mark11
Member
Joined: 30 Mar 2014
Posts: 114
|
 Posted: 13/06/2017 18:55 Post subject: Win32 / Industroyer: a new threat to industrial control syst |
 |
|
Win32 / Industroyer: a new threat to industrial control systems
Win32 / Industroyer is a complex malicious program designed to disrupt workflows in industrial control systems (ICS), in particular, in electrical substations.
The Win32 / Industroyer creators are distinguished by high qualification and a deep understanding of industrial control systems and communication protocols in the electric power industry. It is unlikely that anyone could write and test such software without access to specialized equipment that is used in the target environment.
The authors of the malicious program implemented support for four industrial protocols, described in the following standards:
IEC 60870-5-101 (IEC 101)
IEC 60870-5-104 (IEC 104)
IEC 61850
OLE for Process Control Data Access (OPC DA)
In addition, the authors of Industroyer have developed a tool for performing DoS-denial-of-service attacks aimed at certain relay protection devices, in particular, the Siemens SIPROTEC line.
The features of Win32 / Industroyer are impressive. If we compare it with the tools used in the attacks on the Ukrainian energy system in 2015 and led to massive power outages on December 23, 2015 (BlackEnergy, KillDisk and other components, including legitimate software for remote access), it can be argued that for Industroyer there is a cyber group Higher level. The authors created a malicious program that allows direct control of circuit breakers and circuit breakers in a network of electrical substations. By some indications, we assume that Industroyer may be associated with a power failure in Kiev in December 2016. Nevertheless, at the time of writing the report, this has not been confirmed, and the investigation continues. The infection vector is not yet installed.
Industroyer consists of several modules, the description and analysis of which are presented in the following sections of the report. Before proceeding to details, we propose a simplified scheme that shows the connection between the components of the malicious program.
Figure 1. Simplified scheme of Win32 / Industroyer components.
Some components (including the data eraser) are similar in concept to the tools used in BlackEnergy's attacks on Ukrainian energy companies in 2015. However, we do not see a link between past attacks and the code for new malware.
The main backdoor
The main component of Industroyer - the main backdoor - is used by attackers to control the rest of the program components.
As it should be backdoor, this component is quite simple. It connects to the remote C & C server through HTTPS and receives commands from attackers. All the samples studied are rigidly programmed to use the same proxy address located on the local network. Thus, the backdoor is clearly designed to work in a specific organization. Also worth mentioning is that most C & C backdoor servers use Tor.
Perhaps the most interesting feature of the backdoor is that attackers can specify a particular hour when the malware is active. For example, you can modify the backdoor in such a way that it accesses the C & C server outside of business hours. This complicates detection, based only on checking network traffic. Nevertheless, all the samples studied to date, worked around the clock.
Figure 2. Decompiled code of the main backdoor with the ability to set the time.
After connecting to a remote C & C server, the main backdoor sends the following data to the POST request:
The GUID (globally unique identifier) string for the current hardware profile, obtained using the GetCurrentHwProfile function
Version of malware - 1.1e
Hardcoded sample ID
The result of any previously obtained command
The hard-coded ID is used by the attackers as the identifier of the infected machine. Among all the samples studied, we found the following ID values:
DEF
DEF-C
DEF-WS
DEF-EP
DC-2-TEMP
DC-2
CES-McA-TEMP
CES
SRV_WSUS
SRV_DC-2
SCE-WSUS01
Having received administrator rights, attackers can update the installed backdoor to a more privileged version that runs as a Windows service program . To do this, they need to select an existing non-critical Windows process and replace the ImagePath registry ImagePath with the path to the new backdoor binary file.
The functionality of the main backdoor, which works as a Windows service, is identical to the one described. But there are two small differences: the name of the backdoor version (1.1s instead of 1.1e) and code obfuscation. The code for this version of the backdoor is mixed with unnecessary assembler commands.
Figure 3. Obfuscated assembly code of the main backdoor operating as a Windows service.
Additional backdoor
An additional backdoor provides an alternative mechanism for stability, which allows attackers to restore access to the target network if the main backdoor is detected and / or deactivated.
Backdoor is a trojanized version of the Windows Notepad application. This is a full-featured application, but virus writers have added malicious code to it, which runs every time it runs. Further, having received administrator rights, attackers can manually replace malicious Notepad legitimate.
