Industrial control systems increasingly under attack, says Kaspersky

Accidental infections and insider threats

While targeted attacks are the most dangerous, operators of industrial control systems also need to be aware of accidental infections and insider attacks.

“Although Stuxnet was designed to disrupt operations at a specific nuclear plant, it accidentally infected around 300,000 industrial control systems around the world,” said Nikishin.

Each one of these infections was capable of collecting information about the infected system and transmitting that back to the malware controllers.

Any ICS connected to the internet also runs the risk of being infected with ransomware such as Cryptolocker.

“This is a big headache and a major concern for many operators of industrial control systems who fear their systems will be cryptographically locked and held for ransom,” said Nikishin.

Spanair JK5022 is an example of where an accidental infection had fatal consequences, he said.

In 2008, one of the now-defunct airline’s ground computers was infected with a Trojan virus, but not as the result of a targeted attack.

However, the malfunctioning of the infected computer has never been ruled out as a contributory factor to the failure of warning systems.

“Critical warning systems prior to take-off failed to work, with the result that an aircraft crashed, killing 154 people on board,” said Nikishin.

Finally, industrial control systems are vulnerable to attack by insiders acting out of revenge and greed or because they are being blackmailed.

Some of these attacks are discovered after a relatively short time, but other have been known to run for years before being detected, said Nikishin.

“In one case an insider altered a few lines of code for a control system at an oil and gas company to siphon off free fuel, but that was discovered after three months.

“In another case at a Russian mining company, a gang altered code to divert tons of iron ore that netted them $50m before the scam was discovered after three years,” he said.

Easy targets

Kaspersky Lab expects the emerging trend of attacks on contractors to continue and grow.

“Suppliers of critical national infrastructure and operators of industrial control systems are usually well defended, but their suppliers and contractors are often relatively easy targets,” said Nikishin.

Similarly, attackers are expected to target industrial control systems because industrial networks potentially offer an easier way in to the more heavily protected corporate IT systems.

Attackers are also expected to target and compromise remote controls systems, where such systems have been introduced to cut costs and for ease of use without due consideration to security.

“All sorts of things, including public transport systems and even battleships, are being equipped with remote control systems, which are conceivably open to compromise,” said Nikishin.

Kaspersky Labs is also warning of potential attacks on building control systems for CCTV, air-conditioning, lighting and access control.

“The analysis of malware has revealed components for controlling office doors, so attackers could theoretically block access to targeted buildings, which could be dangerous,” said Nikishin.

“From experience, my feeling is that the situation is likely to go from bad to worse,” he said.