Hackers are targeting industrial systems with malware

guest · Jul 18, 2022

An entire ecosystem of sketchy software is targeting potentially critical infrastructure
July 16, 2022

From the what-could-possibly-go-wrong file comes this: People hawking password-cracking software are targeting the hardware used in industrial-control facilities with malicious code that makes their systems part of a botnet, a researcher reported.

According to a blog post from security firm Dragos, an entire ecosystem of malware attempts to capitalize on scenarios like this one inside industrial facilities. Online advertisements like those below promote password crackers for PLCs and human-machine interfaces, which are the workhorses inside these environments.
Click to expand...

When your industrial system is part of a botnet
Dragos—which helps firms secure industrial control systems against ransomware, state-sponsored hackers, and potential saboteurs—recently performed a routine vulnerability assessment and found software advertised as a password cracker for the DirectLogic 06, a PLC sold by Automation Direct.

“Previous research targeting DirectLogic PLCs has resulted in successful cracking techniques,” Dragos researcher Sam Hanson wrote. “However, Dragos found that this exploit does not crack a scrambled version of the password as historically seen in popular exploitation frameworks. Instead, a specific byte sequence is sent by the malware dropper to a COM port.”
Click to expand...

Besides recovering the password, the software Hanson analyzed also installed malware known as Sality. It made the infected system part of a botnet and monitored the clipboard of the infected workstation every half second for any data related to cryptocurrency wallet addresses.
Click to expand...

Dragos: The Trojan Horse Malware & Password “Cracking” Ecosystem Targeting Industrial Operators

Troy doesn’t know the password, and Hector left a few months ago and is now vacationing on a boat without service indefinitely. Troy looks for answers online, and seeing an advertisement for PLC password cracking software, decides to give it a go. Cassandra, Troy’s security-conscience coworker, warns against introducing this unnecessary risk into their OT environment. But Troy insists this is a time-sensitive task. He purchases the software and runs it on his engineering workstation.

Troy successfully recovers the PLC password, but a couple of minutes later he discovers the engineering workstation system is acting strange.
Click to expand...

Password Retrieval and a Sality Malware Infection
Troy called in Dragos to reverse engineer the password “cracking” software and determined it did not crack the password at all, rather, it exploited a vulnerability in the firmware which allowed it to retrieve the password on command. Further, the software was a malware dropper, infecting the machine with the Sality malware and turning the host into a peer in Sality’s peer-to-peer botnet.
Click to expand...

Log in or Sign up

Hackers are targeting industrial systems with malware

guest Guest

Log in or Sign up

Hackers are targeting industrial systems with malware

guest Guest

Useful Searches