ICS or Industrial Control System networks are integral to running our critical infrastructure, industrial and manufacturing processes, hospitals.  These are specialized systems that have been kept separate or “air gapped” from main networks, but that has been changing over the past few years as everybody finds ways to get connected. However, a mindset persists that because these systems are “special” and “different”, and because they have been segregated from conventional networks for so long, they are inherently protected. This past week heralded the discovery of “Irongate”, customized malware for ICS that is still in the testing stages and has not been used against production facilities – yet. The fact that somebody has carried on from where Stuxnet left off is a warning to us all that our assumptions on what keeps us secure no longer apply.

Stuxnet showed us that specialized systems offer attackers, especially at the nation state level, a unique opportunity for this reason. Nobody is looking when they think they are secure. The fact is that attackers live within our networks for long periods. We have seen this proven in recent months through the rapid escalation of ransomware and lateral movement through networks to accumulate info and destroy data; in the attack on the power grid in the Ukraine where attackers harvested credentials to access the VPN and get into supposedly secure systems; and the SWIFT banking heists where attackers learned the most intricate details of how to manipulate printer outputs and redirect huge monetary transactions.

‘Airgaps’ are great in theory, but don’t hold up given the growing reality of the Iot and now the IIoT. With pressures to cut costs, increase productivity, and just make things easier, these systems are being connected to corporate networks and the “Cloud”. There’s a whole lot of scary here because the truth is that ICS systems are not well monitored. Experts like Chris Sistrunk and Robert M. Lee have made this pointedly clear in emphasizing the need for NSM, network system monitoring and DFiR, digital forensics, to look for what attackers leave behind.  You can’t find the danger if you aren’t looking.

While the big announcement of Irongate was this week, researchers actually found samples late 2015, and reports show that the malware can be dated as far back at 2012, and was submitted to VirusTotal through the web interface in Israel in 2014. There is no evidence of this having been used in any campaign, nor is it associated with known threat actors.  Siemens ProductCERT confirmed that “the code would not work against a standard Siemens control system environment”. As it stands, it is not proof-of-concept for an actual weapon or adversary. Yet, the code was found when searching for droppers compiled with PyInstaller; Irongate droppers are Python scripts converted to executables from that same software. Somebody saw the need to make this, and the opportunity for exploit.  We need to read into that and act on it before it moves from test to production.

According to Robert M. Lee,

“ICS is a viable target and attackers are getting smarter on how to impact ICS with ICS specific knowledge sets… The unique nature of ICS offers defenders many advantages in countering adversaries but it is not enough. You cannot rest on the fact that ‘ICS is unique’ or ‘ICS can be hard to figure out’ as a defense mechanism. It is a great vantage point for defenders but must be taken advantage of or adversaries will overcome it.”

Right now, there is a lot of speculation around why this exists in test, without a known contributor. Dan Scali, senior manager for FireEye Mandiant ICS Consulting, posits “Is someone trying this in a simulated [environment] before taking it to a production environment? Or is it a researcher saying ‘look what I can do … a Stuxnet-type thing?”

Robert M Lee expressed concern that this illustrates a fundamental security problem with ICS/SCADA. “It’s a sign of the interest in this by pen testers, security companies, as well as adversaries…I am not confident that a majority of the industry could respond to it. We don’t know what’s out there; antivirus companies aren’t finding it and even if they had, who would know what to do with it [the threat]?”

If we’re not looking, we’re not finding. And we won’t be able to prepare for attacks which are already in the works. We would be foolish to think otherwise.

This argument is made by Lior Frenkel, CEO of Waterfall Security.  He expects attacks similar to Stuxnet “are in the pipeline”.

“these attacks will increase in their sophistication and complexity so any solution needs to be completely comprehensive and robust to cover the full perimeter of an ICS site … (adding that) unidirectional gateways are the optimal solution for these attacks”.

Add to that this assertion by Sean McBride, attack synthesis lead for FireEye iSIGHT Intelligence: “I would not be surprised to see sandbox evasion and file replacement attacks incorporated by future ICS malware deployed in the wild.” This is yet another wakeup call for ICS SCADA, and other sensitive segregated systems.

Irongate is

• sophisticated,
• has the capacity to be persistent,
• is evasive
• undetected by AV
• introduces new features to existing knowledge of customized ICS malware.

The key feature is a man-in-the-middle (MitM) attack, where the malware replaces existing DLL (Dynamic Link Library) files with malicious ones, enabling it to come between a PLC and legitimate monitoring software to engineer the next step. Like a scene from a movie, where the security camera footage is manipulated, the malicious DLL records five seconds of ‘normal’ traffic from a PLC to the user interface. This “footage” goes on replay while other data gets sent back to the PLC. Hence an attacker can alter a controlled process without alerting the process operators.

Causes for concern should be:  this malware was undetected by AV, even though some strings had the word “dropper” and there was an actual module named scada.exe; the malware is evasive, and will not run if it detects the use of VMware or Cuckoo Sandbox environments – something Stuxnet could not do.

Although Irongate is not as complex, the similarities to Stuxnet stand out:

• Both types of malware search for a single, highly specific process.
• Both replace DLLs to manipulate processes
• Both are evasive. IRONGATE looks for sandbox or VMware that allow observation of malware; Stuxnet sought out antivirus software.
• Both manipulate process data. IRONGATE actively records and plays back to conceal it manipulations however.

A key difference is that unlike Stuxnet, “Irongate has no worm-like spreading function, nor any apparent ties to nation-state actors”.

Recommendations on how to secure against this latest variant of ICS malware include integrity checks and code. But it really comes down to following through on best practices and those areas already identified as weak. The problem is that what we’ve been doing will fail us going forward, and we’re failing at doing the basics right. Know your baselines and actively look for anomalies. NSM needs to happen, as does DFiR within ICS, comprehensively and without further delays and excuses. Otherwise, we are turning a blind eye to attackers who know these systems better than we do.

This latest variant of customized ICS malware may be in the testing stages as we found it. But you can bet if someone else is working on this, things have already moved toward production and deployment. Irongate is yet another major wakeup call and we can’t keep hitting the snooze button.

Resources:

https://www.fireeye.com/blog/threat-research/2016/06/irongate_ics_malware.html

https://www.helpnetsecurity.com/2016/04/13/ics-network-attacks/?utm_content=buffer3b349&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer

http://www.darkreading.com/threat-intelligence/shades-of-stuxnet-spotted-in-newly-found-ics-scada-malware-/d/d-id/1325753

https://www.helpnetsecurity.com/2016/06/03/ics-focused-irongate-malware/