The added malicious code is strongly obfuscated. After decryption, it connects to a remote C & C server (different from the C & C main backdoor) and loads the payload. It has a shell code format that is loaded directly into memory and executed. In addition, the added code decodes the source code of Windows Notepad, stored at the end of the file, and then passes it to execution - so the application is working properly.
Figure 4. Comparison of the autentic binary code Notepad (left) and backdoor.
Launcher
A component is a separate executable file designed to run the payload and the data eraser component.
The startup component contains a specific time and date. In the samples studied, two dates were set: December 17 and 20, 2016. As soon as one of the two dates occurs, the component creates two threads. The first one tries to download a malicious DLL, the second one waits one or two hours (depending on the version of the component), and then tries to load the data eraser component. Both threads have the highest priority THREAD_PRIORITY_HIGHEST , which means that they receive a higher share of CPU resources.
The name of the malicious DLL is added by the attackers through the command line option provided in one of the commands of the main backdoor ("Run the shell command"). The name of the data eraser file is always haslo.dat . Expected command lines look like this:
%LAUNCHER%.exe %WORKING_DIRECTORY% %PAYLOAD%.dll %CONFIGURATION%.ini
Each command line argument indicates the following:
• %LAUNCHER%.exe - the name of the startup component file
• %WORKING_DIRECTORY% - the %WORKING_DIRECTORY% in which the malicious DLL and the configuration are stored
• %PAYLOAD%.dll - the name of the malicious DLL file
• %CONFIGURATION%.ini - a file that stores configuration data for a specific payload. The path to this file is passed by the malicious DLL startup component
The payload and the data eraser component are standard Windows DLL files. To be loaded with the startup component, they must export the Crash function as shown in Fig. 5.
Figure 5. An example of a malicious DLL with the internal name of Crash101.dll and the exported Crash function.
Component 101
A malicious DLL with file name 101.dll is named after the international standard IEC 101 (also IEC 60870-5-101 ), which describes the protocol for monitoring and managing power systems. The protocol provides communication between industrial control systems and remote terminal units (RTUs). The data is exchanged via a serial connection.
Component 101 partially implements the protocol described in the IEC 101 standard. It is able to communicate with the RTU and any other device that supports this protocol.
After execution, component 101 analyzes the configuration stored in the INI file. The configuration can contain several entries: process name, Windows device names (usually COM ports), the number of ranges and range values for information object addresses (IOA). IOA is a number that identifies a particular data item in the device. In Fig. 6 shows the configuration file of component 101 with two defined IOA ranges: 10-15 and 20-25.
Figure 6. Example of component 101 configuration.
The name of the process specified in the configuration belongs to the application, which, as the attackers suggest, works in the victim system. This should be an application that the machine uses to communicate with the RTU via a serial connection. Component 101 attempts to terminate this process and accesses the specified device using the Windows API CreateFile , WriteFile and ReadFile . The first COM port from the configuration file is used for actual communication, the other two are open to prevent other processes from accessing. Thus, component 101 can assume control of the RTU.
The component iterates over all IOA ranges. For each IOA, it creates instruction and execution instruction packets with a single-point ( C_SC_NA_1 ) and a two-position command ( C_DC_NA_1 ) and sends them to the RTU. The main purpose of the component is to change the value of the On / Off switch for single-point and two-position command type IOA. So, in the first stage, the component tries to switch the IOA to Off, the second - On, in the final stage - to return to the value Off.
Figure 7. An example of a disassembled payload package in Kaitai Struct WebIDE.
Component 104
The DLL with file name 104.dll is named after the IEC 104 standard ( IEC 60870-5-104 ). The IEC protocol 104 complements IEC 101 so as to transmit data over TCP / IP. Due to the flexible configuration, the component can be configured by attackers for various equipment. Fig. 8 shows how the configuration file might look like.
Fig. 8. Sample of the component 104 configuration DLL.
After executing the DLL, component 104 will attempt to read the configuration file. The path to the configuration file is taken from the bootloader component.
The configuration contains a STATION section, followed by properties that define the operation of component 104. The configuration can contain numeroase STATION records.
