Cyber physical attacks to critical infrastructure (Part IV: Detecting Attacks)

Detection of cyber-physical attacks

All cyber-physical attacks exposed earlier in this technical note can be detected using a combination of technologies in network intrusion detection as deep protocol behavior inspection (DPBI) and operational correlation.

•       Aurora Attack type: After creating the DPBI pattern of normal behavior for the control network, a script that would monitor the sequence of write commands received by the RTUs in an arbitrary period of time (seconds or milliseconds) would be deployed. In the event that an order of writing CLOSE was sent to a given RTU with a previous OPEN value received, at a lower time than the allowed time interval (0.2s), we would fire an alert.

• Water hammer / discharges Attack Type: Assuming a scenario of progressive control as in Figure 2, would only be possible to reach the completely closed (or open) state for the valve from a previous state with V = 30.

Any value sent in a write command to the PLC control valves would be compared to the last write value sent. If the difference between the value of writing command and the immediately preceding received exceeded the maximum increase in programmed control (∆V = 10), an alert would skyrocket.

Additionally, all values in a command not included in the behavioral blueprint would trigger an alert. (Eg V> 40)

Remarkably, the importance of the anomaly differs depending on the detected transition and a criticality hierarchy may be established. In the example of Figure 2, the abnormal transition E3 -> E5 trigger an alert warning, while the transition anomaly E1 -> E5 trigger a critical alert.

·      Alteration of the amount of production (vinyl acetate monomer): Any value received in the write message on the PLC that controls the temperature of the reactor outside the distribution of values of the behavior blueprint would trigger an alert.

·      Attack by temperature to chemical reactors: As in the case of water hammer, any write command sent to the PLC progressive temperature control would be compared with the immediately preceding. If the difference between the value of writing and the immediately preceding received exceed the maximum temperature defined threshold, an alert would be sent

·      Fake maintenance: Send commands to the control elements in order to conceal attacks on process never would have formed part of the original behavior pattern built for the network, so any transmission of those would trigger an immediate alert.

We can summarize this in the following table:

It is important to note that the semantics needed to detect these attacks through additional programming logic comes from the deep knowledge of the processes controls and possible weaknesses of them. Based solely on deep protocol inspection (DPI) systems could not detect such attacks and it is necessary to use both DPBI and Operational correlation to detect them all.

There is another very powerful implementation of the operational correlation in detecting how allowed control operations (nodes, protocols and distribution of values) are executed on specific time frames. (A firmware update of a PLC or RTU can be normal within one business day and exceptional if done on weekends or at night).

Conclusions

The new attacks on the cyber-physical systems of industrial processes running on critical infrastructure, require the adoption of new strategies capable of detecting without interfering with normal operation.

The change in the functional structures (common Managers and multidisciplinary teams) and the procedures at critical infrastructure operators (Risk Analysis and procurement requirements), it is imperative to address this kind of physical attacks.

The only technology capable of detecting attacks from within the control network using protocols, messages and values ​​allowed within the same, but in order or frequency other than normal is the use of intrusion detection systems that support the deep protocol behavior inspection (DPBI) with the ability to implement correlation of operational events.

The implementation of these technologies in critical infrastructures control networks should be considered seriously by those responsible for the cyber security of these facilities and the authorities responsible for monitoring compliance with the PIC 8 / 2011 Act.

In the future, Sequence-aware NIDS (S-NIDS), or similar technologies, may help simplify the implementation of these systems in control networks significantly improving the behavior pattern generation and subsequent maintenance, protecting processes and cyber-physical systems on critical infrastructures.

New Detection Technologies: Ouija 2.0 takes care of Critical Infrastructure

On my last post in the CCI Blog, I described how American Water Works Association Cyber Security Framework didn’t addressed the detection Cyber Security events measures for these control systems.

Today I have seen a good tweet (as always) from our colleague Joel Langill (@SCADAhacker)  advising about a new Tripwire studyon Critical Infrastructure.  In their study they stated than “86% energy security professionals believe they can detect a breach on critical systems in less than 1 week”, and suddenly I remembered the last CCI report on Industrial Cyber Security for Spain in 2015. According to that report, these were the Cyber Security solutions deployed on those Networks:

As you can see, SIEM, log correlation, IDS and IPS technologies are not very popular on such organizations, so questions are:

•        Who has responded in the Tripwire survey? (Surely not Spanish Industrial companies)
•         If you are not monitoring cyber security events, how can you detect them?
•        Why Duqu 2.0 has been hitting ?

The only rational response to this astonishing detection rate of 86%  is …….  Ouija !!!! (Of course, version 2.0 with snmp and syslog support)

The Dragonfly campaign hangover in Spain - Almost one year after

We have good news !!!!.
After almost one year, we have less Industrial Control Systems open to Internet in Spain.

It has been a long time campaign, but may be someone has got the message and we have contributed with an awareness improvement.

Let's see how things are going in the next month.
Remember, always close the door to your SCADA !!!

Finding the needle in the Water Tank (At least, you should look for it)

Water Management Cyber Security guide from the American Water Works Association is bypassing certain critical controls on ICS Networks. 


