A recent joint Cybersecurity Advisory (CSA) from the United States government has warned that advanced persistent threat (APT) actors (cybercriminals) have developed a way to gain full system access to multiple industrial control systems (ICS) and supervisory control and data acquisition devices (SCADA), targeting specific models of programmable logic controllers (PLCs) manufactured by Schneider Electric and OMRON.
“The initial targeting appears to be liquid natural gas and electric community specific,” said Robert M. Lee, CEO at Dragos, an industrial cybersecurity firm Dragos, one of the organisations which contributed to the CSA. “However, the nature of the malware is that it works in a wide variety of industrial controllers and systems. The malware initially targets Schneider Electric and Omron controllers, however there are not vulnerabilities specific to those product lines.”
“Make no mistake, this is an important alert from CISA. Industrial organizations should pay attention to this threat,” said Tim Erlin, VP of strategy at Tripwire, in a report by IndustryWeek. “It’s important to note that while this alert calls out tools for gaining access to specific industrial control systems, there’s a bigger picture threat that involves more of the industrial control environment.”
Specific Cyberthreats
According to the CSA, cybercriminals have developed custom-made tools to specifically target the machines. Then the modu operandi is similar to the earlier ones. Once the machines are compromised, the cybercriminals can upload malicious code, modify device parameters, and back up device contents, among other things a company does not want to have to deal with.
Practical concerns for the Schneider Electric devices in question include losing the ability to connect your network to the PLCs; severing connections to prompt re-connects that require entering credentials that the cybercriminals may then steal; and crashing PLCs outright until they are restarted and recovery operations are completed.
For OMRON devices, cybercriminals may install hostile software to further enable new attacks; back up and restore files to and from the PLC; and outright issue commands to the PLC to manipulate files and capture data. Cybercriminals have also developed a tool to exploit a known vulnerability in a specific ASRock-signed motherboard driver.
The tool adds malicious code to Windows systems, opening the door for cybercriminals to move into general computer networks and wreak havoc in IT or OT environments. Also, the CSA has cited fresh vulnerabilities for servers running Open Platform Communications Unified Architecture (OPC UA).
Counter Strategies
The CSA includes numerous strategies to mitigate risk before cybercriminals have a chance to attack the industrial systems in question, including multi-factor authentication, changing passwords often and making them strong, and closely monitoring any machines cited as being under particular threat. The CSA also provides a plentiful list of more advanced preventative actions for IT professionals.
“Attackers need an initial point of compromise to gain access to the industrial control systems involved, and organizations should build their defenses accordingly,” added Erlin. “The joint advisory recommends isolating affected systems, as well as employing endpoint detection, configuration and integrity monitoring, and log analysis. This isn’t a matter of simply applying a patch.”