After reading the configuration file, component 104 creates a process for each STATION fragment, one for each. In each such process, component 104 will attempt to communicate with the specified IP address using the protocol described in the IEC 104 standard. Before establishing a connection, it will attempt to complete a legitimate process that must be responsible for communicating with the device. This only happens if the stop_comm_service property is registered in the configuration. By default, component 104 terminates the process with the name D2MultiCommService.exe , or with the name that is specified in its configuration.
The basic idea of using component 104 is relatively simple. It communicates with the specified IP and starts sending packets with the ASDU address specified in its configuration. The purpose of this data exchange is to atingere the IOA of the single-position command type. In the configuration file, the attacker can determine the operation property to indicate how the IOA addresses of the single-item type will be polled.
The first such operation is range . Hackers use it to detect possible IOA in the device of interest. They have to apply this approach, because the protocol described in the IEC standard 104 does not provide a specific method for obtaining this information.
During the first, after receiving the IOA range from the configuration file, the component 104 connects to the target IP address and polls the specified IOA. For each of these IOAs, the component 104 transmits the selection and execution instruction packets for state change and whether the IOA refers to a single-position command type.
Fig. 9. An example of a decoded Wireshark package component 104.
Once all possible IOAs have been polled from a certain range, component 104 goes to the second stage of the range mode. If the ability to write to the logs is enabled, the component will record the Starting only success . The rest of the second stage consists in an endless cycle of using the previously discovered IOA single-point type. In the loop, the component continuously transmits the selection and execution instruction packets. In addition, if the change option is defined, the component toggles the On / Off state between the cycle steps.
In Fig. 10 shows a log file that issued component 104 during our analysis. From this we see that the component polled the IOA from 10 to 15 and, when the IOA single-point type were detected, began using them in a cycle. In the configuration, the change option was enabled, so between the cycles, the component switched the switch value from On to Off and wrote it to the log.
Fig. 10. Example of the logs of component 104.
The second mode is operation - shift . It is very similar to the range mode. The attacker determines in the configuration file the IOA range and the values to be changed. After activating component 104, everything goes exactly the same as in range mode; However, as soon as all IOA in a certain range are polled, it begins to poll a new range. The new range is calculated by adding the default range and the shift values.
The third mode is operation - sequence . It can be used by hackers after they learn the values of all IOA single-command types supported by the connected device. This component will immediately begin executing an infinite loop, passing the selection and execution packets to the IOA specified in the configuration file.
In addition to being able to write to the log, component 104 can output debugging information to the console, as shown in Fig. eleven.
Fig. 11. Output to the console of the component 104.
Component 61850
Unlike components 101 and 104, there is a separate malicious tool consisting of an executable file called 61850.exe and DLL 61850.dll . Named after the IEC 61850 standard . This standard describes the protocol used to exchange data between devices of different manufacturers that perform the functions of protection, automation, measurement, monitoring and control of automation systems of electrical substations. This is a complex and reliable protocol, but component 61850 uses only a small number of its parameters to lead to devastating consequences.
After executing the DLL, the component 61850 tries to read the configuration file, whose path is provided by the startup component. A stand-alone version takes the configuration from i.ini . It is expected that the configuration file contains a list of IP addresses of devices that are able to exchange data using the protocol described in the IEC 61850 standard.
If the configuration file is not found, component 61850 numbers all connected network adapters to determine their TCP / IP subnet masks. The component then numbers all possible IP addresses for each of the subnet masks and tries to connect to port 102 of each address. Thus, the component can automatically detect suitable devices on the network.
In another case, if the configuration file is found and contains the target IP addresses, the component connects to port 102 to these addresses and found automatically.
Once this component is connected to the target host, it passes the request packet to the connection using a connection-oriented transport protocol, as shown in Fig. 12.
Fig. 12 Decoded connection request packet in Wireshark.
If the target device responds properly, component 61850 sends the InitiateRequest packet using the Production Message Specification (MMS). If the expected response is received, it sends a MMS request to getNameList . Thus, the component compiles a list of object names in the virtual production device (VMD).
Then, component 61850 numbered the components found in the previous step, and sends subject-oriented queries to getNameList with each object name. Thus, the component enumerates the named variables in a particular domain.
