Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Advanced Threats

10:40 AM

Utilities, Nations Need Better Plan Against Critical Infrastructure Attackers

The attackers behind the Triton, or Xenotime, intrusions into critical infrastructure (CI) safety systems are testing their skills against electric power companies. Options for defense are still limited, however.

In February 2019, the group behind the Triton attack on oil and gas companies changed their tactics: The group started scanning electric utility companies for vulnerabilities, according to critical infrastructure security firm Dragos.

The switch in targeting is the first publicly known instance of a group behind a specific critical infrastructure attack targeting multiple infrastructures, says Sergio Caltagirone, vice president of threat intelligence for Dragos. The capability to attack more than one target suggests the actors in the group have become more sophisticated and better-funded, he says.

"The challenge is that for as long as we have been tracking industrial threats, the threats have effectively stayed in their own silo," Caltagirone says. "They have either been geographically focused or sector-specific, and the reason is that it costs so much time and resources to attack one specific sector of industrial that there really hasn't been any publicly known group that has been able to cross over."

The problem is that, while attackers have increased their capabilities, defenders still remain stuck with a limited number of tools—both technological and political—to dissuade the attacks on their networks. Most governments and companies targeted by such attacks are left with a single option: Learn about the attackers and then kick them out of the infrastructure. 

"We need a strategic response," Caltagirone says. "There has to be some sort of recognition that we are all in the same space, and we have to somehow find a way to put pressure on them to stop."

Critical infrastructure owners have a harder cybersecurity problem than most companies. Creating a reliable infrastructure has always been a priority, and that means not creating chaos with major changes or software updates. For that reason, industrial devices and critical infrastructure are designed to be deployed for decades rather than years, making the standard software security approach of frequent updates more a logistical nightmare, said Tim Mackey, principal security strategist at Synopsys.

"With digital sensors and computing devices within industrial plants having lifespans far exceeding those of commercial devices, a comprehensive patch management strategy designed with a detailed understanding of the software supply chain powering these devices is a critical component of ongoing threat mitigation," he said in a statement.

For the most part, critical infrastructure companies keep watch on adversaries by passing around indicators of compromise (IOCs) among themselves through information sharing and analysis centers (ISACs). With adversaries changing their tactics frequently, however, they need to do more. 

"We have to get beyond IOCs—we have to, have to, have to," Dragos's Caltagirone says. "We have to start monitoring and identifying behavior. Because over time, over a year plus, these adversaries' (tools) are going to change so many times, it will be nearly impossible to protect yourself."

On the national level, despite the constant attacks on critical infrastructure, strategic options to dissuade such attacks seem in short supply. In 2018, the U.S. Department of Justice, for example, continued to use legal tools against such attackers, indicting both Russian and Chinese actors for attacking election infrastructure and private industry, respectively. The U.S. has imposed sanctions against both countries as well.

Nations and their critical industries need to go beyond those measures and cooperate on both limiting critical infrastructure attacks and improving defenses against such measures. 

"There has to be a defender that is not just the utility—meaning governments, transnational organizations, industry sharing groups, and so forth," Caltagirone says. "You can't have, say, Idaho protect against the Russians and have Mississippi have to do the same—that is an untenable request to make, and we don't make that request in any other domain."

For now, the intent of attackers—most of which are likely rival countries—is to find their way into targets of interest, according to Caltagirone. This activity, called "access operations," teaches attackers a great deal about the targets of interest and what countermeasures the defenders are deploying. 

"What they are doing right now is very intelligent. This is what a mature organizations does—they take the time to figure out what organizations they want to beat," he says.

Yet, in the end, if we don't figure out a way to deal with the attackers—whether through technology or policy or both—then the outcome is grim, Caltagirone says. "If we don't accept that understanding of the world and defend in that way, the adversary is going to walk right through all our defenses," he says.


Related Content

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
User Rank: Apprentice
6/19/2019 | 2:50:32 PM
Raising awareness around a growing area of risk
Great article Rob.  You shed some light onto the existing inconsistency in critical infrastructure protection, an area we started working on in 1997 with PDD 63.  Given current events and increased heat around attacks and responses on the grid, more of this kind of exposition is important.
User Rank: Ninja
6/29/2019 | 8:23:41 AM
Utilities need to be honest with the American public
"They have either been geographically focused or sector-specific, and the reason is that it costs so much time and resources to attack one specific sector of industrial that there really hasn't been any publicly known group that has been able to cross over."

 Interesting, I have worked a few ICS companies and what I have found is the following:
  • The organizations did not to make changes to old ICS systems because they felt it would affect certain IPL device performance or cause the software to shutdown
  • The software is outdated and the patch levels were months behind
  • The operator and staff were unwilling to setup test labs, the lab can be one or two machines with ICS software installed as a test case
  • The organization was unwilling to extensively test application segmentation
  • The OS and software the companies used numerous Windows Visual Studio C++ versions and ran databases in product environments that were 7-10 years old (MSSQL 7)
  • The utility company did not implement MFA/2FA
  • After the company bought the ICS application, enhancements were not applied
  • Adequate training was not purchased and shared across organization groups (certain groups did not share information with various teams)

For example, a friend of mine in Washington, DC (Citrix Systems Integrator and Designer) worked with a utility company where he was the manager and designer of a VDI environment, the system was running (during that time) the latest version of Cisco Switches (Nexus), Cisco UCS, NetApp with high-speed connections bursting from 10G/sec to 80G/sec (numerous fibre connections from DC, Delaware to ATL). They were acquired by a large power company, the larger power company wanted to deploy their software versions (because they were unfamilar with the Citrix VDI solution currently running) on their hardware (remove existing). The company went from 99.99% uptime to 44.60% uptime after they deployed their solution (this was for the utility helpdesk). There was a buy out, people complained but they were bought out or let go. This is a prime example of individuals not willing to listen or absorb the best aspects of the company, we see it all the time in the IT business, it had nothing to do with money, it was more about control.

In certain cases, money may have been an issue but the number one issue was "fear" or unwillingness to accept that a group may be more knowledge in an area of IT. The mentality for years is based on "if it's not broke, don't fix it". Well that is no longer a valid adage for performance and security. I do think it is a mentality but with proper planning, work extensively with the vendor, setup a small lab, schedule meetings, adequately train internal staff and test patch to identify the affects; the organization can reduce their outage concerns while minimizing costs.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
Modern Day Insider Threat: Network Bugs That Are Stealing Your Data
David Pearson, Principal Threat Researcher,  10/21/2020
Are You One COVID-19 Test Away From a Cybersecurity Disaster?
Alan Brill, Senior Managing Director, Cyber Risk Practice, Kroll,  10/21/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-10-26
libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session_id.
PUBLISHED: 2020-10-26
An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this is only exploitable if the application usi...
PUBLISHED: 2020-10-26
Ruckus through is affected by remote command injection. An authenticated user can submit a query to the API (/service/v1/createUser endpoint), injecting arbitrary commands that will be executed as root user via web.py.
PUBLISHED: 2020-10-26
Ruckus vRioT through has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorization header.
PUBLISHED: 2020-10-26
In the git-tag-annotation-action (open source GitHub Action) before version 1.0.1, an attacker can execute arbitrary (*) shell commands if they can control the value of [the `tag` input] or manage to alter the value of [the `GITHUB_REF` environment variable]. The problem has been patched in version ...