.

An attacker would need to do a large amount of research to hack a plant, but finding this type of legitimate data as well as files on VirusTotal, for example, would shorten that research process by the attacker, Lee notes.

ICS security expert Joseph Weiss this week in a blog post pointed out that malware indeed is resident in ICS systems, so plant operators must "focus on resilience and recovery" from potential cyberattacks. Ensuring that critical control systems are not available on the Internet, as well as establishing secure software updates and limiting access to trusted users are among some of the protections these sites should employ, he noted.

Related Content:

 

 

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Look Beyond the 'Big 5' in Cyberattacks
Robert Lemos, Contributing Writer,  11/25/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: We are really excited about our new two tone authentication system!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4126
PUBLISHED: 2020-12-01
HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attacker to capture the cookie by intercepting its transmission within an http session. Fixes are available in HCL Domino and iNotes versions 10.0.1 FP6 and 11.0.1 FP2 and later.
CVE-2020-4129
PUBLISHED: 2020-12-01
HCL Domino is susceptible to a lockout policy bypass vulnerability in the LDAP service. An unauthenticated attacker could use this vulnerability to mount a brute force attack against the LDAP service. Fixes are available in HCL Domino versions 9.0.1 FP10 IF6, 10.0.1 FP6 and 11.0.1 FP1 and later.
CVE-2020-9115
PUBLISHED: 2020-12-01
ManageOne versions 6.5.1.1.B010, 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, ,6.5.1.1.B050, 8.0.0 and 8.0.1 have a command injection vulnerability. An attacker with high privileges may exploit this vulnerability through some operations on the plug-in component. Due to insufficient input validation of ...
CVE-2020-9116
PUBLISHED: 2020-12-01
Huawei FusionCompute versions 6.5.1 and 8.0.0 have a command injection vulnerability. An authenticated, remote attacker can craft specific request to exploit this vulnerability. Due to insufficient verification, this could be exploited to cause the attackers to obtain higher privilege.
CVE-2020-14193
PUBLISHED: 2020-11-30
Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside the WEB-INF/classes & <jira-installation>/jira/bin directories via a template injection vulnerability in Jira smart values using mustache partials. The ...