The Dangers Of OT Malware: Hacking A Nuclear Power Station - Matt Mckenzie

[Music] Good afternoon everybody. So uh as say my name is Matt McKenzie. I'm from EA Consulting. We uh work in various industries within the the cyber security sector looking at lots of different areas of cyber security from from AI to IoT and IoT testing and and security to cyber transformation. And uh as a company we work all across that cyber security space to help our clients sort of embed cyber security within their organization and not just kind of make small um changes that don't lead to that lasted impact. Now to look at the sectors that we work in um primarily within the critical natural infrastructure my team in the the OT team are looking across sort of the

energy and utilities um transport sectors the consumer and manufacturing spaces and that's helping clients like electricity companies water companies uh rail operators um but also um the companies that are providing the buses um gas services um all the way to um nuclear sector operators as well. Now IoT and and is quite a challenging um sector to work in. It's fairly new in terms of the cyber security space and the requirement to to actually doing cyber security and that is um becoming challenging for companies who are operating these sort of systems to to navigate this space. So just to look at some of the um the examples of of work that we've done um we work with airline

companies so airports and airlines for sure their security of the the systems around the airports and um the the national flights themselves. We've worked with great food manufacturers, so companies that are running multiple um sites across the world um that interconnected systems and sensors that are feeding different uh departments different information. We've worked with government departments to help them regulate navigate this space themselves because they are actually fairly limitless as well. Uh we also helped oil companies so invested in long-term cyber practices um and logistics operators. So companies that are shipping mail internationally to uh understand how to prepare for instant response. Now this going to be slightly clunky if the test hasn't worked for you.

What I'm going to show you here is a cyber security demonstration on uh how to map a nutrient valve station. Now hopefully we can see here this is uh a HMI. So it's our human machine interface and what this is um displaying is the process uh on this this box here. Hope you can can all see this. Now what we got in here is a PLC. So programmable logic controller. This is essentially the brain of the operation of our nuclear power station. So that has got all the logic that is controlling our cooling system for our nuclear reactor. So what we're monitoring here is our core temperature and that is uh the level and the the

core is reading to uh to generate steam. and and electricity. So just get right. So we're monitoring the core temperature and essentially the job of this is to moderate that temperature. So as that temperature increases, we're increase the amount of coolant that is being pumped into the core. So we want to keep somewhere within that 600° range. You can see on the right hand side screen there, we got a uh alarm temperature set point there for at 600°. So when we hit that point, that's when we need to be alerted in the control room. Our system is potentially becoming unsafe um and that our operators might need to intervene. Now you'll see a second. We're going to hit that

temperature set point. Um, and our alarm is going to go off and we'll get light on that display letting us know that that is not safe. I hope you all hear that high pitch noise. [Music] So, what we see now is that our system is going to start regulating itself. So, it's going to start decreasing in temperature because that coolant flow rate has increased. There's a few things to to notice on this. So, firstly, the alarm temperature set point at 600°, but also our coolant flow meter. So, that green light is indicating that our coolant pump is running. Now, I've not explained this setup particularly well. Um, some of it has decided not to play

ball today. Um, this equipment has just come back from the States. Um, so I think it's been thrown around by some baggage handlers. Um and it's uh now a bit of a st. But what I've got here is a laptop running some HMI software. So this is genuine um software that's a genuine program controller that you would find um in a nuclear gas site. What I'm going to do just you see on the screen here um I have got set for a laptop. Now this is what I would use as my engineering workstation. So this is what an engineer would come into the site with to uh commission a PLC, make changes um or to do tests and and it's a

separate laptop. It would be isolated from internet and hopefully have some security tooling on it. Now just so we can see what happens here, I'm going to put this on to this laptop. The effects is the same. So, I've got a a USB here with um some software and also a PDF. Now, I'm going to open this PDF with Adobe. Um no, it does not. So, in normally what I show you is this PDF being opened. Now, the PDF has got code running in the background of it and essentially um that hidden from the engineer. It looks as if it's from the Alan Bradley website. They've actually been on to the Alamody website who's the vendor of PLC. They

downloaded that and they've bought on site. What they didn't realize at the time was that that vendor had actually been hacked and what they've done embedded malicious code to the back of the PDF and they then um downloaded that slide. Now that's called watering hotel. So rather heavily on the the behalf of the attackers rather than hacking 10 15 different companies they g you know what let's put some dodgy malware on the vendor website and let's have some kind engineers walk that on site for us and plug it directly into their networks. So instead I'll run this which does exactly the same thing. Now what we'll see is we've got some changes on the the screen

