11 March 2017
Part II: Some thoughts on the access vector
For preparation of the attack the attacker had to gain in-depth knowledge about the victim’s network and SIS installation.
SIS installation
According to Schneider Electric such attack could only be successful for Triconex Tricon controllers configured with the model 3008 Main Processor and firmware versions 10.0 to 10.4.(1) Only this controller family seems to use PowerPC processors. Older Tricon controllers use National Semiconductor, newer systems use ARM processors.(2)
Since the binary malware components inject.bin and imain.bin were compiled in PowerPC byte code the attacker hat detailed knowledge about the installation, in particular the controller version. Without this knowledge about the controller version the attack would have failed because of a code mismatch.
Network
If the SIS controller and engineering station are operated in an isolated SIS network this attack is not possible. For remote control, the Remote Access Trojan (RAT) needs to open at least an outgoing connection to its Command and Control server (C&C) outside the production network.
Blocking incoming traffic to SIS network but allowing outgoing traffic from the SIS network to applications, e.g. a historian, in other production network partitions is industry standard (ISA-99). Unfortunately, the latter recommendation is often misunderstood. Instead of opening only connections to dedicated systems / ports in adjacent partitions the security devices are often opened for all outgoing network traffic, sometimes across partitions.
With this, once the RAT is installed on the engineering station a weak implemented industry standard fosters the connection with the attacker’s C&C server.
Attack vector: Compromised Supply Chain
At first sight this sounds like a bad thriller. But it gives some good answers to some important questions.
How did the attacker get the knowledge of the victim’s facilities?
- In-depth knowledge of the plant network and the SIS installation can be extracted from documentation stored on the plant operators computer systems or on the Engineering Service Providers (ESP) computer systems.
- An ESP network is in general less well protected against cyber-attacks than a highly secured production network.
Conclusion: It is very likely that the attacker compromised the ESP network and the systems used for developing the SIS software.
How could the attacker develop such mature code?
Once the attacker hijacked the ESP network he was able to develop and test his attack framework on a system very similar to the production SIS.
How was the SIS network / engineering station infected?
With the next project update the ESP transferred the compromised code, e.g. by USB stick, to the production network.
Have a great week.
- Hand A. Triton Gone Wild | Automation World [Internet]. Automation World. 2018 [cited 2018 Mar 3]. Available from: https://www.automationworld.com/triton-gone-wild
- Analyzing the TRITON industrial malware [Internet]. Midnight Blue Labs. 2018 [cited 2018 Mar 5]. Available from: https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware
IT Security Matters 