Why bother cracking PCs? Spot o' malware on PLCs... Done. Industrial control network pwned

Hummm

There are multiple ways that attackers can deploy reconnaissance malware to an air-gapped network,

The ways listed in that paragraph all depend on the security IT section not doing its job.

Updates - no matter where they come from should be tested and scanned before deployment.

Infected USB drives and/or contractor laptops - these should automatically be suspect and scanned well before they get near the air-gapped system.

Malicious ladder logic code - anyone that can't spot anomalies in that code shouldn't be coding for air-gapped systems.

All of the above are standard security requirements that my company insists on at the two industrial complexes we maintain. If management doesn't like it we walk away as we did in one case

Bandwidth?

"other techniques designed to increase the bandwidth of transmissions"

The limiting factor is most likely to be the available SNR as that places an ultimate limit on the data rate (Shannon limit).

If the PCs/controllers are well designed then RF leakage should be very small, and if you are relying on operations in the low tens of MHz region then background noise in most areas will already be way above the receiver's noise figure. So unless you are *really* close I doubt you could get more than tens of bits per second out.

Solution looking for a problem

Industrial control networks are notoriously easy to compromise. because security has never been a top concern. Money, making money now, is the #1 concern, fuck what may happen in the future.

Hoping to encourage the development of more robust defences for SCADA-based systems is laudable and is as old as SCADA systems themselves. No one familiar with SCADA systems think they are in difficult to hack, particularly if only to create chaos, and those concerned about technical issues have always wanted better security.

As a result there is no need to add code to create RF signals. RF monitoring technology is now ancient if one wanted to use those methods. I suspect inserting code is used to help others understand that RF leakage is a security concern. Once they understand that it becomes easier to explain that all parts of the system can leak RF that can be used to determine what the system is doing.

"Hacking" SADA systems needs no such equipment, as shown by Stuxnet over a decade ago. Even easier is to "ask" someone with access to the building to install monitoring equipment. That equipment can be as common as a camera or wifi usb adapter. The OS didn't automatically install the drivers? No problem the password is as old as the system itself and if not written in the panel can be had by asking or just looking if that camera isn't obvious, or sometimes it is better if it is very obvious.

The basic problem is that no one in charge of the money really cares about security. If they did there would be no lowest bidders, no endless traffic of poorly trained and poorly paid, untrustworthy workers with access during and after construction. Sure, sometimes, there is a pretense of security but that's all that is ever required. Far more important is completion on time and under budget. Let the future deal with any results, that'll be a different time, different crew, different CIO, CEO, different board and most importantly a different budget.

BTW many of those " air-gapped" SCADA systems are not. IME most get connected so the contracting company, sometimes employees, can further reduce costs by not having to travel to site or by sub-contracting work to off site companies, companies that do not have to meet site security requirements. Sometimes that wifi adapter gets install by site personnel who would rather work from their comfy, and quiet, company vehicle which makes it much easier the next time wifi access is required, or so I've heard. ;)

If society was really concerned about such security they would make companies, and those that profit from those companies pay far more for failure. When there can be no profits without security, no ability hide profits and cash behind deniability or claims of ignorance there will be security. Until then security is little more than an illusion waiting to be exposed. Not that it matters to those that profited, they are well insulated and may even ride back on white horses to fix the very problem they created, cost plus of course.

I better remember to check anon. I might need that plausible deniability if someone reads this and thinks they recognize the imaginary major SCADA systems I referred to.

Not a real view of how things are, Ivan

I know someone who does industrial control setup - he does it *all* for about 10-20 large chemical plants, distilleries and so on. There is NO IT department in any of the smaller ones. Zero. So how competent a nonexistent entity is is irrelevant. They also have time according to how many there are to check stuff like anomalies in ladder logic, or apply updates at all - zero if things are working, my high paid friend as a consultant for a day at most when they stop.

My friend is somewhat interested in security, and far more skilled in computers generally than nearly all of his ilk. He tells me there's simply no way to put in security as it's utterly politically infeasible. There's always some idiot in the C suite that wants to remote monitor their money maker during the few hours a day they're not playing golf (the plant usually runs 24/7/365), and the existing software for such things - all of it - can't do that as a read-only thing. In fact, most of it has to poll the PLC's in the plant to get the reading to display on the cool picture/flowchart of the plant. If you have to send commands to poll for data, the barn door is unlocked already.

And of course, those same PHBs often want to see it on their laptop or phone, which is almost surely internet connected - despite all the rest being air-gapped, it's always one of those guys crossing the line and the gap...and who never admit it when things go south.

In many ways, this is otherwise the most conservative business ever - downtime is super expensive, if it ain't broke, don't fix it, and my friend has had to replace PLCs older than himself - and he's no spring chicken. Only when a plant is relocated or otherwise rebuilt does any of this change.

Downtime or any change can also be pretty risky when you have hundreds of thousands of gallons of flammable solvent at the boiling point in various places around the plant...you don't go in just to patch some obscure PLC that's working the safety valve on a boiler that's been running for > 10 years and only making ROI for a few of them.

That's not great (to say the very least), but it IS the way things are now. "Ought to" is a funny concept if you've sunk a lifetime of money into something and are waiting for a payback...stupid or not, it's the way of the world. It's even worse if it's a public money with a fiduciary responsibility to the shareholders. If it blows up, they can cut and run, deflect blame with "everyone does this", but if they don't make money....it's even worse.

Question is 'why'?

While interesting, it appears the exploit only benefit is the ability to extract data from a PLC network.

The question is therefore what data on a PLC is worth this level of effort to extract it?

For example there will be no credit card numbers, sensitive documents, or blackmail porn.

It seems the researchers have said PC's are hard, hey look PLC's have microprocessors lets try it here. However even in the cyber criminal world there is a cost benefit equation and this doesn't fly. If you are going to go to tne effort of compromising a air-gapped PLC system there are far better reasons such as industrial sabotage.

That is not to underestimate the risks to PLC and the distance the industry has to go to improve, but I will file this one under 'intresting, but not a applicable'

airgapped?

"infecting USB drives or laptops of third-party contractors who connect directly to the network for maintenance purposes." What a strange definition of 'airgapped'.