here. So, the first thing you might have noticed there is our coolant flow motor has turned off. So, that means we're no longer pumping coolant into our core. Um, that's not ready. The second thing you might see is in the bottom right hand corner there, we've got an alarm temperature set point that's changed now from 600° to,500. So, we're now getting into some pretty serious and dangerous territory uh before um we are kind of notified about that that unsafe condition occurring. As you can see now, we've got above that 600° mark and that temperature is going to continue rising. Now, coolant flow rate is still at 80%. But we've got no pump. So how can we do

pumping 80 80% if we've got no pump running? So what's happened here is the malware is not only affected those points but it's also manipulating that column flow rate value to read the operator as if something's happening that's not. about information security we use the CI model to conf

[Music] sorry the availability is paralle we need to know what operations at what the next most important thing is the integity of that data so we need to know that the data that we're being told is the correct data because that's what making decisions that potentially have got life or death consequences. There's environmental impacts and financial impacts that are massive depending on what it produces. We're an oil plant producing millions of l.

So the fact that we've now lost the integrity of our our system um is really quite concerning. Those of you who have heard the attack um called Dutch, this followed a very similar thing. Essentially, this was um an attack sort of done by the CIA and the the Israeli intelligence agency. They targeted an Iranian um centrifuge system. So that's our alarm hitting 1500° off. So essentially that bad attack targeted an uranium um nuclear site. They were enriching uranium. Now what it did I'll just paint back over there. [Music] What that did was target the centuage system. And the way they work is they're big mass tubes. They contain uranium. They spin really fast and that purifies

and enriches um the the uranium. Um they managed to manipulate that so the actually spam way too fasting and that resulted in physics to the plant. Now what was really clever is they essentially re the previous day's operations to them. So if you think of the Simpsons Simpson control he was actually watching yesterday data thinking everything's ready to be everything was on fire. Now that's not the only um example of malware that we've seen target control systems. There's also been uh the indestroyer attack in Ukraine and this targeted witnesses uh or exploited um industrial protocols essentially um which granted unauthorized control and allowed them to manipulate the circuit breakers within the Ukrainian um substances causing a

blackout uh within the capital there. Um and they also use aware um on their system to sort of clear that but also delay that um restoration of services and they make that even harder which is why um backups are so in these situations. There's also um the tri attack or the crisis which occurred to um an oil company in Saudi Arabia and this is quite an interesting one because it's the first time we've seen the safety system specific targeted and it targeted the architecture of those safety controllers and it essentially just allowed unsafe conditions to occur on the plant. Now, um, the Russians decided that they haven't had enough fun with Ukra. So they revamped in destroyer into

indestroyer 2 and it essentially built on the um the abilities of the original um the original uh software but further exported something called the I660 protocol which is like an IP based protocol um for electricity substations. Um and this time they focused on the transmission as the high voltage network. So there's a couple of bits uh I've put in the wrong orderer cuz I'll give you the presentation already. But this is the architecture of our our system here. So our box we have a PLC as I said that is the the logic controller controlling what happens. We've got a human machine interface which is the screen that we were showing um before and then the engineer station

in which we plug into um our USB. What I've not been able to show you unfortunately is basically his story and this is um this is where companies are starting to um struggle with security. So traditionally we've relied on the air gap to say our systems are connected to our business networks and they're not connected to the internet. More and more now we're looking to try and extract business data out of these systems. sorry trying to express industrial data out these systems in order to use it for good purposes. Now these devices they they do cars are connected to them and they wear time and and they can be tweaked to to improve that performance

and sometimes we want to look at that data and see what it's doing. Now, traditionally that would have gone into Historian and nothing really would have been done with it because we can't safely get it out into the business network. So, we can plug it into our S6 tool, put it over a PowerBI dashboard and see what's going on there. Now, I want to talk about what these devices are. This is data diode. Essentially, this is a networking device which only allows data to travel in one direction. So, it's like a firewall, but it's done at hardware level. It only allows data to travel in this direction through the use of fiber optics. So fiber optics

work by essentially you've got a glass tube car data in form of light and you have a laser. Now laser can go away if you put a laser there and you fire both at the same time. Now what we've done here is remove the um the laser at this. So we find data in this direction from system A through to system B but data physically cannot come back through that connection from B back to system and that is the hardware it's physically possible to to do that opportunities in terms of what we can start doing uh with our data in these environments and how we can safely start extracting them um for the use cases

