Compromising Industrial Safety Systems
Hackers who were most likely working on behalf of a nation-state recently invaded the safety system of a critical infrastructure facility in a watershed attack that halted plant operations, according to cyber investigators and the firm whose software was targeted.
FireEye Inc disclosed the incident on Thursday, saying it targeted Triconex industrial safety technology from Schneider Electric SE.
Schneider confirmed that the incident had occurred and that it had issued a security alert to users of Triconex, which cyber experts said is widely used in the energy industry, including at nuclear facilities, and oil and gas plants.
FireEye and Schneider declined to identify whom the victim was, or the industry or location of the attack. Cyber-security company Dragos said the hackers targeted an organisation in the Middle East, while a second firm, CyberX, said it believe the victim was in Saudi Arabia.
It marks the first report of a safety system breach at an industrial plant by hackers, who have in recent years placed increasing attention on breaking into utilities, factories and other types of critical infrastructure, cyber experts said.
Compromising a safety system could let hackers shut them down in advance of attacking other parts of an industrial plant, potentially preventing operators from identifying and halting destructive attacks, they said.
Safety systems “could be fooled to indicate that everything is okay,” even as hackers damage a plant, said Galina Antova, co-founder of cyber-security firm Claroty.
“This is a watershed,” said Sergio Caltagirone, head of threat intelligence with Dragos. “Others will eventually catch up and try to copy this kind of attack.”
Remote Control of safety systems
“In the incident, hackers used sophisticated malware to take remote control of a workstation running a Schneider Electric Triconex safety shutdown system, then sought to reprogram controllers used to identify safety issues. Some controllers entered a fail safe mode, which caused related processes to shut down and caused the plant to identify the attack” FireEye said.
“FireEye believes the attacker’s actions inadvertently caused the shutdown while probing the system to learn how it worked” said Dan Scali, who led FireEye’s investigation.
“The attackers were likely conducting reconnaissance to learn how they could modify safety systems so they would not operate in the event that the hackers intended to launch an attack that disrupted or damaged the plant” he said.
Analysts note that though Triton should serve as a wakeup call in the industrial control community, its existence should not come as a surprise. “The position that this is the first instance of targeting [certain] engineering and physical infrastructures is at best an assumption” says Jeff Bardin, the chief intelligence officer of the threat tracking firm Treadstone 71, which monitors nation state hacking around the world, particularly in the Middle East. “Just because you just now discovered it does not mean this is the first time. Controller software has flaws across the spectrum.”