Youssef El Maimouni on Senthorus Blog

European energy sector targeted by cyberattacks

Fri, 12 Apr 2024 00:00:00 +0000

Introduction

Energy infrastructures represent a critical concern for all cities and are increasingly the target of sophisticated attacks aimed at destabilizing certain countries. Particularly within the context of escalating geopolitical tensions. Attacks targeting electrical energy providers can trigger chain reactions leading to devastating consequences, particularly affecting safety and even causing natural disasters beyond their immediate impact on electricity availability.

These attacks are utilized as a veritable arsenal of war when motivated by geopolitical tensions. This was evident in 2022 in Ukraine when the attack on the electrical infrastructure was coupled with a physical military assault. Or more recently, between May 11th and 30th, 2023, a large-scale attack took place against Danish electrical actors, targeting up to 22 companies in the same campaign.

In this article, we will review these two attacks to draw concluding lessons regarding the tactics and techniques employed, along with recommendations to best monitor and protect critical infrastructures.

Ukraine 2022 – Sandworm APT manages to cut off electricity in multiple Ukrainian regions

This is not the first time Ukraine has been targeted by the APT Sandworm. We recall the year 2015 when they used the specific malware BlackEnergy3, followed by Industroyer/Crashoverride in 2016, successfully cutting off electricity for several hours, forcing operations to switch to manual mode to restore power.

On October 10, 2023, the APT Sandworm repeated its attack, this time with an even more stealthy approach and a more significant impact, using a new type of attack. The exact point of entry into the target infrastructure or the initial access date is not known precisely. However, it is known that the attackers were able to pivot to Supervisory control and data acquisition (SCADA) instances by exploiting the host hypervisor using an outdated version of the MicroSCADA software.

Sandworm used then a set of Living Off the Land Binaries (LOTL) scripts to directly impact the control of electricity stations by disconnecting them. LOTL refer to cyber criminals’ techniques leveraging non-malicious binaries, generally built-in operating system, to hide their malicious activities via legit processes.

The last phase of the attack involved the usage of a new version of CaddyWiper to erase attack traces on the IT side.

Tactics

The Mandiant incident response team estimates an intrusion around June 2022 (source), during which the attacker deployed a webshell Neo-REGEOARG on an internet-facing server, ensuring persistent access to the station’s web servers. In July, this persistence was reinforced by deploying GOGETTER, an open-source tool acting as a tunnel to the attackers for their command-and-control servers over TLS.

Using SystemD, the adversaries managed to establish persistence for Gogetter’s execution after machine reboots, all while disguising this service to appear legitimate.

Figure 1 Incident targeted attack lifecycle - Source: Mandiant

By exploiting a vulnerability in this end-of-life version of the SCADA control system, they managed to insert an ISO containing three scripts (lun.vbs, n.bat, s1.txt). However, no obvious malicious payload was included in these files because they succeeded in translating their goal directly into the SCIL language, which is the scripting language for the MicroSCADA control system. These commands were then transmitted to the Remote Terminal Units (RTUs) of the substations, likely to open the circuit breakers and achieve the attack’s objective.

By using the LOTL scripts, the attackers were able to remain discreet. To complete the operation, on October 12th, they deployed a new version of CaddyWipper via Group Policy Objects (GPO) and a scheduled task to clean up the traces left behind.

Denmark 2023 - Multiple attacks against energy sector companies

On May 11th, 2023, the Danish energy sector was heavily impacted by a series of targeted attacks, affecting no fewer than 22 companies involved in the energy domain. The group of attackers exploited a vulnerability (CVE-2023-28771) in Zyxel firewalls, officially known since April 25th, 2023. Zyxel is widely used in Denmark and is found in many critical OT infrastructures designed to protect against threats. Ironically, the attack vector was precisely the device meant to ensure the protection.

The attackers managed to leverage the resources of compromised entities in brute force and DDoS campaigns against other companies before the defense teams managed to isolate compromised infrastructures from the Internet.

Tactics

First wave

The vulnerability CVE-2023-28771 was exploited by sending a single crafted packet to port 500/UDP of the vulnerable firewall’s VPN service. The attacking group conducted a deep reconnaissance, as all sent packets successfully reached their target without one miss. This indicates that they precisely knew which firewalls were vulnerable, even though this information was not available publicly on Shodan. As a result, the attacker could execute commands with root privileges directly on the device without authentication.

Once the attackers gained initial access, they proceed to the extraction of the vulnerable firewall configuration and user accounts information.

