Industrial cyber threat landscape
•
4 likes•1,009 views
This document summarizes the industrial cyber threat landscape as of September 2017. It outlines several high-profile cyber attacks on industrial control systems dating back to 2010, including Stuxnet, Shamoon, BlackEnergy, and CrashOverride. These attacks targeted critical infrastructure like power grids, water treatment plants, and an Iranian nuclear facility. The document also discusses the risks and costs of these incidents, which include physical damage, production shutdowns, and an estimated global cost of cybercrime reaching $6 trillion by 2021. Mitigation strategies are proposed, such as using gateways and managed remote access to block malware and unauthorized access to industrial control networks.
Report
Share
Recommended for you
Recommended for you
Recommended for you
Recommended for you
More Related Content
What's hot
What's hot (20)
Similar to Industrial cyber threat landscape
Similar to Industrial cyber threat landscape (20)
Recently uploaded
Recently uploaded (20)
Industrial cyber threat landscape
- 1. INDUSTRIAL CYBER THREAT LANDSCAPE SEPTEMBER 2017
- 2. Number of incidents U.S. official sees more cyber attacks on industrial control systems http://www.reuters.com/article/us-usa-cybersecurity-infrastructure- idUSKCN0UR2CX20160113 Attacks Targeting Industrial Control Systems (ICS) Up 110 Percent https://securityintelligence.com/attacks-targeting-industrial-control-systems-ics-up- 110-percent/ IBM reports ICS cyber attacks up 110% in 2016 http://securityaffairs.co/wordpress/54792/security/ics-attacks-2016.html https://www.theregister.co.uk/2016/07/11/ics_vuln_internet_exposed/ Risk In April, 2013 a massive ping revealed about 114,000 manufacturing control systems vulnerable for attack, about 13,000 of which can be accessed without inputting a single password Cost One in six businesses have experienced a cyber attack in the past year. New research from Grant Thornton reveals that cyber attacks are taking a serious toll on business, with the total cost of attacks globally estimated to be at least US$315bn* over the past 12 months Cybercrime damages expected to cost the world $6 trillion by 2021 http://cybersecurityventures.com/hackerpocalypse-cybercrime-report-2016/ Note – many of these incidents are underreported, and highly sensitive, limited information is available. This is a non-exhaustive list. INCREASE IN INDUSTRIAL CYBER THREAT INCIDENTS Source: Kaspersky Lab
- 3. Discovered in July 2010 Targeted Iran’s nuclear enrichment program Initially spread using infected removable drives, Infected 100,000 computers and at least 22 manufacturing sites Attacked Siemens PCS7, S7 PLC and WIN-CC systems. Exploited the architecture of the controller by hijacking the vendor’s DLL driver Caused centrifuges to spin out of control without triggering alarms Modified ladder logic sent to/received from the controller without the notice of the development application or the controller No signed code was in use No code execution or configuration tamper control was developed Destroyed up to 1000 centrifuges between November 2009 and January 2010 Set Iran’s nuclear program back a decade Bayshore mitigation Deep content and context inspection could have alerted ladder logic changes Threat intel policies block known malware including Stuxnet Gateways prevent malware from entering server farm and affecting HMIs, Engineering Workstations, other susceptible endpoints Management Console rapidly deploys policies across gateways, blocking cross-contamination New anti-springboard technology stops malware from making horizontal jumps STUXNET
- 4. Duqu Malware had many similarities with Stuxnet Trojan horse aimed to capture and exfiltrate information via jpeg files Flame Spyware discovered in Iran oil and nuclear installations, ran undetected for years More complex than Stuxnet Could record audio, screenshots, keyboard activity and network traffic Bayshore mitigation Deep content and context filtration could have alerted ladder logic changes Block virus from reaching industrial control assets Expropriation of data blocked by deep content filtration and enforcement of DLP policies New anti-springboard technology stops malware from making horizontal jumps DUQU AND FLAME “THE SONS OF STUXNET” Source: Symantec
- 5. Mid-2012 Targeted attack on Saudi Aramco by the “Cutting Sword of Justice” Email, scam-link The most destructive attack on the business sector seen to date Infected more than 75% of the company’s workstations (30,000 to 55,000 workstations partially or totally destroyed) Replaced crucial system files with an image of a burning U.S. flag Impacted messaging services severely for several weeks, Aramco gave oil away free to keep it flowing http://money.cnn.com/2015/08/05/technology/aram co-hack/ Bayshore mitigation Threat intel policies block known malware Gateways prevent malware from entering the server farm and affecting HMIs, Engineering Workstations, other susceptible endpoints Management Console rapidly deploys policies across gateways, blocking cross-contamination New anti-springboard technology stops malware from making horizontal jumps SHAMOON
