What is Industrial Hacking

​

It may be the work of Hollywood images engrained in our minds, but when we think about cyber attacks against particular industries, we think of mushroomed explosions and civility testing blackouts due to nuclear plant malfunctions. However, hackers can cause severe damage with more finite attacks, without the need for targeting critical infrastructure. In reality, these subtle hacks can be significantly more threatening, as reported on by Motherboard. Robert Lee, a security researcher and a cybersecurity PhD candidate King’s College in London, notes that some hackers have the ability to infiltrate the system of drug company and change the chemical composition of a particular medication during its preparation stage at a pharmaceutical plant and kill thousands of people.

 

At BlackHat USA 2015, critical vulnerabilities in control switches that are actively used in industrial control management systems, such as substations, factories, refineries, ports, and other areas of industrial automation were disclosed by researchers. The flaws were discovered in system switches, These switches can facilitate the potential shutdown of plant processes, such as nuclear-reactor “SCRAM” or forcing an industrial control system into an unknown hazardous state, like causing damage to a blast furnace at a steel mill.

 

Moving too slow

 

Unlike other discovered hacks, this problem is quite real and ongoing. Marina Krotofill, a researcher at Hamburg University of Technology, notes that the hacking of industrial plants for extortion is by in large an untold story because attacks are seldom reported. Since 2006, hackers have been penetrating industrial control systems of utility companies on a large scale, as told to folks visiting BlackHat USA 2015. Yet, as Krotofill argues, almost 10 years later we still know almost nothing about how the attackers are doing that because targeted companies are unwilling to make any information available.

 

According to Sameer Bhalotra, former Senior Director for Cybersecurity for the Obama Administration and now Chief Operating Officer of Web security company Impermium, software companies, like Microsoft, have become adept at rapidly patching vulnerabilities, to the point where major flaws are now rare. Companies responsible for the production of industrial control equipment and software have never had to worry much about security, and so they’re not capable of generating patches quickly, or making significant design changes. “Nothing well organized is happening today,” says Bhalotra “Vendors are just going to have to get faster and better at patching, and that’s going to take some time.”

 

One reason the process is so slow is a total lack of clear incentives. Current law doesn’t make energy operators or the manufacturers of control systems liable for the consequences of poor security, such as damage caused by an explosion or a lengthy power outage. Only the introduction of new legislation to clear up this issue is likely to speed up the process of creating more secure industrial control systems. Other imperative steps to addressing industrial hacking are: collecting information of the attacks, comparing patterns and similarities, and solving the root at which these switches are vulnerable.

 

Black Hat

 

However, there is good news! Researchers have been alerting vendors about these issues, and as as result, some vendors have issued patches in a prompter manner. Researchers plan to teach Black Hat attendees how to detect and mitigate these attacks, despite vulnerabilities in switches.

Despite the doomsday scenarios as seen in Hollywood, researchers are optimistic. Some of the vendors have been very responsive topatch development, and researchers hope that by highlighting these issues, the switches of the future will be designed with security in mind. Until then we keep our ear to the ground, hoping for some security in a potentially bleak future.