Second wave

On May 22nd, 2023, a second wave of attacks was observed, where compromised companies were seen downloading new software through insecure connections. Additionally, encrypted command and control traffic was detected, utilizing either a recently created domain or known malicious IPs associated with a variant of the Mirai botnet called Moobot. This time, it appeared that the attackers exploited zero-day vulnerabilities, which were disclosed by the Zyxel vendor two days after the beginning of the second wave attack.

Following the command-and-control activities, there was a coordinated DDoS attack on the United States and Hong Kong, as well as a SSH brute force attempt against a Canadian company, occurring just before the defensive containment measures.

Figure 2 Cyberkill chain of the attack - Source: Sektocert.dk

Recommendation

It is recommended to implement strict network segmentation between OT and IT zones, as well as critical zones within the OT network. Additionally, when aware of vulnerable assets and the unability to patch them, it is essential to segment them to minimize the attack surface while allowing production to continue. This is particularly crucial for End-of-Life products, as demonstrated by the success of the Sandworm attack.

Concerning operational industrial scripts and commands, collaborating with production teams is crucial to identify functions and commands for defining a configuration baseline. This helps to detect stealth techniques, such as LOTL. Effective collaboration within the industrial/production team would further enhance the ability to spot malicious activities, improving defense capabilities.

Log collection from EDR and centrally managed Antivirus systems to improve detection capabilities. Integration with a SIEM and enrich with Threat Intelligence feeds to detect attacks based on tactics and known IOCs associated with known botnets or APTs.

In addition to effective network segmentation, it is recommended to monitor potential threats to vulnerable systems using specific detection rules at the SOC level.

Monitor the OT network, paying particular attention to flows from IT to OT and OT to/from the internet. Establishing a 24/7 detection capabilities for swift response, utilizing passive monitoring solutions coupled with machine learning to detect any changes in your environment or abnormal connections.

References

Key controls for ICS environment

Sun, 17 Sep 2023 00:00:00 +0000

Industrial Environment Security

Challenges in OT Network Security

Industrial environments networks are often considered less secure than traditional IT environments. This is partly because OT systems were designed to operate autonomously with a focus on performance and real-time with less attention on security. Additionally, the equipment and communication protocols used in OT environments are often outdated and vulnerable to attacks.

Key Challenges

Difficulty of updating equipment: Many industrial equipment are difficult to update due to their critical nature or very long lifecycle.
Complexity of systems: Industrial systems are often complex and interconnected, making them difficult to manage and secure.
Internal threats: Employees, subcontractors, or partners may access industrial systems and cause intentional or unintentional damage.

To enhance the security of industrial environments, it is important to have a secure-by-design approach, develop best practices for patching and coding, and have the capability to monitor and respond when an incident occurs.

Security by Design

The Purdue Model

The Purdue model was defined to establish best practices in terms of data separation between the OT and IT networks. It is based on a hierarchical architecture, dividing the information system into six different levels, each with its own security concerns and requirements.

The Purdue model proposes a security architecture based on network segmentation into different security zones, including DMZ buffer zones, particularly between levels 3 and 4, where the industrial DMZ (level 3.5) is located.

Although debated in terms of modern relevance, especially with the rise of IoT, it remains a recognized standard and provides a solid foundation adaptable to industry-specific needs.

Segmentation

OT network segmentation is a vital security practice. It reduces the risk of attack propagation throughout the network.

Key principles:

ICS protocols must remain confined to the control network (not above level 3).
Lower layers, including the control level, must never have direct internet access.

Hardening and Patching

Hardening and patching are critical but challenging due to:

Use of outdated and unsupported operating systems.
Need to reduce attack surfaces via effective segmentation.

It’s also important to follow good coding practices, even for PLC programmers. A guide of the 20 best practices for coding PLCs, based on the OWASP Top 10 format, has been developed to ensure secure programming. The list of recommendations in detail can be found here.

Identification and Monitoring

Asset Identification

Understanding all assets is crucial. This includes:

Identifying “crown jewels” (critical assets).
Inventorying physical equipment, data flows, and networks.

Baseline

Defining a baseline enables anomaly detection:

Data flows and configurations should be baselined.
Example: A baseline could have prevented the Stuxnet attack.

Monitoring

Effective monitoring requires:

Passive rather than active scans (to avoid disrupting sensitive equipment).
Tools like Nozomi, Claroty, Microsoft Defender for IoT.

