Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/14/2015
05:11 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Anatomy Of A 'Cyber-Physical' Attack

Inflicting major or physical harm in ICS/SCADA environments takes more than malware.

S4x15 Conference — The real threat to a power or manufacturing plant isn't the latest vulnerability or malware variant. 

"If you only consider hackers, you don’t have to be concerned that much. They won't be able to take down a power grid or blow up chemical facilities," says Ralph Langer, founder of Langner Communications and a top Stuxnet expert. The danger is when attackers have an understanding of the physical and engineering aspects of the plant or site they are targeting, he says.

"We have not seen a lot of cyber-physical attacks in the past to actually cause much damage. That requires skillsets that have nothing to do with hacking," says Langner.

Stuxnet, of course, was the first known example of a cyber-physical attack. Its mission was to derail the uranium enrichment process at Iran's Natanz nuclear facility by sabotaging the associated centrifuges.

"So we can conclude at this time that there are organizations out there already who understand this and have mastered this [cyber-physical attack model], more than like nation-states," Langner says. But that knowledge ultimately will spread more widely, he says.

Langner predicts exploit tools will emerge for attack power grids, for example, as the methodologies known by nation-states proliferate. "That's what concerns me."

Bryan Singer, principal investigator at Kenexis Security Corp., teamed up with chemical engineer Lily Glick at his company to demonstrate just what it would take to execute a remote physical attack on a power plant or manufacturing plant floor. "Software vulnerabilities are of no use if want the maximum scenario. You need to know the engineering protocols" of the targeted site, Singer said here today in a presentation.

An attacker would need to have some knowledge of the control systems running in the plant and how the process -- such as vodka distillation, which Singer and Glick featured as an example in their presentation -- works. So process control operators can't merely rely on vulnerability assessment to secure these systems, according to Singer.

That doesn't mean an attacker needs to actually have engineering expertise, however. The attacker could glean intelligence from open-source information on ICS products as well as acquire inside intelligence about the plant itself, either by stealing plant engineering diagrams or information remotely, or even by schmoozing a plant engineer.

"You could social-engineer an engineer," notes Chris Sistrunk, a senior consultant in the ICS practice at Mandiant, a FireEye company.

[ICS/SCADA systems and networks hackable but not easily cyber-sabotaged without industrial engineering know-how, experts say. Read ISIS Cyber Threat To US Under Debate.]

Other methods of reconnaissance, such as surveillance, or attacking the plant's third-party suppliers, such as systems integrators or vendors, are possible, Singer says. RFPs are also a treasure trove of intel, he says. "They're never going to touch one of those systems until they absolutely have to -- to decrease their chances of getting caught," he says.

The first phase of the actual attack could be compromising a workstation to mimic HMI traffic, for example, he says.

Singer showed how an attacker could mess with pressure release valves to release more steam from the distillation columns, for instance, or close off the valves to decrease the steam, both of which would have a financial impact on the plant.

ICS/SCADA environments are known for being well-prepared for physical safety issues, such as fires or explosions, but mostly from physical events caused by random hardware malfunction or failures -- not due to cyberattacks.

"The way we used to approach hazard analysis misses the malicious component," Langner says. "This opens up a completely new state" of hardware failure, he says. Namely, malicious attackers are more likely to make the process control systems "misbehave" while remaining operational -- much like Stuxnet aimed to do.

The key, Langner says, is to identify any possible direct paths from the cyber side to the physical side of the plant, such as a smart sensor, for example. "This has nothing to do with a buffer overflow in a web server," he says. "If you're able to compromise these 'waypoints,' it's an entry point to physical control."

He points to the MKS PR4000 calibration system attached to pressure sensors in the Natanz plant that tracked the pressure readings of the centrifuges. Langner theorizes the attackers behind Stuxnet manipulated those calibration systems so the plant workers didn't see the real pressure readings that would have flagged  the problems with the devices early on.

"The MKS manual for the product shows how you can calibrate the sensors, by sending [a] command to that box. If you simply use a malicious calibration profile, the sensor never shows that it's above the threshold," he says. "I'm very confident this did happen" in the Stuxnet attack.

Langner says the sophisticated attacker would know when to attack as well to ensure maximum impact. "They would consider certain points in time when the attack would be more effective, or the process or facility more vulnerable," he says, such as when first powering up a nuclear power plant.

"We need to start thinking beyond attackers. If we consider professional engineers working on it, this is how they would go about it," says Langner, who on Friday will give a presentation on this. "I call it cyber-physical attack engineering... We'd better figure it out quickly for the defense."

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
1/15/2015 | 10:45:52 AM
Interesting
It's very interesting to see that some of the stuff that science-fiction warned us about hackers, is potentially possible as hardware becomes smarter and more connected than ever before.

However, here's hoping that the world catches up to taking security seriously enough that only the most determined - and therefore potentially the most likely culprits - will be able to achieve some of the physical barrier crossings that you described. 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/15/2015 | 12:10:39 PM
Re: Interesting
The physical barrier is significant. But it does make social engineering a much more serious risk..
SgS125
50%
50%
SgS125,
User Rank: Ninja
1/15/2015 | 3:45:33 PM
Wrench in the works
Reminds me of engineers talking about how they had to add bullet proof steel to electrical transformers because hill billys kept shooting holes in them with high power rifles.  Where there is a will.......

 

Or when striking workers at the meat packing plant simply cut the conveyor belts and left the plant.

 

Always a risk no matter where the "attack" comes from.
Kaytana22
50%
50%
Kaytana22,
User Rank: Apprentice
1/29/2015 | 1:03:58 PM
Hmmm
     It is only a matter of time really, the 'hacktivists' responsible are only going to get better at this. Sooner or later there is going to be a breach and things are going to get very messy. I was just talking to my husband about what would happen if they actually got into the system where they can cause a total shutdown or even an explosion of some kind. It always seems that no matter how good our system securities are, there is always someone out there that is better. I just hope we have the people to combat this threat and keep up on it, to keep people out of the places that we don't want them to be in.

-M. Cummings
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Human Nature vs. AI: A False Dichotomy?
John McClurg, Sr. VP & CISO, BlackBerry,  11/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: -when I told you that our cyber-defense was from another age
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15073
PUBLISHED: 2019-11-20
An Open Redirect vulnerability for all browsers in MAIL2000 through version 6.0 and 7.0, which will redirect to a malicious site without authentication. This vulnerability affects many mail system of governments, organizations, companies and universities.
CVE-2019-15072
PUBLISHED: 2019-11-20
The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and universities.
CVE-2019-15071
PUBLISHED: 2019-11-20
The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail syste...
CVE-2019-6176
PUBLISHED: 2019-11-20
A potential vulnerability reported in ThinkPad USB-C Dock Firmware version 3.7.2 may allow a denial of service.
CVE-2019-6184
PUBLISHED: 2019-11-20
A potential vulnerability in the discontinued Customer Engagement Service (CCSDK) software version 2.0.21.1 may allow local privilege escalation.