Are we still in time in Spain to avoid this mishap? 


I know I should be looking for the needle in the Haystack, but looking for that in a Waste Water Tank is not easy either. When you have to protect Drinking & Waste Water control networks plants you should be aligned with the best practices and be national regulation complaint.

Since February 2014, EEUU deployed its Cyber Security Framework from the National Institute of Standards and Technology (NIST). In that General Framework, detection of behavioral anomalies, is recognized in the third function defined by the Framework: Detect.

Under the function Detect (DE) is the category of Anomalies and events (AE), and under this, there is one sub management categories established:

· DE.AE-1: A baseline of network operations and expected data flows for users and system is established and managed.

(The need to detect anomalies in control networks is found in the following standards: COBIT 5 DSS03.01, ISA 62443-2-1:2009 4.4.3.3 and NIST SP 800-53 Rev. 4 AC-4, AC-3, CM-2, SI-4)

   

In the Water sector and in 2014 too, AWWA deployed another Cyber Security Framework (Process Control System Security Guidance for the Water Sector). In this guide there was a Cross Reference to NIST Cybersecurity Framework, and the only two categories not addressed in this cross reference were related with cyber security events detection!!! 

   

Why is this? I don’t really know, but what I do know is that continuous security monitoring is the only way to detect any threat in your network and managed risk in a proper way. 

Now we are going to have our water sector regulation in Spain but … Are we going to forget about anomalies detection in our permanent security measures too? 

If so, we will never find the needle (or the virus) in our water tanks.

2015 Mission: Simplify Cyber Security (No more excuses, Mr CEO)

I've been in this for years and it seems like I am always living my first projects as security auditor. It is true that technology issues on the "Red Team" have improved a lot: Bad USB and other Firmware attacks, Air Gap attacks based on cyber physical systems, Ultra advanced malware evading 99% of the AV solutions, etc. But, What about the "Blue Team" (Organizations)?

In the last HP Cyber Security Report for 2015, you can read the following:

• 44% of known breaches in 2014 came from vulnerabilities that are between two and four years old
• Misconfigurations of servers as the top vulnerability in 2014

This is really a good (bad) indicator about Cyber Security awareness in organizations.
But, Why is this happening?.

If we look at other important report for 2014 from Information Week - Darkreading, we can find that most of the organizations surveyed have declared Complexity as the main concern for last year:

 1 Million Dollar question is: How they can thing patching and right configuring (hardening) is complex?

My only response to this question is they don't have security or even IT staff enough to apply the right procedures in the right manner. But if so, another question arises: Why are they not contracting Security Managed Services?
May be Mr CEO thinks this is very expensive and complex, but I will try to explain my approach to him in the next posts.

Chinese Spies are retiring: Spanish Waste & Drinking Water services don't need them

Industrial Control engineers do their work for them Critical Infrastructure protection law is being deploying in Spain and new essential sectors will be covered this year. One of those sectors is Water and I have began to study that sector in depth. My first findings are amazing and I will talk about them in my next posts.

This week I will show you how things have changed with social networks in these last years. Nowadays, everyone seems to find for celebrity through social network presence: Facebook, Twitter, LinkedIn and any other platform that let you show to the entire world how cool you are. (By the way, you could think this is what I am doing, but this is just Cyber Work).

Making some Internet spidering on Waste water plants around Spain I have found some "funny" staff.

In one SCADA control engineer personal blog I have found his complete CV describing all the projects he has been working in through his career. This is not bad by itself but when deep description on SCADA plant systems is present, it is getting worse....

Information you can find there is:

• Plant Name and location
• Automation elements description:
• SCADA application redundant systems (Schneider Electric Monitor Pro)
• 3 Telemecanique Unity devices (MODICOM PLCs)
• Other PLC to control engines
• Ethernet interconnection between them and a Modbus Gateway
• Interconnection Diagram
• Advantsys I/O modules 

Sure you can find many plants worse documented than this !!!!

Awareness is something we have to improve in the next months if we want to get a better Security Level in our critical infrastructure.

In the meantime, no Chinese spies required ......

New threats, Old vectors

In the last weeks I have been making some presentations on different Cyber Security Events in different Cities and with different attendants, but there is always a common question in all of them:

- "Can you talk us about the new Threats?".

My response is always the same:

- "Don't you have enough with the old ones?"

I understand people can be worried about all Cyber espionage, Cyber Crime, Cyber attacks campaigns, but at the end of the day everything remains the same: "Nobody reads the F#@ Manual".

When talking about Dragonfly we have been dealing with old attack vectors:

• Phising
• Compromising vulnerable Web Sites

Nothing new in these attacks. Nothing a good awareness policy can't stop. Nothing a basic OWASP compliance test can not detect. Nothing has been done in those organizations in the last years on the security posture.

In the last 8 ENISE congress, some representative from the NATO Security Network Area was describing the top attacks NATO was registering, and surprisingly they were: Phising and DDOS.
May be the malware associated with the phising campaigns is more sophisticated (on the second round), but there must be always someone who press the attach link to activate the malware.

Why don't we stop the old attack vectors before proceeding to the new threats defenses ?