that managers are increasingly interested in. So, as I say, did this in the wrong order, but yeah. So, how do we defend against these sorts of attacks? So, I simplify this down. There's a lot of ways that you can defend against these threats, but I think when you look at it from a a really high level, it boils down to around four things. Now people people are essentially the biggest weakness in any organization. Um it doesn't matter if you have the best security. They have the latest tools already patched. Someone who wants to do something will find a way. But although we're asking people who job isn't to start doing things for a science student purpose, I don't

necessarily understand why. So in this example, we've walked nowhere on site using now banned on site, but that's not stopped our idea doing this. They're also susceptible to fishing attacks and other forms of social engineering um and they get tired um and don't know necessarily what to do in every situation. Then you've got processes. Now in this space typically the the operational technology space and largely with engineers. Now engineers like things to be written down the processes and standards and they're really good at following them. Now cyber security is now coming into their world and saying you need to do things this way because of cyber security. we need to interact with them in a way that they

understand and that is through use of processes standards and and governance. So understanding the risks in the systems and developing solut to to treat those risks and then doing everything that goes on with that in terms of the control insurance and and monitoring. without technical controls. There's a a lot of people here um that will want to be looking at the really specific vulnerabilities that have been used in this attack and what could be done to prevent that. I'm going to be really open and honest with you. This is a really unsecure system and the reason it's unsecure because I need to I need to do this presentation in 10 to 15 minutes otherwise if I stop.

So the way this is happening is essentially we're using the master class is not encrypted. It's not authenticated. So a USB in this case file that contains really nice code measure. So there's ways of securing that. Obviously we can start using protocols um and authenticate them. Um but there's layers to to this. Now that device is is the the end control and there's obviously layers of security that around that there's networking devices there service all of those things can be technically secured but again in this example this comes down to people. about if it is decided to work today. I do it has also broken. So what I prepar

they create essentially what it is is in this case we have a desktop system and it's got multiple bars on it. And this has got something like on it. So looking at all different types of text and not just one one area and what that allows you to achieve is something like 99.8% section on malware. So the process that sits behind that is that before someone comes on site to use USB stick or their own laptop, you might have to maintain your system using their own laptops. You plug that in. They also have a a USB stick to check the and whatnot. So rather than just trusted files on your USB stick, you run them

through the the scan and let you know if there's any files on there. But it can also start doing things um a bit more a bit deeper as well. So um for example, the code that I'm using, it's not micious. is three of us code for changes registers register on this PLC inherently that is not malicious and there are I think there would be valid use cases for someone using file to a PLC but what we just to look for is things like at the country of origin so we've got PLC it's an American company and the example of PDF that may have been a file originated from Beijing. Now when it looks files, it

looks dile. [Music]

No, not so again one of the technical controls looking at our supply chain, our software supply chain. Where is our information data handled or we bring in and on site then it's just another step as well as things like data diodes um in preventing these sort of incidents but physical security is also really important. Now these control systems can sometimes be a armed guard facility. Power station is not locked at night. But sometimes these systems are if you think of the electricity network, you've got substations out in the middle of nowhere providing 400,000 k of electricity through it. about is it to have a man with the dog or not? Um because quite cheap to go and break things off

because that would hurt. But you have an equipment network connected station. You could do some range station on the network. But physically securing that break into it is is really the first to face getting into the building and they can't interact with our equipment. We obviously can't rely on that. you still have to have the controls around user access control and also those and then just as importantly respond. So time and time again see that we work with having very little in the way of backups of their critical system backups that and that's not being tested is not much use because if it doesn't work then you really are suggest So these are the sort of things that is

um it's around having a holistic security approach there 99.9% doesn't stop the zero attack before it has to be a layered approach security and that's the reinforcement thing and it all comes that I think to to people are running these operations interacting with these systems and they they don't have any choice but to do that somewhere to to go and reprogram some equipment networks we can't tell them they can't do their job with any stick we have to think ways to to make that is the risk [Music] of the lights are going out. So it's all about weighing that risk and understanding the controls that we can in order to secure the environment. um impressions

