Over the years, the number of attacks against ICS/SCADA systems used by industrial organizations worldwide has rapidly increased. Many security firms highlighted the risks related to attacks targeting OT networks used in utilities.
Recently FireEye’s incident response unit Mandiant demonstrated how to infiltrate the network of a North American utility and hack into its industrial control systems to turn off one of its smart meters.
The scope of the test was to demonstrate tactics, techniques, and procedures used by threat actors to breach the protected perimeter between an IT network and an OT network.
“Mandiant’s experience during red team engagements highlights that collecting information from IT network assets plays a crucial role in targeted OT attacks. As a result, the internal reconnaissance phase for OT targeted attacks begins in the enterprise network, where the actor obtains knowledge and resources to propagate from an initial compromise in the IT network to remote access in the OT network.” states the FireEye’s report. “Detailed information collected about the target, their security operations, and their environment can also support an actor’s attempts at remaining undetected while expanding operations.”
Mandiant’s red team initially targeted the external-facing IT network, then attempted to gain access to the OT network.
Mandiant launched a spear-phishing attack to gain a foothold in the target enterprise network. The experts used a combination of two different phishing scenarios:
With this approach, the red team achieved code execution on a user workstation in the enterprise environment.
Once achieve control over the workstations in the enterprise environment, experts used a set of publicly available offensive security tools (OST) to escalate privileges and to obtain domain administrator level access.
Below the list of tools used by the Mandiant’s team:
Then Mandiant’s OT Red Team conducted an internal reconnaissance in the IT network to determine targets of interest (people, processes, or technology) and find a way to jump from the IT to the OT.
“During the process of propagation from IT to OT networks, an actor will leverage previously compromised systems, credentials, or applications to access systems in higher security zones—such as OT demilitarized zones (DMZ).” continues the report. “Based on our observations during multiple red teaming engagements and research, the most likely attack vectors for propagation are:
Finally, once mapped the OT network, researchers were able to steal login credentials for a human-machine interface portal for the meter control infrastructure and issue a command to disconnect the smart meter.
“With access to the domain controller in the core OT network, we extracted credentials for high privilege domain administrator accounts in the OT network using DCSYNC and Mimikatz. Using these accounts, we gained control of management servers, application servers, and operator workstations in the OT network.” concludes the report. “Mandiant was also able to use compromised credentials to login to the human machine interface (HMI) portal for the meter control infrastructure and issue a disconnect command for a target endpoint meter in the smart grid environment.”
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
(SecurityAffairs – hacking, smart meters)