Analysis Report iTrust-Analysis-001 May 2016 BlackEnergy - Malware for Cyber-Physical Attacks About iTrust iTrust is a multidisciplinary research centre located in the Singapore University of Technology and Design (SUTD), established collaboratively by SUTD and the Ministry of Defence, Singapore (MINDEF). The focus of iTrust is on cyber security, spanning across three research areas: a. Cyber Physical System (CPS); b. Enterprise Networking / Security; and c. Internet of Things (IoT). iTrust researchers focus on the development of advanced tools and methodologies to ensure security and safety of current and future cyber physical systems and Internet of Things (IoT) systems. Systems of interest include large infrastructure of national importance such as power grid, water treatment, and oil refineries as well as cyber-devices such as smart watches, pacemakers, defibrillators, insulin pumps, and VNS implants. Cyber physical systems is one of the many areas we are working on. The focus of the proposed research is to improve our understanding of cyber threats to CPSs and to develop and experiment with strategies to mitigate such threats. Our approach is based on well understood technical foundations borrowed from the interdisciplinary fields of control theory, artificial intelligence, game theory, networking, and software engineering. The techniques propose will be evaluated against, and demonstrated in our Secure Water Treatment (SWaT) Testbed, Water Distribution System (WADI) testbed, and Electric Power and Intelligent Control (EPIC) testbed. Similarly, shielded room laboratory for IoT research. iTrust researchers are drawn from across SUTD and with a strong collaboration with Massachusetts Institute of Technology (MIT), enrich the depth, breadth, and quality of research. Academic collaborators include MIT, Imperial College, University of Illinois at Urbana-Champaign (UIUC)/Advanced Digital Sciences Center (ADSC), Ben Gurion University, Israel and Nanyang Technological University, Singapore (NTU). For more information, please refer to http://itrust.sutd.edu.sg. Thank you. iTrust, Centre for Research in Cyber Security Singapore University of Technology and Design Malware for Cyber-Physical Attacks Siddhant Shrivastava, iTrust Centre for Research in Cyber Security yber-Physical Systems are increasingly 5.7 BlackEnergy in the Ukraine Attacks 8 being used in critical infrastructures. 5.7.1 Media Industry . 8 CRecent attacks on these systems have 5.7.2 Power Industry . 8 resulted in adverse consequences on an international level. Contemporary malware 6 Ukraine Power Sector Attacks 9 has expanded its scope from conventional 6.1 Events Timeline . 10 cyberspace to the physical space by attacking 6.2 Attack Workflow . 10 Cyber-Physical Systems. One such popular 6.3 Impact on CPS . 11 malware family, BlackEnergy, is studied in 6.4 Analysis . 11 detail here to better understand the scope 6.5 Open-Source Knowledge . 11 of Malware in facilitating Cyber-Physical 6.6 Significance . 13 Attacks. 7 Current State of ICS Security 13 7.1 Defence Mechanisms . 13 Contents 7.2 Security by Design . 13 1 Introduction 1 8 Conclusion 13 2 Cyber-Physical Systems 2 1 Introduction 3 Critical Infrastructure 2 3.1 Threats to Public Infrastructure . 2 Recent malware-facilitated attacks on criticial public 3.2 Points of Attack . 2 infrastructure bolster the need to understand the relation between malware and cyber-physical attacks. 4 Malware 3 This report studies the BlackEnergy malware family 4.1 Types of Malware . 3 in detail and its involvement in attacks on industries 4.2 Attack Strategies Used . 4 in Ukraine (media, power). The uniqueness of the attack strategies lies in the employment of different 5 BlackEnergy 4 versions of the same malware family to achieve 5.1 Infection Vectors and Targets . 4 different end results. The attacks in this paper 5.2 Architecture . 5 are reportedly the first in the history of power- 5.3 Features . 6 sector related cyber-physical attacks. It is important 5.4 Versions . 7 to note that the versatility of the BlackEnergy 5.4.1 Version 1.0 . 7 malware family enables it to be a persistent threat 5.4.2 Version 2.0 . 7 to the industries. The attacks were coordinated 5.4.3 Version 3.0 . 7 with much fewer resources and lesser sophistication 5.5 Attacks . 8 than previous attacks on critical infrastructure by 5.6 KillDisk Component . 