“ClearEnergy” May Have Been Fake News, But Threats Against ICS / SCADA Security Are Quite Real
Accusations of “fake news” rocked the cyber security industry last week after infosec provider CRITIFENCE implied that it had detected a brand-new “in the wild” ransomware variant called ClearEnergy that posed a clear and present danger to ICS and SCADA security.
Bleeping Computer reports:
After the publication of an article in Security Affairs called "ClearEnergy ransomware aim to destroy process automation logics in critical infrastructure, SCADA and industrial control systems," security researchers used Twitter to bash the company for what they felt were lies about real world attacks, the company orchestrating a media stunt, and not releasing any research they could vet.
After being mercilessly hammered on Twitter, CRITIFENCE engaged in furious backpedaling, claiming that the company had “[forgotten] to mention [that ClearEnergy] was only a proof-of-concept ransomware, and promised to release more details in the upcoming days.”
However, it turned out that this particular fake news story contained a rather important kernel of truth; Bleeping Computer reports that “two security flaws CRITIFENCE discovered are real and have resulted in a patch from Schneider Electric, the PLC vendor whose products are affected.”
The ClearEnergy debacle does not negate the fact that ransomware and other cyber attacks against the government and critical infrastructure are skyrocketing, and ICS and SCADA security is in bad shape, putting our nation’s critical infrastructure at risk.
Government Organizations Besieged by Ransomware
Ransomware attacks are most commonly associated with the healthcare industry, but in reality, educational institutions are the most frequent ransomware targets, followed by the government, with healthcare in third place. Ransomware attacks against government facilities are growing rapidly, having
tripled over the past 12 months. In one recent attack, hackers
breached the emergency warning system in Dallas, Texas, causing 156 warning sirens to begin blaring in the middle of the night and panicking residents, who flooded the city’s 911 centers with calls.
There’s no reason to think that hackers cannot or will not target the SCADA networks and other industrial control systems used by utility and transportation organizations, other critical infrastructure providers, and even automation systems for “smart” buildings.
In fact, it’s already happened.
•
The Stuxnet virus, believed to have been developed and unleashed by U.S. and Israeli spies, disabled the Natanz nuclear facility in Iran.
•
A Ukraine power company’s SCADA network was attacked shortly before Christmas in 2015, knocking 30 substations offline and plunging 230,000 residents, as well as the utility company itself, into the dark.
•
A U.S. federal indictment handed down in 2016 accused a team of hackers with ties to the Iranian government of repeatedly breaching the SCADA system at a dam in New York State.
• In 2008, a teenager
breached the SCADA system at a train station in Lodz, Poland, derailing four trains. The teen told the authorities he had launched the attack because he was “bored.”
SCADA Security Can No Longer Hinge on Obscurity and Isolation
ICS and SCADA networks were first introduced in the 1960s, and some organizations are still running legacy systems that date that far back. They suffer from the same problem as ATMs and electronic voting machines: Because their design pre-dates the internet, they were built with functionality, safety, and efficiency in mind, but not cyber security. When threats of cyber crime emerged, it was assumed that SCADA systems were inherently safe because of “security through obscurity” and “security through isolation.” Some SCADA equipment is not continuously connected to the internet (isolation), and most systems use proprietary interfaces and specialized protocols that aren’t widely known (obscurity).
The problem with hinging security on obscurity and isolation is that the internet has rendered both of these “protective” measures obsolete. While industrial control systems and protocols may be obscure, they are far from impossible to research; after all, a bored teenager managed to figure it out. A determined cyber terrorist can also enlist the help of a malicious insider or use spear phishing or another social engineering scheme to take advantage of an unwitting employee. Isolation cannot be counted on because all SCADA equipment must periodically be connected to the internet, or at least to a flash drive, for brief periods to send and receive information or download updates.
Eventually, a terrorist will hack a SCADA system at a power plant, a train station, or another part of the nation’s critical infrastructure, possibly as part of a larger terrorist attack. Public and private sector agencies must work together to proactively secure industrial control systems and ensure they meet the highest levels of cyber security.