Key areas of focus:

Remote connections (RDP, VPN, TeamViewer…)
Border elements between IT and OT (e.g., data historian)
Collecting logs and sending to a SIEM for early detection

Incident Response

A dedicated, trained incident response team is essential. They should:

Understand ICS processes
Maintain regular contact with operational staff
Be ready to minimize operational impact and downtime during incidents

ICS Cyber Kill Chain

The ICS Cyber Kill Chain is a model from SANS Institute to understand and counter ICS-targeted attacks. It consists of two phases:

Phase 1: Intrusion & Learning

Reconnaissance: Identifying vulnerabilities and entry points
Delivery: Deploying malware (e.g., phishing)
Exploitation: Using vulnerabilities to penetrate the system
Installation: Installing malware to gain remote control

Phase 2: Attack

Privilege Escalation: Gaining elevated privileges
Propagation: Spreading across other ICS systems
Malicious Act: Disruptions, parameter changes, or ransomware

Examples

Stuxnet: Passed through all Purdue levels to reach nuclear centrifuges at level 0.
Havex: A RAT used in espionage campaigns; introduced via phishing and watering hole attacks.

ICS Security Resources

ICS/OT Components overview

Sun, 10 Sep 2023 00:00:00 +0000

ICS components overview

Today, many industrial sites are directly connected to the internet or the company’s information systems (IS). Although this can facilitate and automate operations, these connections can also be targeted by malicious intrusions if they are not sufficiently protected. It is therefore important to clarify the concepts related to industrial system security and provide some keys to prevent them.

First, we must clarify the confusion between the different acronyms frequently used in industrial security OT, ICS, SCADA…

OT, or operational technology, includes all the hardware and software technologies used to maintain the functioning and interact with the components and production infrastructure. Industrial control systems (ICS), building management systems (BMS), heating, ventilation, and air conditioning (HVAC) systems, as well as lighting, access, and security in buildings, are all part of OT systems.

Industrial Control Systems

ICS, or industrial control systems, refer to the software or hardware solutions used for control and supervision operations in the OT environment of industrial production processes. Supervisory Control and Data Acquisition (SCADA) systems are one of the most common ICS solutions, and are offered by various players such as ABB, Rockwell Automation, Schneider Electric, and Siemens. These systems collect information from different production units and sensors to allow operators to remotely visualize or modify real-time production operations.

In the industrial world, Safety and Reliability must be the watchwords, even before the traditional principles of confidentiality, integrity, and availability (CIA) of the IT world. ICS systems are omnipresent in all industries and are a vital element for critical industries such as nuclear power plants, electricity, water, gas, and oil distribution. It is therefore crucial to protect these systems against malicious attacks because compromising an ICS can have serious consequences, including loss of human lives or environmental disasters.

SCADA Architecture

SCADA architectures include both hardware and software components, making them a prime target for cyber-attacks in OT environments. Within a SCADA architecture, there are several common components, including Programmable Logic Controllers (PLCs), Remote Terminal Units (RTUs), historian databases, Human Machine Interfaces (HMI), sensors, and actuators.

SCADA systems are designed to collect information on geographically dispersed industrial processes, allowing operators to centrally view, supervise, or control operations in real time and remotely. This information may include states, temperatures, and pressures obtained from valves, sensors, pumps, etc.

This information is transmitted to the SCADA software by on-site controllers that are involved in the industrial process, especially by PLCs and RTUs. PLCs are input/output-based microprocessors that execute programmed actions based on received inputs. RTUs do the same but tend to be used for less complex applications than PLCs as they are less flexible in terms of programming and are cheaper.

The information collected by the different PLC/RTU is transmitted to the SCADA software, which centralizes it and makes it accessible via the HMI interface. Operators can then view and react to alarms in real-time.

A data historian is a centralized database located on the control system’s local network. It enables users to collect a significant amount of real-time data and business data to transform operations by providing information on equipment trends, patterns, and performance.

ICS data historians typically collect data from various sources such as control devices, sensors, and PLCs. The collected data is usually obtained via specific/proprietary SCADA systems or OPC DA/UA protocols. The data is then stored and made accessible via a user interface or API for reporting or analysis needs.

In addition to being a central point across a network of sensors, control devices, and PLCs, data historians can also be connected to other systems such as Enterprise Resource Planning (ERP) systems and analytics platforms to enable more comprehensive data analysis and decision-making. Therefore, due to its unique position between IT and OT, attackers are most likely to target the data historian and could use it as a pivot point to reach the OT network.

ICS protocols

One of the specificities of the OT environment compared to IT lies in the differences in protocols. Indeed, a whole range of proprietary and non-proprietary protocols connect communications between the various components of the ICS. One common trait of these protocols is that they are insecure by design, as when they were developed (mostly a long time ago), the primary goal was performance. Messages are transmitted in clear text for most protocols or are affected by numerous security vulnerabilities. As a result, there is a risk that anyone who penetrates the control network would be able to read or send control instructions to a controller.