shows that I live in an IP connected world. If the data die only goes in one direction, there would be no acknowledgement, no error correction, yes risk. So it depends on what often these something called capture. So um there's some software that sits on it and pitches it over the D and there's software on the other end that catches it and reads into that's where [Music] all those things probably [Music] in the space and for sending data things by other investigation. But if we're just really from it to understanding more than it has been in the last six months or is the level getting you know an executive engineering view on that then we care about the accuracy

of it but the criticality of that accuracy is less than how with this device in our modern history. We've got people engineers turning up their laptop and making laptop part of the part that belongs to the station fix that problem everywhere. Why don't we just have all devices holding AI such that all pieces of code things like that come down from the manufacturer inside that device could not come by any other group. So um really challenging um in these environments. So um one of the problems one of the things they are working usually so you don't have time to device in the network. Um cuz the reason um security monitoring on these devices is really quite challenging because even

though these are getting um more and more like commercial products we have to um we have to allow that data to work in absolute real time. So when we start doing things like security, it would be very unadvisable to do active public in these environments because you could potentially dis the traffic arriving in the the time that it's when you're bringing down new codes instruction. anything else entering that conceptual ring need to be you need to make sure it's only coming from manufacturing. >> So there are um soap for example have a product that does that. So they have essentially a dropbox solution in the cloud. It passes us data into that drop in whatever you want to do there and it

pops out one of those kiosk or you can jump over that um that boundary so this is around how you apply those tech controls um and Yeah, that sort of isful project [Music]

except you have thought that infrastructure had a black box. No, data stories have been around for for quite a while. They're not like essentially a database of it's not datual database. There's a company called PNET [Music] that store all the data. last weekend. I think what's been happening is the use of that

is what happens

[Music] or analytics and information. So this is where the using technology which wasn't necessarily designed to be managed in the best ways

[Music] that somewhere on a post screen. So is this where is having to catch up where it is historically not been not working. So to give you an example before I move into consulting I had um one of the most important positions on site was running on window server 2000. Now I didn't know what that was when I was to go and take a back on it. I actually needed that that device hadn't beened in about 8 years. Um actually a whole new system sports operating system. Um so those are the sort of challenges that when you're working with these systems we can't just reink you can't reate our um particularly often um so patches

and this is this is part of the challenge is it is inherently difficult to do security in this environment but we have to find a way because we're finding that there being prompted more and more. There are now specific groups that are looking to take down systems. Um, and part of that is potentially a lot a lot more vulnerabilities in the systems these devices that may because they're kindable more people are interested in this more research groups looking for vulnerabilities. But you're starting to see this make it way into the main there are films that talk about a magic USB that seems to every exist public

suggest the ide [Music]

[Music] on on diodes as the real end. What I tend to see is that from [Music] it risk it doesn't actually reduce

any

where do you have firewalls that rules this way and there are devices that can

do anything but what it does is that risk of if you want to get really environment with lower trust and you definitely do not want someone that way is the safest option because there's no cable in the wrong way. There's no opportunity error in terms of incorrect warning. [Music] So that's that's where [Music]

>> exactly the networking

back down. So it's around these devices more creating opportunities to use datar [Music]

[Music]

[Music] idea. doing something devastating a single is quite scary but slightly less do you see a lot of use of like hardware >> yeah so certainly that was the fact so a few years ago so what you would have is the equipment power This would be what I call the basic control system. is the process and interacting the process. What you then have is a safety system and that is something that traditionally has been very soft with that and that's as

[Music] any any further um electricity in this case. Um, increasingly we're starting to see more of that digitiz and there are examples of basic control systems and safety in one product which is a risk decision that needs

to electro mechanical frame. safe is that in my opinion it's kind of the safest thing to have to prevent that really bad from happening if everything goes goes wrong in the process of that past I think accelerator radio they thought software and the software was quite right Exactly. Yeah.

And really you're just what you're demonstrating now talking about like scanning systems really just moving the trust back how secure that system is because recently sh you know dropped the things that it just sp and it yeah table sort of thing, you know, but it was like they decision. >> Yeah. Yeah. And um obviously so this is a security research. There is certain level of trust that that goes into that obviously themselves are not unable to make a mistake. There was a recent incident that caused quite a big outish worldwide where um that software update was every Windows device in the world crash. These things do do happen. You have to trusting this device.

[Music] You don't have to [Music] process potentially whereas some of the stuff we talking about could be critical. >> Yeah.

in terms of understand [Music]

that organizations make risk based decisions around how those controls organizations need to to improve on generally risk articulation risk to me is is decision as well. [Music] Yeah.