The SolarWinds Hack Can Directly Affect Industrial Control Systems

 It looks like Russian’s hackers succeeded in getting a “two-fer” in the SolarWinds hack which compromise both the IT infrastructure and direct control of building control system devices.

The Russians also got indirect control of industrial control systems via the IT network backdoors.

A highly sophisticated Russian Intelligence group has compromised the SolarWinds Orion platform. The platform’s broad base of users has been estimated at up to 18,000 customers and includes an unknown but vast number of sites.

FireEye, which was affected by SolarWinds, issued a blog on SolarWinds dated December 13, 2020, “Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor”. The blog states: “They gained access to victims via trojanized updates to Solar Wind’s Orion IT monitoring and management software. This campaign may have begun as early as Spring 2020 and is currently ongoing. Post compromise activity following this supply chain compromise has included lateral movement and data theft.”

The FireEye blog, the DHS CISA and the SolarWinds Advisory have all focused on the IT networks, network visibility, and data exfiltration/compromise. However, SolarWinds is used to manage all types of Simple Network Management Protocol (SNMP) devices and these include not just IT equipment like servers and switches, but, also Industrial Control Systems (ICS) like power and cooling systems. 

Specifically, SNMP management systems are used to monitor (using the SNMP "get" command") and control (using the SNMP "set" command) any SNMP device. SNMP management platforms like Orion also monitor and control critical power and cooling systems in mission-critical facilities even though SNMP has little or no viable security. Consequently, data center equipment can be compromised using SNMP vulnerabilities.

Most power and cooling systems in data centers, laboratories, telecom systems and network closets include SNMP communication cards or chips for the expressed purpose of allowing them to be monitored and remotely controlled. 

These power and cooling systems include:

  • Switchgear
  • Power Distribution Units
  • Rack Power Distribution Units
  • Uninterruptible Power Supplies
  • Rack Uninterruptible Power Supplies
  • Computer Room Air Conditioners and Air Handlers (CRAC and CRAH units)
  • Temperature and Humidity Sensors
  • Rack Environmental Monitoring Systems

In mission-critical facilities, it is common for multiple management platforms to have monitoring and control access to SNMP-based systems. For example, the Network Management System (NMS) like Orion typically tracks device information at the rack-level, including the servers, switches, Rack PDU's and, when present, Rack UPS, Rack Cooling, and Rack Monitoring systems. At the same time, Building Management Systems (BMS) track the central cooling units and rack cooling units while the Data Center Infrastructure Management (DCIM) system is also tracking Rack PDUs, Main PDUs, Main UPSs, and Switchgear. This gap in building risk assessments has been highlighted by the process automation experts at Control Global.

Even the most recent SNMP version, version 3, is now over 20 years old and has long been shown to be vulnerable (though not as vulnerable as versions 1 and 2). This peer-reviewed and well-researched report from the Georgia Institute of Technology shows just how easy it is to compromise SNMP devices and cause physical damage.  

Devices that are using SNMP are insecure and can easily be compromised.  The Russians used SNMP communication cards as attack vectors in their 2015 attack on the Ukrainian power grid that left hundreds of thousands without power.

The Russians used targeted the UPS in the control center as the starting point for their attack.  In short, they placed code on the UPS that made it shut down at precisely the moment when they also started a Denial of Service (DoS) attack on the telecom switch (just as shown above in the consequences of SNMP attacks as outlined by the Georgia Tech paper).  Simultaneously, they opened the main breaker that delivers power to the Ukrainian power grid serving much of the country.

It has long been speculated that the Russians have been using the Ukraine as the "test laboratory" for more extensive cyberattacks they intend to use against other countries. Unfortunately, we can now say that they have succeeded in this SolarWinds Orion attack. 

While almost all are searching for malicious code on servers and managed switches, the reality is that code has likely been placed on power and cooling systems' SNMP cards throughout mission-critical enterprises around the globe. SNMP malware is extremely difficult to detect, and there are only a handful of people who have been involved in finding and managing this type of malware. 

The Russians spent significant efforts to deliver the BlackEnergy2 malware that is still in the US grids. The Russians modified it to create BlackEnergy3 which was used in the Ukrainian power grid attacks where the starting point was hacking the UPSs which use SNMP.  Now they spent a significant amount of effort to develop SolarWinds which enables direct access to the SNMP devices in more than 18,000 customers who have critical buildings (e.g., data centers, control centers, laboratories, manufacturing buildings, etc.) with SNMP devices.  

This attack demonstrates the need for the paradigm shift for control system cyber security by having an independent view of the control system devices not connected to any IP network. At what point will control systems be adequately addressed?

About The Author:  Joe Weiss  is an international authority on cybersecurity, control systems and system security. He is Managing Partner at Applied Control Sloutions.

You Might Also Read: 

Russian Hackers Have Stolen US Secrets:

 

« The Different Types of Malware
How To Optimize The DevSecOps Pipeline »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Covenco

Covenco

Covenco is a data management and IT infrastructure specialist. Working with customers to transform their IT environments, with data protection and security at the forefront of everything we do.

Airbus Cybersecurity

Airbus Cybersecurity

Airbus CyberSecurity is a European specialist in cyber security. Our mission is to protect governments, military and critical national infrastructure enterprises from cyber threats.

BGD E-GOV CIRT

BGD E-GOV CIRT

BGD e-GOV CIRT's mission is to support government efforts to develop ICT programs by establishing incident management capabilities within Bangladesh.

qSkills

qSkills

QSkills is an independent training provider specialized high-quality IT and IT management training courses including IT security.

Untangle

Untangle

Untangle provides network security products designed specifically for the below-enterprise market, safeguarding businesses, home offices, nonprofits, schools and governmental organizations.

Cybersecurity & Infrastructure Security Agency (CISA)

Cybersecurity & Infrastructure Security Agency (CISA)

CISA leads the national effort to defend critical infrastructure against the threats of today and to secure against the evolving risks of tomorrow.

Eperi

Eperi

Eperi is a leading provider of Cloud Data Protection (CDP) solutions with 15 years of experience in data encryption for databases, (SaaS) applications and files.

BluBracket

BluBracket

BluBracket is the first comprehensive security solution that makes code safe—so developers can innovate and collaborate, and security teams can sleep at night.

Quantifind

Quantifind

Quantifind enables financial crimes/fraud analysts and investigators to make better decisions, faster, with intelligent automation.

SpecterOps

SpecterOps

SpecterOps has unique insight into the cyber adversary mindset and brings the highest caliber, most experienced resources to assess your organizations defenses.

Kratos Defense & Security Solutions

Kratos Defense & Security Solutions

The Kratos Space, Training, and Cybersecurity division addresses key cybersecurity challenges, including cloud security, continuous monitoring, IT security, and risk management.

Feroot Security

Feroot Security

Feroot Security secures client-side web applications so that businesses can deliver a flawless user experience to their customers. Our products help organizations protect their client-side surface.

Red Access

Red Access

Red Access provides the first SaaS-based platform to protect web browsing from cyber threats on any browser and any in-app while ensuring frictionless user experience.

SafePaas

SafePaas

SafePaas is a leading Enterprise Risk Management Platform. One source of truth for all your Audit, Risk, and Compliance requirements. Complete governance across your systems.

Lansweeper

Lansweeper

Lansweeper is an IT Asset Management platform provider helping businesses better understand, manage and protect their IT devices and network.

Invictus International Consulting

Invictus International Consulting

Invictus International Consulting are a recognized leader in full-spectrum cyber technology solutions designed to protect the security of our nation's global defense and critical infrastructure.