- 6. December 2012 Chinese hackers (APT1) used a virus concealed in an MS-Word document to take over the control system for a municipal water tower Thankfully, the tower was a honey-pot decoy set up by US Government and no physical damage was done Bayshore mitigation Gateway blocks unauthorized commands from reaching end-points Managed Remote Access solution limits ability to access plants remotely, and controls activity during remote access sessions WATER TOWER DECOY
- 7. Summer 2013 Iranian hackers repeatedly obtained unauthorized access to the SCADA systems of a dam 25 miles north of NYC Accessed through a cellular modem Obtained status and operational data Access would normally have permitted remote operation and manipulation of the sluice gate Thankfully, sluice gate was manually disconnected for maintenance at the time of the intrusion http://time.com/4270728/iran-cyber-attack-dam-fbi/ Bayshore mitigation Gateway blocks unauthorized commands from reaching end-points (sluice gate controls) Managed Remote Access solution limits ability to access plants remotely, and controls activity during remote access sessions BOWMAN DAM
- 8. Fall 2012 Virus attacks control systems in two plants Delivered by maintenance technicians on an infected USB stick A virus in a turbine control system that impacted about 10 computers on its control system network, and affected operations for about three weeks Bayshore mitigation Managed Remote Access solution limits ability to access plants remotely, and controls activity during remote access sessions Threat intel policies block known malware Gateways prevent malware from entering the server farm and affecting HMIs, Engineering Workstations, other susceptible endpoints Management Console rapidly deploys policies across gateways, blocking cross-contamination New anti-springboard technology stops malware from making horizontal jumps US POWER PLANTS
- 9. APT group - AKA Energetic Bear - in operation since 2011, resurfacing now State-sponsored APT Initially targeted defense and aviation companies in the US and Canada followed by European energy firms Targeting ICS systems, now focused on energy sector in EU and NA Damaged and disrupted target companies Use malicious email, watering hole attacks, and trojan horse (RAT) software HAVEX watering hole malware created by DragonFly, extracts information on network, email, contacts, OPC, etc. Bayshore mitigation Managed Remote Access solution limits ability to access plants remotely, and controls activity during remote access sessions Threat intel policies block known malware Gateways detect and prevent network scanning Gateways prevent malware from entering the server farm and affecting HMIs, Engineering Workstations, other susceptible endpoints Management Console rapidly deploys policies across gateways, blocking cross-contamination New anti-springboard technology stops malware from making horizontal jumps DRAGONFLY / HAVEX
- 10. December 2014 Attackers remotely manipulated the industrial control system Used spear-phishing to infiltrate the company network Successfully transitioned to industrial network and control systems Disrupted the blast furnace to not shut down properly Resulted in “massive” physical damage GERMAN STEEL MILL ATTACK Bayshore mitigation Threat intel policies block known malware Gateways prevent malware from entering the server farm and affecting HMIs, Engineering Workstations, other susceptible endpoints Management Console rapidly deploys policies across gateways, blocking cross-contamination Policy enforcement blocks unauthorized commands (e.g., manipulating blast furnace controls) Managed Remote Access solution limits ability to access plants remotely, and controls activity during remote access sessions Content filtration alerts / blocks unnecessary access to the ICS network
- 11. December 2015, a Russian hacking group, Sandstorm, remotely disrupted electricity to 25% of country Used spear-phishing to infiltrate the company network with BlackEnergy malware, transitioned to industrial network and control systems Seized SCADA controls, remotely switched off 30 substations, 230K people without power Used KillDisk to delete HMI hard drives and overwrite MBR Destroyed IT infrastructure (UPS, RTUs, modems, serial- to-Ethernet converters) DDoS on call center to deny consumer access December 2016, another similar attack took out 20% of the countries power CrashOverride/Industroyer Designed to disrupt/destroy ICS Capable of directly controlling switches Most serious cyberweapon since Stuxnet Bayshore mitigation Threat intel policies block known malware Gateways prevent malware from entering the server farm and affecting HMIs, Engineering Workstations, other susceptible endpoints Management Console rapidly deploys policies across gateways, blocking cross-contamination Policy enforcement blocks unauthorized commands (e.g., remotely switching off substations), and unauthorized firmware downloads Managed Remote Access solution limits ability to access plants remotely, and controls activity during remote access sessions New anti-springboard technology stops malware from making horizontal jumps UKRAINE
