Reassessing the 2016 CRASHOVERRIDE Cyber Attack
•
2 likes•448 views
Upon discovery and initial analysis in mid-2017, audiences primarily viewed CRASHOVERRIDE as a disruptive event targeting electric utility operations in Ukraine. Similar to the 2015 attack in the same area, CRASHOVERRIDE interrupted the flow of electricity by manipulating ICS equipment and delayed recovery operations to prolong the impact. However, CRASHOVERRIDE’s immediate effects represent only the precursors for an attempt at a more ambitious attack than what was achieved. In this presentation, Dragos Principal Adversary Hunter Joe Slowik reexamines the CRASHOVERRIDE event and likely attacker intentions, highlighting how CRASHOVERRIDE attempted a different type of attack than 2015. Viewers learn how to begin developing and deploying the required visibility, resilience, and response measures needed to cope with an attack like CRASHOVERRIDE. To view the webinar, go here: https://youtu.be/yX0ZSu_rVc0
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Reassessing the 2016 CRASHOVERRIDE Cyber Attack
Similar to Reassessing the 2016 CRASHOVERRIDE Cyber Attack (20)
More from Dragos, Inc.
More from Dragos, Inc. (8)
Recently uploaded
Recently uploaded (20)
Reassessing the 2016 CRASHOVERRIDE Cyber Attack
- 1. Joe Slowik / @jfslowik Dragos, Inc. | September 2019
- 4. ➢ ➢ ➢ ➢
- 6. Penetrate ICS, place malware on computers communicating to field devices Schedule malware execution to open breakers at target transmission site Perform a limited wipe and system disabling event on infected machines Target protective relays with DoS exploit post- attack*
- 8. Attack Operations • 2015: Manual interaction with control systems • 2016: Interactions encoded in malware* Attack Impact • 2015: Disrupt electricity distribution, inhibit recovery • 2016: Disrupt electricity transmission, inhibit recovery, attempt to impact protection systems Attack Success • 2015: • 3 distribution companies • 225k customers • Several hours • 2016: • Single transmission/distribution site • <225k customers • Approx. 1-2 hours
- 9. Targeted hundreds of RTU’s for state manipulation Most seemed to not respond or communication not work Impact far smaller than intended
- 11. • Serial-to-ethernet firmware modification • Killdisk wiper deployment on workstations, HMIs 2015 • File and service wiper on impacted SCADA workstations • Attempted protective relay DoS 2016
- 12. Based on 2015 response, attacker knew Ukrainian operators would enter “manual operations” quickly… So system wipe seems non-sensical to prolong outage, just makes long-term recovery more painful And what’s the point of the Siprotec DoS…
- 14. Output Validation • Manufacturing tolerances • Product quality • Product consistency Long-Term Operations • Process control and understanding • Maintenance, upkeep, and modification Safety • Integrity is vital to reliability which enables safety • Unsafe processes are non-functional processes
- 15. ICS Attack Turn off the power Blow up the plant Destroy centrifuges
- 16. ICS Attack Degrade process in hard- to-diagnose fashion Introduce defects or lack of reliability Undermine process safety
- 18. Create hazardous situation for personnel and equipment Induce islanding among affected substations Create pre-conditions for a possible AURORA-like impact on reconnect
- 20. Create large-scale transmission outage • Timing coincides with 2015 event • Pressures utility to restore ASAP Wiper event products loss of view, loss of control • Wiper delays restoration • More importantly degrades visibility into SCADA DoS SIPROTEC Protective Relays • Remove transmission protection on de- energized line • Loss of view makes this difficult to ascertain Anticipate rush to physical restoration • Create conditions for overcurrent event • SIPROTEC DoS results in physical damage
- 22. Create Large-Scale Transmission Outage Anticipate Rush to Recovery Induce Loss of View into ICS Environment Remove Line Protection via Protective Relay DoS Service Restored on Unprotected Lines Induce Immediate Overcurrent or Wait for Eventual Line Fault
- 23. Unprotected Transmission Line Reconnected Overcurrent results in overheating and hardware damage or degradation Failure to fault or disengage line produces unsafe situation Physical equipment damaged requiring lengthy repair or replacement
- 24. Improper Protocol Communication • Hundreds of devices targeted – few impacted • ICS protocol implementation incorrect in various instances • Ignored stateful communication requirements SIPROTEC DoS Implementation • DoS properly designed • Target addresses hard-coded in malware • Improper socket creation resulted in incorrect addressing
- 26. Impossible to completely know ELECTRUM intentions absent effects Physical protection systems and redundancies may reduce impact Same scenario could play out very differently in other systems
- 27. Integrity attacks undermine confidence in process while potentially producing impact Delayed direct impact can produce effects at time of adversary choosing Immediate direct impacts are least flexible and likely to scale
- 29. Process Manipulation Manufacturing Operations Electric Generation and Distribution Oil & Gas Production
- 30. • Target equipment and process safety • TRISIS-like attacksSafety • Undermine ability to protect personnel and equipment • CRASHOVERRIDE-like DoSProtection • Impact frequency consistency to introduce process variability • Generate oscillating conditions to produce AURORA-like eventReliability
- 31. Electric Utility Operation Attacks Generation Frequency Instability Protective Relay Disabling Translate loss of Frequency Stability into Physical Damage
- 33. ICS Security Traditional IT- Centric Defense Process Monitoring and Analysis Resilience and Recovery Investment
- 34. Identify indications of ICS breach Correlate IT intrusion information to anomalous process data Deploy knowledge to investigate process disruptions Facilitate post-incident recovery and analysis
- 35. • Evolution of ICS Attacks and Prospects for Future Disruptive Events – Dragos (https://dragos.com/wp- content/uploads/Evolution-of-ICS-Attacks-and-the-Prospects-for-Future-Disruptive-Events-Joseph-Slowik-1.pdf) • Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE – Dragos (https://dragos.com/whitepapers/CrashOverride2018.html) • Industroyer – ESET (https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf) • Analysis of the Cyber Attack on the Ukrainian Power Grid – SANS (https://ics.sans.org/media/E- ISAC_SANS_Ukraine_DUC_5.pdf) • Staged Cyber Attack Reveals Vulnerability in Power Grid – CNN (http://www.cnn.com/2007/US/09/26/power.at.risk/) • Common Questions and Answers Addressing the Aurora Vulnerability – Mark Zeller (https://cdn.selinc.com/assets/Literature/Publications/Technical%20Papers/6467_CommonQuestions_MZ_20101209_Web.p df?v=20150812-151908) • Myth or Reality – Does the Aurora Vulnerability Pose a Risk to My Generator? – Mark Zeller (https://cdn.selinc.com/assets/Literature/Publications/Technical%20Papers/6452_MythReality_MZ_20110217_Web2.pdf?v=2 0181015-210359)