Slashdot Mirror
Researchers Create An Undetectable Rootkit That Targets Industrial Equipment (bleepingcomputer.com)
An anonymous reader quotes Bleeping Computer: "Two researchers presenting at the Black Hat Europe security conference in London revealed a method of infecting industrial equipment with an undetectable rootkit component that can wreak havoc and disrupt the normal operations of critical infrastructure all over the world. The attack targets PLCs (Programmable Logic Controllers), devices that sit between normal computers that run industrial monitoring software and the actual industrial equipment, such as motors, valves, sensors, breakers, alarms, and others."
Researchers say they packed their attack as a loadable kernel module [PDF], which makes it both undetectable and reboot persistent. The attack goes after PLC pin configurations, meaning the PLC won't be able to tell which are the actual input and output pins, allowing the attacker full-control to make up bogus sensor data, send fake commands, or block legitimate ones.
The researchers acknowledge that the attack is extremely complicated, but the article argues it would still be of interest to a state-sponsored actor.
Researchers say they packed their attack as a loadable kernel module [PDF], which makes it both undetectable and reboot persistent. The attack goes after PLC pin configurations, meaning the PLC won't be able to tell which are the actual input and output pins, allowing the attacker full-control to make up bogus sensor data, send fake commands, or block legitimate ones.
The researchers acknowledge that the attack is extremely complicated, but the article argues it would still be of interest to a state-sponsored actor.
I'm guessing you didn't read the.... oh, never mind. This is Slashdot, what am I thinking?
File under 'M' for 'Manic ranting'
At some point, anyone bent on malicious programming _wants_ to be detected -- when the payload does whatever malice intended. Before then, it wants to hide. Loadable kernel modules are a good way to hide, but not perfect. It might be detected by network activity (gotta love those lights) or power consumption (machine not sleeping). Both AFAIK still major detection mechanisms for all intrustions.
But LKM are a known security risk, and can be turned off in Linux. Easy with known hardware. At one time OpenBSD did not allow LKM.
Some of us are old enough to remember PLC that worked fine by themselves, not needing to be hooked to any other "computer". Maybe we need to start thinking about making things simpler again, where it makes sense, for reasons of security, robustness and even longer life of the equipment.
The difficulty of messing with industrial equipment is not how to mess with the software, but in how to get access to it in the first place. These days most newer machines don't actually have a physical PLC(unless you count safety plc that only handles the safety), instead they run a soft plc on a PC, generally side by side with windows using VT-x. Once you have access to such a machine messing with it is really not hard at all.
Nonsense. I long ago developed non-detectible malware, but I can't prove it because you can't detect it.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
> At some point, anyone bent on malicious programming _wants_ to be detected -- when the payload does whatever malice intended.
Not at all. Espionage is a clear example. Surely the target will notice when their ship gets blown up, but you don't want them to know it was due to espionage, much less computer, and certainly you don't want them to know WHICH computers you have compromised.
With industrial control specifically, you may want to make the final device fail, perhaps have an ICBM explode at launch, but you don't want them to know that it failed because you've caused their CNC machine to cut a slot to have wider clearance than specified.
'Majid Hashemi : Avanade, a Microsoft / Accenture joint venture'
From billg:
To: mhashemi:
Cc: a.abbasi:
Msg: "Please write a report on Linux PLC malware so as to distract from the curent Microsoft Windows phishing/malware/virus infestation on the Internet."
Is there any other kind of rootkit except the undetectable kind. It's interesting that in that entire document they managed to mention Raspberry Pi 13 times, Linux 5 times and Microsoft Windows not at all.
This reminds of the old engineering saying "good, fast, cheap - pick any two". Only in this case it's "complex, configurable, secure - pick any two". If you want security then you either forego complexity, (so the device can't do a lot, plus all the combinations and permutations of its behaviour can be understood and determined in advance, plus its attack surface is correspondingly smaller), or you forego configurability, (meaning functionality is set in wires or DIP switches or ROM, not by software that can be altered).
Such complex and versatile systems, (such as the Internet), simply can't be protected adequately, unless they're disconnected from the outside world and therefore lose most of their advantages. What comprises solid protection today, probably won't tomorrow. We need to find ways of mitigating damage and recovering quickly; we can't rely on thwarting malicious hacking, because that's simply not possible in the long term. This applies equally to crappy consumer grade IoT gear and hardened SCADA systems. Yes, a good SCADA system is, (or should be), harder to compromise; but usually the payoff is commensurately bigger.
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
How does the "persistent over reboots" part work? I haven't read the whole paper, but a search for "reboot" or related terms returns nothing.
My first program:
Hell Segmentation fault
They've found a cheap PLC they can exploit. Buy a decent PLC and you have a fair shot against something like this.
I was a PLC monkey (still am) when Stuxnet was new. Shortly afterward I watched one of my Clients, an automation manufacturer with a fairly decent market share migrate their critical products to signed firmware. Controllers, ethernet bridges, and industrial switches to start with, but it continues--there's signed firmware options for more and more of the available products.
You buy the products from an authorized reseller with unsigned firmware (if it's available) and if you want signed, you can flash it yourself.
After that, there's no going back--from that point forward you can only flash signed firmware from the mfr.
You can still put bad things in the user code, but such is the nature of user programs. Those can be signed, fingerprinted, and locked too.
Of course none of that is "proof against" attackers, but a real PLC should certainly not be as vulnerable as an embedded controller from a terminal block manufacturer.
These Wago units run about 500 bucks. You can get cheaper units with built-in I/O from new places like plcdirect, or used from radwell.
Heck, if you've got some patience you can get a "PLC" from aliexpress for less than fifty bucks. Won't have Ethernet, though.
If I delivered a project to a Client built around any of that stuff, they would *not* pay me; they'd sue me.
It's going to cost you around $2K (depending on your multiplier, of course...) to get a modern micro PLC with included I/O from a real automation company--trust ain't cheap.
"Reality is that which, when you stop believing in it, doesn't go away." - Philip K. Dick
Adding security could be done of course, and perhaps there are things to be done that should be. But for the majority of deployments total security adds complexity to protect against a threat which is extremely unlikely to ever happen. If you want to protect your PLCs from being tampered with, there is a far simpler solution - buy a big secure cabinet and a big padlock. If you're super paranoid, fill any firmware update slots with epoxy.
As the article mentions, this would likely need a nation state sponsor.
This attack is unfocused. The attacker probably has no idea what the individual IO points mean or do.
The attack would be only to destroy.
That's an Act of War.
You're next move Dr. Strangelove?
I write industrial control software. Most of my customers don't have their process control computers accessible, except as needed. As for IO points, at least with what I work on, each system is unique.
Of course this is detectable. If it is loaded into the PLC persistently, then you can find it via a JTAG read and compare. If not, you can detect it during load.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.