8 malware such as Stuxnet. Page 1 of 15 The report is organised as follows. Section 3 Critical Infrastructure 2 discusses concepts of cyber-physical systems. Criticial Infrastructures and Malware are considered CPS is increasingly being utilised for designing in Sections 3 and 4 respectively. A comprehensive and engineering Critical Infrastructures. Critical study of the BlackEnergy malware family is Infrastructure [23] is a set of commonly accessible described in Section 5. Details about the Ukraine services that fulfills the basic needs of a nation's Power Sector Attacks are mentioned in Section 6. society and economy. Every country has certain Finally, the current state of the security landscape services that fall under the Critical National is discussed in Section 7. Infrastructure. ICS-CERT (Industrial Control Systems Cyber Emergency Response Team) [30] has defined 16 sectors as critical infrastructures as 2 Cyber-Physical Systems shown in Table 2. Cyber-Physical Systems (CPS) entail all possible systems which exist in the cyber Domain as 3.1 Threats to Public Infrastructure well as the physical Domain. Examples include intelligent transportation systems, water treatment Due to distributed design, increased network and distribution systems, automobiles, pacemakers connectivity and technology readiness, contemporary and the power grid. CPS integrates computing, critical infrastructures face the following threats: networking, and physical processes. The physical process is integrated, monitored and controlled • Cyber Attacks - An attack purely in the by computers [17]. The intelligence programmed cyber domain, in which one of confidentiality, in the cyber domain decides the steps that the integrity, availability is compromised physical process should take given the state of the system. This enables automation, control and • CPS Attacks - An attack in the cyber domain quality assurance of processes which would otherwise with consequences in the physical domain, require humans in the loop. Thus, cybersecurity e.g., unauthorised actuation, espionage, delayed becomes increasingly important in the case of CPS actuation as all critical infrastructures are built on this model. The security of CPS depends on more factors than • Physical Attacks - An attack purely in the conventional networked cyber systems. A secure physical domain, e.g., drilling a hole in a water CPS has at least the following features: tank • Confidentiality • Physical-Cyber Attacks - An attack in the physical domain with consequences in the cyber • Integrity domain, e.g., pulling out wires connecting to the historian server • Availability • Authenticity These attacks may not be mutually exclusive; the overlap between these domains is represented in Figure 1. Thus, it suffices to say that an insecure cyber Note that even further specialised types of attack system is also a vulnerable CPS. The risk is not such as cyber-physical-cyber can be carried out by limited to data and services but includes physical a determined adversary. However, the impact of the and biological risks to the people who are affected by malware on CPS domains is the primary focus of the CPS. Since the physical process can be attacked this report. physically by adversaries, defence mechanisms need to take physical security into consideration as well. Components of CPS are referred in Table 1. The 3.2 Points of Attack vulnerable points of entry of attack are identified in Figure 2. CPS technology is increasingly being The points of attack for a generic CPS are utilised as the model for designing and engineering represented in Figure 2. For a specific CPS, the public critical infrastructures of nations. descriptions are presented in Table 1. Page 2 of 15 Table 1: Examples of CPS. CPS Sensors/ Control Utility Systems Actuators Devices Devices Water Treatment Level sensor, SCADA workstation, PLCs SCADA System Pumps, Flow sensor Historian server Pulse monitor, Mobile application, Pacemaker Timing controller Pulse amplifier Pulse logger ECUs using Dashboard computer, Automobile Odometer / Throttle CAN Bus, i2c, Mobile application FlexRay Table 2: Critical Infrastructures defined by ICS-CERT. Energy Water Chemical Finance Food and Agriculture Communications Commerce Government Nuclear Defence Manufacturing Dams Transportation Information Technology Emergency Services Healthcare 4 Malware • Worm - A computer software written for self-replication without an external trigger Malware is a portmanteau for malicious software, and it spreads from machine to machine and refers to all the practices that are meant to cause over the network until it reaches the harm to the normal operations of a cyber-system. desired host. Historically, worms have been Malware can be classed as a source of cyber-physical identified for their notoriety in CPS Attacks - attacks when used against a CPS. Stuxnet(centrifuges), Slammer(nuclear plant) and most recently BlackEnergy (power) 4.1 Types of Malware • Botnet - A malware strategy in which a set of The most common types of malware are listed below: compromised infected computer nodes act as • Rootkit - Programmes which utilise privilege unaware victims for a C&C Server.