Fig. 13. Decoded MMS request getNameList in Wireshark.
Component 61850 then parses the information received in response to these requests and looks for variables that contain the following string sequences:
CSW, CF, Pos and Model
CSW, ST, Pos and stVal
CSW, CO, Pos, Oper, but not $ T
CSW, CO, Pos, SBO, but not $ T
The CSW sequence is the name of the logical node that is used to control circuit breakers and switches.
For variables that contain the Model or stVal sequences, component 61850 sends an additional MMS Request Read . For some of these variables, the component can also send a MMS Write request, which will change their current state.
Component 61850 will create a file with logs of its work, containing IP addresses, MMS domains, named variables and the state of nodes (open or closed) of its targets.
Component OPC DA
The OPC DA component implements the client for the protocol described in the OPC Data Access specification. OPC (OLE for Process Control) is a software standard and a specification based on Microsoft technologies such as OLE, COM and DCOM. The part related to data access (DA) of the OPC specification allows real-time data exchange between distributed components based on the "client-server" model.
This component exists as a separate malicious tool with the file name OPC.exe and DLL, which uses the functionality of both 61850 and OPC DA components. The internal name of the DLL in the exported PE table is OPCClientDemo.dll , which suggests that this component can be based on an open source OPC Client project.
Fig. 14. The PE table shows the internal DLL name of the OPC DA component.
The OPC DA component does not require any configuration file. After execution by the attacker, he numbered all the OPC servers using the ICatInformation::EnumClassesOfCategories with the category identifier CATID_OPCDAServer20 and IOPCServer::GetStatus to determine which ones are running.
The following component uses the IOPCBrowseServerAddressSpace IOPCBrowseServerAddressSpace to number all OPC server elements. Specifically, it looks for items that contain the following sequences in the name:
CtlSelOn
CtlOperOn
CtlSelOff
CtlOperOff
\ Pos and stVal
Element names suggest that attackers are interested in OPC elements provided by OPC servers that are related to ABB solutions, such as the MicroSCADA line. In Fig. 15 shows a sample of OPC elements that contain names with similar string strings. This list of OPC elements is obtained by the ABC process object list tool from ABB.
Fig. 15. An example of the names of OPC elements in the IN field, obtained using the OPC process object list tool.
Attackers use the Abdul line when adding a new OPC group. Perhaps this line is used by attackers as a slang name for ABB solutions.
Fig. 16. The disassembled code of the OPC DA component that uses the Abdul string.
At the final stage, the OPC DA component tries to change the status of detected OPC elements using the IOPCSyncIO IOPCSyncIO , setting the value 0x01 twice.
Fig. 17. Disassembled code of the OPC DA component that uses the IOPCSyncIO IOPCSyncIO .
The component specifies the name of the OPC server, the status of the OPC element name, the quality code, and the value in the log file. The recorded values are separated by the following header lines:
[* ServerName:% SERVERNAME%] [State: Before]
[* ServerName:% SERVERNAME%] [State: After ON]
[* ServerName:% SERVERNAME%] [State: After OFF]
Eraser component
The Data Wiper component is a destructive component that is used in the final stage of the attack. Hackers use this component to cover up tracks and complicate the recovery process.
The file name of this component is haslo.dat or haslo.exe , it can be executed by the launch component, or it can be used as a separate malicious tool.
After execution, the component tries to enumerate all the keys in the registry that lists the Windows services.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
It tries to set the value of the ImagePath registry with an empty string in every detected record. This will cause the operating system to stop loading.
The next step is to delete the contents of the file. The component numbers files with certain extensions on all drives connected to the computer, from C: \ to Z: \. It should be noted that during the enumeration the component skips files located in the subdirectory that contain the word Windows in the name.
The component replaces the contents of the file with meaningless information received from the contents of the new allocated memory. To perform this operation properly, the component tries to overwrite the files twice. The first attempt occurs when the file is detected on the drive. If the first attempt is unsuccessful, the component makes a second attempt, but before this completes all processes except those included in the list of critical system processes. The list of processes is shown in Fig. 18.
To speed up the erasure process, the component overwrites only part of the contents of the file at the beginning of the file. The amount of information that will be overwritten depends on the size of the file.The smallest amount of information to be rewritten in a size of 1 Mb (4096 bytes) of files or less. The greatest amount of information will be overwritten in 10 Mb file size (32,768 bytes) or less.
