Slashdot Mirror
Mysterious Safety-Tampering Malware Infects Second Critical Infrastructure Site (arstechnica.com)
An anonymous reader quotes a report from Ars Technica: Sixteen months ago, researchers reported an unsettling escalation in hacks targeting power plants, gas refineries, and other types of critical infrastructure. Attackers who may have been working on behalf of a nation caused an operational outage at a critical-infrastructure site after deliberately targeting a system that prevented health- and life-threatening accidents. What was unprecedented in this attack -- and of considerable concern to some researchers and critical infrastructure operators -- was the use of an advanced piece of malware that targeted the unidentified site's safety processes. The malware was named Triton and Trisis, because it targeted the Triconex product line made by Schneider Electric. Its development was ultimately linked to a Russian government-backed research institute.
Now, researchers at FireEye -- the same security firm that discovered Triton and its ties to Russia -- say they have uncovered an additional intrusion that used the same malicious software framework against a different critical infrastructure site. As was the case in the first intrusion, the attackers focused most of their resources on the facility's OT, or operational technology, which are systems for monitoring and managing physical processes and devices. The discovery has unearthed a new set of never-before-seen custom tools that shows the attackers have been operational since as early as 2014. The existence of these tools, and the attackers' demonstrated interest in operational security, lead FireEye researchers to believe there may be other sites beyond the two already known where the Triton attackers were or still are present. "After establishing an initial foothold on the corporate network, the Triton actor focused most of their effort on gaining access to the OT network," FireEye researchers wrote in a report published Wednesday. "They did not exhibit activities commonly associated with espionage, such as using key loggers and screenshot grabbers, browsing files, and/or exfiltrating large amounts of information. Most of the attack tools they used were focused on network reconnaissance, lateral movement, and maintaining presence in the target environment."
Now, researchers at FireEye -- the same security firm that discovered Triton and its ties to Russia -- say they have uncovered an additional intrusion that used the same malicious software framework against a different critical infrastructure site. As was the case in the first intrusion, the attackers focused most of their resources on the facility's OT, or operational technology, which are systems for monitoring and managing physical processes and devices. The discovery has unearthed a new set of never-before-seen custom tools that shows the attackers have been operational since as early as 2014. The existence of these tools, and the attackers' demonstrated interest in operational security, lead FireEye researchers to believe there may be other sites beyond the two already known where the Triton attackers were or still are present. "After establishing an initial foothold on the corporate network, the Triton actor focused most of their effort on gaining access to the OT network," FireEye researchers wrote in a report published Wednesday. "They did not exhibit activities commonly associated with espionage, such as using key loggers and screenshot grabbers, browsing files, and/or exfiltrating large amounts of information. Most of the attack tools they used were focused on network reconnaissance, lateral movement, and maintaining presence in the target environment."
I know it is inconvenient, but these sites should not be connected to the Internet.
The truth is that all men having power ought to be mistrusted. James Madison
There's no proof Russia had anything to do with it. Just wild speculation from leftist conspiracy theorists.
Slashdot needs some scientific facts like from AE911Truth Org
Is it me, or is this language extremely bland, featuring huge bubbles full of... nothing? As from a sci-fi text written by someone who has no clue of sci or tech?
The solution to the problem is likely physical network connections between remote sites that include authentication, monitoring, and encryption (in the case the physical line is compromised) and dedicated devices that do not have support for outside input other than keyboard and mouse. There is likely no real need to open up critical infrastructure to the internet or other networks that may be connected to the internet. By utilizing dedicated devices you close down access via remote vulnerabilities. Now your opponent needs some sort of physical access at specific points to tap into your network and that can be more easily monitored. If an employee needs access at home for instance to 'critical' and remote infrastructure he'll have it. I can imagine the need for this at destinations where there may not be 24/7 on-site staff and dedicated security (like infrastructure in a more rural area).
Like those Iranians and their centrifuges. Really it looks like between election tampering and cyberattacks Russia is aiming to start world war three.
First Strike: Stuxnet
(captcha: shutdown)
One, that is modern and feature-rich, and a second one that is very simple, maybe even analog, well-understood, reliable systems which will provide protection when the main system isn't working.
I'll use brakes in trains as a comparison:
You can have a modern system where automated train controls can cause the train to speed up or slow down, but you still have 19th century air brakes connected to some very simple but very reliable sensors. These sensors would detect "critical" things like the train moving too fast around a curve or moving too fast downhill, among other things. If the air-brake line is damaged and loses pressure, the train stops. If any of the simple sensors detect a problem, the trains stops. To get the train going again, a human being has to go to the train and fix the problem with the air brake system or manually reset the sensors.
Apply this design philosophy to any system where you absolutely positively do not want certain bad things to happen without corrective action being taken and/or an alarm sounding, and you'll have at least some minimum level of safety even when your modern technology fails or is compromised.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
We are already 16 comments in and it is clear slashdot readers are uninformed and don't even keep up with the issues.
False flag or not, your gas prices are going up.
Have gnu, will travel.
Is it MS Windows? The JS code of Google and Facebook?
“Sixteen months ago, researchers reported an unsettling escalation in hacks targeting power plants, gas refineries, and other types of critical infrastructure.”
Then what the heck is this critical infrastructure even doing connected to the public Internet?
It's 2019, why the F*CK are ANY systems designated as critical infrastructure still connected to the GD internet.
Lease a private line FFS and air-gap the head end systems.
Yes, it's expensive.
Yes, it's not very convenient.
Yes, it's NECESSARY.
GDMIT.
Until we start throwing CEO's in prison for significant amounts of time when their incompetence results in epic level WTF, this sh*t will never get fixed.
It seems that every malware article goes out of the way to avoid using the word WINDOWS. In practically every reported instance of remote infection, the initial vector is WINDOWS.
Regarding Triton:
Security firm Symantec said that Triton has been active since August and works by infecting a Windows computer attached to the safety system. It said: “While there have been a small number previous cases of malware designed to attack industrial control systems (ICS), Triton is the first to attack safety instrumented system devices.”
https://www.theguardian.com/technology/2017/dec/15/triton-hackers-malware-attack-safety-systems-energy-plant
It's Russia again. Just when Russia was finally out of the headlines. Color me shocked. Call me when you have more proof than all the last times it was supposed to be Russia.
Seven puppies were harmed during the making of this post.
software to monitor for east-west traffic pivot movements and you will be saved.
Nothing more than a product advertisement wrapped in scary BS ...
Hardware safety relays are a a thing. Less flexible and maybe less reliable, but they're there.
I'm very strange to hear such things in the news. Didn't the loud hacker attacks of recent years teach you anything? Even the simplest avira review can help protect the system to the average user. Why do they forget about elementary network security on such a scale?