Some of the most common ICS protocols include:

Modbus/TCP: Generally used for communication between equipment such as PLCs and supervisory computers or remote control devices. It is relatively simple to implement and deploy, making it a popular choice for industrial applications.
OPC: A communication protocol that allows software from different vendors to communicate with each other. There are 2 versions: OPC DA (older, unencrypted) and OPC UA (supports encryption).
DNP3: Developed for electric power distribution networks. It includes security mechanisms such as authentication, key management, and cryptography enhancement.
EtherNet/IP: A proprietary protocol developed by Rockwell Automation.
Profinet: A communication protocol developed by Siemens.
S7COMM: A protocol developed by Siemens for SIMATIC S7 controllers.

From a security standpoint, the most important thing about all ICS protocols is not to know them in detail, but rather to know the expected behaviors and traffic through a baseline in order to quickly detect anomalies on the network.

Common attacks vector to penetrate OT networks from IT

Attackers often seek to penetrate OT systems through attack vectors originating from the IT network, such as malware, phishing attacks, and system vulnerabilities. In this article, we will explore three common attack vectors from IT to OT.

Insufficient network segmentation

Flat networks are widespread in the world of OT (where air-gapped network should be), which allows attackers to move from IT to OT and vice versa. A significant portion of the attacks perpetrated in the ICS network may not necessarily be targeted and prepared for these environments. In fact, most attacks target the IT environment, and network exploration allows malware to deploy in the OT and disrupt or interrupt production, which can be easily achieved with ransomware-type malware. It is therefore essential to implement effective security measures to protect ICS systems, including network segmentation and establishing security barriers to prevent attackers from moving easily between IT and OT.

Although segmentation can be used to protect information technology and operational technology systems, there are often gaps and vulnerabilities that persist between them. This can be particularly true for historians, which are databases that serve as a gateway between the two types of systems. Unfortunately, if these historians are not properly segmented, they can become an easy entry point for attacks targeting ICS. Hackers can exploit a vulnerability in the historian’s model to gain access to the rest of the network.

Recently, Claroty’s Team82 security team demonstrated how a hacker could compromise a GE (General Electric) historian. To learn more about this attack, you can refer to their article.

Unsecured remote connections

There are several types of remote connections that are commonly used in ICS. These include:

Engineering host on the business side that accesses ICS with poorly configured VPN
Human-machine interface (HMI) through Virtual Network Computing (VNC) or Remote Desktop Protocol (RDP)
Unsecure VPN with or without credential theft from the IT side

These remote connections are often used to provide remote access for engineers, technicians, and other personnel who need to perform maintenance or diagnostics on ICS equipment from outside the control room. However, these connections can also create significant security risks if they are not properly secured.

Cybercriminals can exploit vulnerabilities in these connections to gain unauthorized access to ICS networks, which can result in severe consequences, such as the loss of production, equipment damage, or even injury to personnel. Moreover, cyberattacks on ICS networks can also cause widespread disruption and harm to critical infrastructure.

Several cyberattacks on critical ICS networks have exploited unsecured remote connections. For instance:

Triton/Trisis: In 2017, this malware was discovered targeting a Middle Eastern petrochemical plant. The hackers used an unsecured VPN connection to gain access to the plant’s ICS network and executed a malware based on a vulnerability in the plant’s safety system. The malware was designed to manipulate the safety system, which could have resulted in a catastrophic incident if it had not been detected and mitigated in time.
Ukraine Power Grid Attack: On December 23, 2015, hackers gained access to the grid’s network by exploiting a vulnerability in the grid’s VPN system, causing a blackout that left hundreds of thousands of people without electricity.

These attacks highlight the importance of securing remote connections in ICS networks.

Third parties

Industrial control systems networks are increasingly being connected to third parties such as suppliers, service providers, and maintenance companies to facilitate the exchange of information and interactions between different parties. However, this interconnectivity can pose significant risks to the security of ICS. Third parties can access the OT network through various pathways such as VPN connections, direct cable connections, energy management systems, and building management systems.

Norsk Hydro, a Norwegian aluminum manufacturer, suffered from a ransomware attack in 2019. The attack began by targeting a third-party IT service provider for Norsk Hydro, which allowed the attackers to gain access to the company’s network. Once inside, the attackers deployed ransomware that encrypted the company’s files and disrupted its production systems, causing significant financial damage.

The attack suffered by Norsk Hydro highlights the risks associated with third-party suppliers and vendors in the supply chain of industrial control systems. This underscores the need for organizations to conduct deep risk assessments of their supply chain and ensure that their third-party suppliers are duly evaluated and secured.