Finally, the component is trying to complete all processes, including system, except his own. This will cause the system to stop responding and eventually fails.
Fig. 18. A list of processes that do not terminate at the second attempt.
Masks for file names that correspond with eraser component:
SYS_BASCON.COM
* .v
* .PL
* .paf
* .v
* .XRF
* .trc
* .SCL
* .bak
* .cid
* .scd
* .pcmp
* .pcmi
* .pcmt
* .xml
* .CIN
* .ini
* .prj
* .cxm
* .elb
* .epl
* .mdf
* .ldf
* .bak
* .bk
* .bkp
* .log
* .zip
* .rar
* .tar
* .7z
* .exe
* .dll
This list contains the file name extensions that are used in standard environments such as binaries Windows (.exe / .dll), archives (.7z /.tar/.rar/.zip), backup files (.bak / .bk /. bkp), Microsoft SQL server files (.mdf / .ldf) and the various configuration files (.ini / .xml). Additionally component erases files which can be used in industrial control systems, for example, written using language Substation Configuration Description (.scl / .cid / .scd), as well as files and extensions are used products ABB.
For example, a file named SYS_BASCON.COMusing ABB solutions for information storage configuration, and files with the extension .paf( Product Authorization File) - to store information on licenses for products ABB MicroSCADA.
Additional Tools port scanner
Arsenal attacker includes a port scanner, which can be used for drawing up the network cards and the search computer relating to their attack. That is interesting, instead of using already existing software, hackers have created their own port scanner. As can be seen from Fig. 19, they can assign a range of IP-addresses and ports of the network range to be scanned by the instrument.
Fig. 19. An example of using a port scanner.
Additional tools: DoS Tool
Another tool in the arsenal of hacker - the refusal tool in the service (DoS), aimed at the Siemens SIPROTEC devices. The tool exploits the vulnerability of the CVE-2015-5374 , to cause hang-ups. As soon as this issue will be used, the device will not respond to any commands until then, until it is restarted manually.
To exploit this vulnerability, attackers have hardcoded in DoS-tool IP-addresses of the devices. When using the tool sends a specially crafted packet to port 50000 on the target IP-address using UDP (User Datagram Protocol). UDP packet contains a total of 18 bytes.
Fig. 20. Content UDP packet involved using vulnerability CVE-2015-5374.
Conclusion
Investigation of power outages in Kiev in December 2016 has not yet been completed. At the moment, there is no evidence that Industroyer became the direct cause of the failure. Nevertheless, we believe this version quite likely because the malware allows you to directly control the switches and circuit breakers in electrical substations network using ICS protocols, and contains a label activation time December 17, 2016 - the day of power outages.
We can say with confidence that the Win32 / Industroyer family - an advanced and sophisticated malware, targeted at industrial control systems. The problem is that the malware - only a tool in the hands of even more advanced and skilled attackers. Kibergruppa behind Industroyer, can adapt the program to any such environment.
Widespread industrial protocols used by Industroyer, created decades ago, without taking into account security issues. Thus, any interference in the work of hackers industrial network, where these protocols are used, known to lead to serious consequences.
infection indicators (IoCs)
| Code: | Hash SHA-1: IP-address C & C servers:
F6C21F8189CED6AE150F9EF2E82A3A57843B587D
CCCCE62996D578B984984426A024D9B250237533
8E39ECA1E48240C01EE570631AE8F0C9A9637187
2CB8230281B86FA944D3043AE906016C8B5984D9
79CA89711CDAEDB16B0CCCCFDCFBD6AA7E57120A
94488F214B165512D2FC0438A581F5C9E3BD4D4C
5A5FAFBC3FEC8D36FD57B075EBF34119BA3BFF04
B92149F046F00BB69DE329B8457D32C24726EE00
B335163E6EB854DF5E08E85026B2C3518891EDA8
195.16.88[.]6
46.28.200[.]132
188.42.253[.]43
5.39.218[.]152
93.115.27[.]57 |
Attention!Most servers with these IP-addresses were part of the Tor network, which means that the use of indicators can give a false positive match. |
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
