TRISIS in Perspective
Download as PPTX, PDF1 like703 views
The document discusses the Trisis malware attack on a safety system at a gas facility in Saudi Arabia in 2017, highlighting its impact and the ongoing threat from the Xenotime group which has expanded its targeting. It offers defensive recommendations for industrial control systems (ICS), emphasizing the importance of monitoring, isolation, and robust network defenses against cyber threats. Additionally, it stresses the need for effective incident response capabilities, including forensic analysis and system recovery planning.
TRISIS in Perspective
- 1. TRISIS in Perspective Implications of Safety System Attacks for ICS Defenders
- 2. Place Your Header Here in Arial 22pt Place Subtitle Here Agenda • TRISIS Event • TRISIS Malware • XENOTIME Activity Group • Defensive Recommendations
- 3. TRISIS Event Unspecified gas facility in Saudi Arabia attacked in August 2017. Infection resulted in system shutdown during the intrusion. Not assessed as a shutdown due to an attack (accidental). Attack focused on Schneider Electric Triconex Safety System (SIS).
- 4. TRISIS Attack Progression Establish Access on SIS- Connecting System Transfer TRISIS Package to System Use TRISIS Base EXE to Upload Tristation Program Tristation Program Compromises SIS Leverage Access for ICS Disruption via SIS
- 5. Establish Access on SIS- Connecting System Transfer TRISIS Package to System Use TRISIS Base EXE to Upload Tristation Program Tristation Program Compromises SIS Leverage Access for ICS Disruption via SIS TRISIS Attack - Observed Something breaks here! (maybe)
- 6. TRISIS Malware exploits and installs rootkit on SIS Engineering Workstation LIBRARY.ZIP + TRILOG.EXE SIS INJECT.BIN IMAIN.BIN
- 7. TRISIS Activity Group: XENOTIME Deliberate targeting of SIS accepts risk of physical damage and potential loss of life. New ‘norm’ established in ICS targeting and operations. Post-TRISIS, we have observed that XENOTIME has expanded its targeting to North America and other safety systems. XENOTIME isn’t simply a problem for Schneider Triconex customers.
- 8. ICS Cyber Kill Chain – Focus on Stage 2
- 9. SIS Connectivity – Isolation isn’t always possible Increasing connectivity requirements results in SIS connectivity to general network. Yokogawa ProSafe-RS recommends that SIS connected to rest of network. Honeywell Safety Manager docs provide similar guidance.
- 10. Border Defense – Stopping Stage 2 • Look for Credential Theft and Re-Use. • Remote logon activity should route through a hardened jump host for better monitoring. • If not possible, implement host-based logging visibility on border hosts from IT to ICS along with network monitoring host to host. • File Monitoring • Unknown ICS malware will often evade AV (known limitation). • AV effective for supplementary tools like Mimikatz. • Open source: Bro + Yara for files of interest crossing border. • Command and Control Detection – outbound activity from ICS
- 11. ICS Network Defense – Choke Points and Pivoting • Following initial access, attacker must pivot through network to reach host of interest. • Architectural decisions can limit adversary freedom of movement. • Treat choke points like IT-ICS boundary. • Most effective: physical/virtual LAN segmentation. Install taps for better visibility.
- 12. SIS Monitoring and Defense • Assumption: adversary has breached network and has access to SIS. • Harden SIS-Connected hosts, such as EWS, to the greatest extent possible. • Patching • Limit local and admin accounts as well as remote access. • Logging (Sysmon, Windows event log) • Treat SIS-connected hosts as a choke point. • Physical Defense: Isolate as much as possible. Use keyswitch-like controls. • Monitor Traffic Flow to SIS. • Organizational awareness of known maintenance periods
- 13. SIS Response and Recovery – Plan Ahead • Forensics and Root Cause Analysis • TRISIS victim was able to determine a cyber event was involved in plant shutdown. This is often overlooked. • Assess capability to obtain forensics artifacts from the SIS. e.g. Control Program Audits • Ensure robust forensic capability on SIS-connected devices, to enable determination of cyber involvement. • System Restoration and Recovery • Known Good configuration secure backups (firmware if possible) • Develop response plan. Engage Vendor contacts early.
- 14. Start Now with SIS Defense XENOTIME is still learning. The playing field is level, so we have time for designing defense. Questions?
- 15. Sources and References • Yokogawa SIS Prosafe-RS Documenation https://tinyurl.com/ybtkwxfw • Honeywell Safety Manager Specifications and Technical Data https://tinyurl.com/yde2tgwy • The Bro Network Security Monitor https://www.bro.org/ • Yara: The Pattern Matching Swiss Knife for Malware Researchers https://virustotal.github.io/yara/ • Sysmon – Microsoft https://tinyurl.com/y9bcgolz
- 16. Sources and References • Windows Security Event ID 4624 https://tinyurl.com/zaklujy • TRISIS – Initial Release https://dragos.com/blog/trisis/ • TRISIS and Xenotime webinars: Analyzing TRISIS – Reid Wightman & Jimmy Wylie XENOTIME and SIS – Joe Slowik https://dragos.com/webinars.html