It has been discovered by cyber security experts that hackers are using a new type of malware to target industrial control systems which is forcing operations to shut down. Cybersecurity firm FireEye has named this malware “Triton”. Travis Smith, Principal Security Researcher at Tripwire commented below.
Travis Smith, Principal Security Researcher at Tripwire:
“The fact that operations were shut down, whether that was the primary intent or not, shows the real physical impact these cyber threats can have on critical infrastructure. Industry experts have warned about these threats for some time now, so incidents like these emphasize the need for industrial operators to invest in securing their infrastructure.
Critical infrastructure still suffers from a general lack of foundational security controls. There was a time when industrial control systems could be protected by physical security measures. Internet connectivity changed the whole security landscape and operators must address the new cyber risks, such as misconfigured devices and unpatched vulnerabilities. With the potential impact so great, we need to take action before something terrible happens.”
Gary McGraw, Vice President of Security Technology at Synopsys:
“When everything is connected to the Internet, including industrial control systems, cars and trucks, and banks, we should not be surprised with the connected things become potential targets. War has long since moved onto the Internet just like everything else. Physically destroying a target’s infrastructure in future wars may be just as much a matter of logic bombs in software as it is about exploding missiles made of metal. You can bet that nation-states are doing whatever they can to get a leg up on potential enemy targets, including probing safety instrumented systems (SIS). In this case the SIS apparently tripped a shutdown while attackers were probing and doing other system reconnaissance. The attackers did not set out to get caught.
Software has been a target of attack for decades. We should not be surprised that infrastructure software in safety critical systems is a target. The TRITON attack serves as an important wake up call for those continuing to hit the cyber snooze button.”
“Copperfield is not nearly as dangerous as Triton and its propagation can be stopped by not allowing engineers and operators to use USB devices connected to Industrial Control Systems (ICS). Although this is not an improved malware, it could result in data exfiltration, control of a workstation or reconnaissance of the network. It is however, an incident that reiterates the message that cybercriminals are actively probing critical infrastructure for vulnerabilities and are increasing their efforts. All ICS operators should be on high alert as this type of activity is increasing exponentially. In the meantime, ICS operators must strictly adhere to best practices, security protocol and be vigilant about looking for abnormal behaviours in the network using deep packet inspection and hybrid analysis.”
ISBuzz Team embodies the collaborative efforts of the dedicated staff at Information Security Buzz, converging a wide range of skills and viewpoints to present a unified, engaging voice in the information security realm. This entity isn't tied to a single individual; instead, it's a dynamic embodiment of a team diligently working behind the scenes to keep you updated and secure. When you read a post from ISBuzz Team, you're receiving the most relevant and actionable insights, curated and crafted by professionals tuned in to the pulse of the cybersecurity world. ISBuzz Team - your reliable compass in the fast-evolving landscape of information security
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.