November 2012
By Bill Lydon, Editor
Kaiser described various other cyber activities including:
- In 2012 Chinese hackers gained 'full access' to NASA's Jet Propulsion Laboratory that commands 23 spacecraft.
- In the last 6 months malware has been repeatedly used against oil companies.
- 82 targeted intrusions focused on Nuclear power and chemical plants.
- ICS-CERT is tracking a major spear-phishing campaign into U.S.
- 23 pipeline operators were targeted
- Attack on Saudi Aramco wiped out 30,000 computer systems in August.
- ICS-CERT receiving increased reports of attacks on industrial systems.
Oil & Natural Gas Pipelines
December 2011- May, 2012.
The next week RasGas experienced a similar cyber-attack.
The malware used stole information and then destroyed data and computer operation.
Kaiser showed data illustrating a 400% increase in the reporting of vulnerabilities to ISC-CERT from 2010 to 2011. In the last six months, ISC-CERT has had over 20,000 reports of unauthorized internet access to control systems.
Ordinary phishing emails typically contain a link to a counterfeit website, designed to look like an authentic login page. It will actually capture personal data for cyber criminals, who will use it to commit financial fraud. The emails are typically poorly targeted so the criminal enterprise relies on sheer volume of email to create victims. Spear phishing is different. Targets are identified in advance and the emails that attempt to trick them into handing over personal data can be highly specific.
They might purport to come from a friend or colleague, or seek to exploit the target’s known interests.
Using another video, Kaiser illustrated how the control analysis center at Idaho National Laboratories is used to learn about cyber-attacks and how to protect systems. The video showed a chemical pilot plant where experts created a series of remote cyber-attacks to compromise the plant operations causing a potentially dangerous situation. In this case malicious code was embedded in a PowerPoint presentation and inserted into the corporate domain. It opens a covert channel from the victim’s computer through the corporate firewall to the attackers on the internet. Once the attacker has control of the victim’s computer, the attacker uses a variety of scanning mechanisms and network analysis tools to take control of more machines in the corporate environment.
By “watching” how machines are exchanging information, the attacker is able to hijack sessions between the corporate domain and the industrial automation system domain. The attacker is then able to extend their covert channel into the automation system’s domain. In this example, the attack took control of pumps to overflow tanks and at the same time the operator screens were controlled to show all systems running normally, effectively masking the attacker’s activity.
Kaiser discussed the importance of having awareness campaigns to bring issues that compromise systems to employees’ top of mind. She told a story of how they wrote “classified” on CDs and threw them into parking lots of government facilities. An amazingly large number of federal employees with security clearances picked them up and put them in a computer drive.
- Cyber Security Evaluation Tool (CSET)
- Department of Homeland Security: Cyber Security Procurement Language for Control Systems
Cyber Security has been under discussion for quite some time but it seems to be an issue that doesn’t come to the forefront until major disasters and/or government regulations. It is likely that both of these will be motivators for improving industrial automation systems in the future.
The Cybersecurity Act of 2012 sought to protect computer networks running the power grid, gas pipelines and water supply and transportation systems from hackers by creating a set of security standards for companies to meet. The Act was defeated in Congress.
I get the impression from listening to Lisa Kaiser and other presentations that cyber-attacks on automation and control systems are increasing significantly - the “big game” has not started yet. Adversaries are just learning, poking and gather data. Winners of classic military battles generally get good reconnaissance and probe at their opponents’ defenses before launching major attacks. Carrying the war analogy further, there are typically campaigns with many battles.
You better take a harder look at cyber security for your automation and control systems.
