Hackers take out safety systems in ‘watershed’ attack on energy plan

In what experts are calling a watershed moment, hackers have infiltrated the critical safety systems for industrial control units used in nuclear, oil and gas plants, halting operations at least one facility.

The attackers, who are believed to be state-sponsored, targeted the Triconex industrial safety technology made by Schneider Electric SE, according to security firm FireEye and Schneider, who disclosed the incident on Thursday.

A security alert was sent to users of Triconex, but neither firm would reveal the nature or location of the plant, which some have suggested may be in the Middle East, possibly Saudi Arabia. Experts said the attack marks the first reported breach of a safety system at an industrial plant by hackers.

Galina Antova, co-founder of cybersecurity firm Claroty, said safety systems “could be fooled to indicate that everything is OK” even as hackers damage a plant.

The hackers used sophisticated malware, dubbed “Triton”, to take remote control of a safety control workstation, according to a FireEye investigation. Some controllers entered a failsafe mode as the hackers attempted to reprogram them, causing related processes to shut down and allowing the plant to spot the attack.

The attackers were probably attempting to learn how they could modify safety systems if they wished to launch an attack in future, said FireEye.

“This is a watershed,” said Sergio Caltagirone, head of threat intelligence with cybersecurity specialists Dragos. “Others will eventually catch up and try to copy this kind of attack.”

Security firm Symantec said that Triton has been active since August and works by infecting a Windows computer attached to the safety system. It said: “While there have been a small number previous cases of malware designed to attack industrial control systems (ICS), Triton is the first to attack safety instrumented system devices.”

“The first and most notable example of ICS malware was Stuxnet, which was designed to attack programmable logic controllers being used in the Iranian uranium enrichment program.”

Following Stuxnet in 2010, the second known piece of malware designed to disrupt industrial systems was the so-called Crash Override or Industroyer, likely used in a December 2016 attack that cut power in Ukraine.

CyberX vice-president Phil Neray said his security firm found evidence that the malware was deployed in Saudi Arabia, suggesting that Iran could be behind the attack. Security researchers widely believe that Iran was responsible for a series of attacks on Saudi Arabian networks in 2012 and 2017 using a virus known as Shamoon.

The US Department of Homeland Security said it was looking into the matter “to assess the potential impact on critical infrastructure”. (Source: www.theguardian.com)

Schneider said in its security alert: “While evidence suggests this was an isolated incident and not due to a vulnerability in the Triconex system or its program code, we continue to investigate whether there are additional attack vectors.”