- 12. March 2016 Syrian hackers manipulated PLCs that manage chemical treatment of public water supply SQL injection and phishing attack entered through antiquated payment app On two instances, chemical levels were altered November 2011 Russian hackers accessed control equipment at South Houston Water and Sewer Department, and destroyed a pump WATER TREATMENT PLANTS Bayshore mitigation Threat intel policies block known malware Gateways prevent malware from entering the server farm and affecting HMIs, Engineering Workstations, other susceptible endpoints Policy enforcement blocks unauthorized commands (e.g., adjusting chemical levels, remotely switching on and off pumps), and unauthorized firmware downloads Managed Remote Access solution limits ability to access plants remotely, and controls activity during remote access sessions New anti-springboard technology stops malware from making horizontal jumps
- 13. February 2014 Internal attack by disgruntled ex-employee After being fired, used VPN to install his own software on ICS systems Disrupted operation, equipment, caused $1.2M in damage Jailed for 34 months Bayshore mitigation Gateways prevent malware from entering the server farm and affecting HMIs, Engineering Workstations, other susceptible endpoints Managed Remote Access solution limits ability to access plants remotely, and controls activity during remote access sessions. No VPN access permitted. GEORGIA PACIFIC
- 14. November 2016 Washington DC Police Video system encrypted 8 days before election April 2017 156 Dallas Emergency Tornado Sirens hacked May 2017 - WannaCry Attack disabling 230,000 computers in 150 countries Severely disrupted UK’s National Health Service (NHS) Production shutdowns at Renault, Nissan, Honda, Il Mundo, Gas Natural, Iberdrola Estimated $5B in damage June 2017 Petya/NotPetya Chernobyl plant monitoring offline Maersk ($300M write-off) Merck, DHL, Modelez (Cadbury, Oreo, Tang), JNPT (India’s largest port) Ongoing Nigerian Business Email attack 500 companies in 50 countries so far Supply chain disruption, access to sensitive data Bayshore mitigation Threat intel policies block known malware Deep filtration prevents malware access to ICS controls systems, and blocks malware from affecting HMIs, Engineering Workstations, other susceptible endpoints Management Console rapidly deploys policies across gateways, blocking cross-contamination New anti-springboard technology stops malware from making horizontal jumps RANSOMWARE, MISC
- 15. 11 biggest industrial cyberattacks so far http://www.industryweek.com/technology/11-biggest- industrial-cyberattacks-so-far-slideshow#slide-0-field_images-119571 Trans Siberian Pipeline https://pgjonline.com/2009/11/17/hacking-the-industrial-scada-network/ Ukraine https://en.wikipedia.org/wiki/December_2015_Ukraine_power_grid_cyber_attack https://www.technologyreview.com/s/603262/ukraines-power-grid-gets-hacked-again-a-worrying-sign-for- infrastructure-attacks/ http://www.nerc.com/pa/CI/ESISAC/Documents/E-ISAC_SANS_Ukraine_DUC_18Mar2016.pdf https://ics-cert.us-cert.gov/alerts/IR-ALERT-H-16-056-01 NY Dam http://time.com/4270728/iran-cyber-attack-dam-fbi/ https://www.justice.gov/opa/pr/seven-iranians-working-islamic-revolutionary-guard-corps-affiliated-entities- charged ADDITIONAL BACKGROUND
- 16. DragonFly https://www.sans.org/reading-room/whitepapers/ICS/impact-dragonfly-malware-industrial-control- systems-36672 German Steel Mill https://ics.sans.org/media/ICS-CPPE-case-Study-2-German-Steelworks_Facility.pdf https://www.wired.com/2015/01/german-steel-mill-hack-destruction/ http://www.bbc.com/news/technology-30575104 http://www.reuters.com/article/us-thyssenkrupp-cyber-idUSKBN13X0VW https://securityintelligence.com/german-steel-mill-meltdown-rising-stakes-in-the-internet-of-things/ Medical http://www.industryweek.com/technology/manufacturers-medical-devices-warned-about-hacking ADDITIONAL BACKGROUND
- 17. Power Grids http://www.telegraph.co.uk/news/2016/12/31/russian-hackers-penetrated-vermont-electric-utility-report/ https://www.thepresidency.org/sites/default/files/Final%20Grid%20Report_0.pdf https://www.scientificamerican.com/article/power-grid-cyber-attacks-keep-the-pentagon-up-at-night/ https://www.wsj.com/articles/cyberattacks-raise-alarms-for-u-s-power-grid-1483120708 https://www.bloomberg.com/news/articles/2017-01-06/grid-in-imminent-danger-from-cyber-threats-energy-report-says http://securityaffairs.co/wordpress/49378/cyber-crime/furtim-energy-sector.html Airlines http://observer.com/2016/09/did-a-cyber-attack-ground-delta-airlines/ https://www.fool.com/investing/2017/01/30/are-americas-airlines-under-cyberattack.aspx http://onemileatatime.boardingarea.com/2016/09/30/delta-outage-cyber-attack/ Chinese Hackers Sold Delta Air Lines Vulnerabilities on Black Market http://www.theepochtimes.com/n3/2134288-exclusive-chinese-hackers- sold-delta-airline-vulnerabilities-on-black-market/ http://www.trtworld.com/in-depth/airline-outages-provide-insight-into-the-threat-of-cyber-warfare-287142 ADDITIONAL BACKGROUND
- 18. Public Water http://www.reuters.com/article/us-cybersecurity-attack-idUSTRE7AH2C3201 https://www.infosecurity-magazine.com/news/water-treatment-plant-hit-by/ http://www.exida.com/images/uploads/Pennsylvania_Water_Hack_Brings_Total_to_Ten.pdf https://www.technologyreview.com/s/517786/chinese-hacking-team-caught-taking-over-decoy-water- plant/ ADDITIONAL BACKGROUND