After gathering information about a target,
an adversary is in a position to design the first stage of an attack,
which is to gain an initial foothold in the target environment.
This course won't go into detail about the technical aspects of gaining access.
Pluralsight has a number of other courses on this topic,
some of which we'll touch on later.
However,
let's take a look at some of the general types of attack
used by adversaries to gain access.
An adversary may encounter a number of different
architectures to gain access to an OT environment.
The first and most straightforward is a direct connection to the internet,
albeit via a firewall.
In this example,
since the corporate network and OT network are both behind the same firewall,
then email, internet access, and a number of other services will be permitted.
It's therefore fairly straightforward for an adversary to deliver a
weaponized payload into the corporate IT environment and then to look
for ways to move laterally to the OT network.
In the second example, the OT network is in a screened subnet,
sometimes referred to as a demilitarized zone,
or DMZ.
In this situation,
the adversary has a bit more work to do to move from the
corporate network to the OT network.
Well‑configured screened subnets will tightly control network traffic
and only allow certain traffic in one direction,
but poorly configured networks, weak authentication controls,
or vulnerable services, for example,
can make traversing a screened subnet trivial.
In the third example,
a physical air gap separates the OT network from the internet.
In this case,
it's impossible to pivot directly from the corporate
network to the OT environment.
An adversary, therefore,
needs to look at other elements of the OT attack surface,
such as wireless networks, transient cyber assets,
and supply chain attacks.
In a drive‑by compromise,
a user's web browser is targeted and exploited simply
by visiting a compromised website.
This is a type of strategic web compromise,
also known as a watering hole attack.
The adversary compromises the websites of trusted third‑party
suppliers or other industry‑specific groups,
which are often visited by the target organization.
From at least 2011 through to 2016,
the Dragonfly threat group utilized watering hole attacks on
energy sector websites by injecting a redirect iframe to deliver
various types of ICS‑specific malware.
Adversaries can leverage weaknesses in various types of internet‑facing
software to gain initial access into an industrial network.
Internet‑facing software can take the form of user applications,
underlying networking implementations, or even an asset's operating system.
As we saw in an earlier demo,
ICS often provide public‑facing applications to provide direct
access into an ICS environment or the ability to move into an ICS
network for ease of administration.
These are the sorts of bad decisions that can be made
when availability becomes the priority.
In 2014,
the Sandworm Team exploited vulnerabilities in various manufacturers' HMI
devices that were directly exposed to the internet.
External remote services, such as VPNs, Citrix,
and so on,
allow users to connect to internal network resources from external locations.
Vendors and internal engineering groups will often have
access to external remote services to control system
networks via the corporate network, and in some cases,
access is enabled directly from the internet.
This is convenient, but it's a liability.
Adversaries can exploit these services to gain access to and
execute attacks against a control system network.
In the 2015 incident,
the Sandworm Team harvested VPN worker credentials and used them to
remotely log in to electricity grid control system networks.
Adversaries may target devices that are transient across
ICS networks and external networks, such as USBs,
CDs, or handheld scanning or monitoring devices.
Normally, transient assets are brought into an ICS environment legitimately,
but don't remain there permanently.
Adversaries can target transient assets when they're connected to
an external network and then leverage the trusted access in an OT
environment to install malware.
Stuxnet was a computer worm delivered by a malware‑infected USB drive
that infected software at industrial sites in Iran,
including a uranium enrichment plant.
The virus targeted industrial control systems,
compromised the system's logic controllers,
spied on the target systems,
and provided false feedback to make detection more difficult.
Another vector to attack industrial control systems is Wi‑Fi. Wi‑Fi and
other wireless connected devices are growing in popularity in ICS
environments with the development of smart instruments because they ease
deployment, administration, and troubleshooting. Adversaries can
compromise and gain access to wireless networks with the aim of listening
to, modifying, or disrupting communications. Identifying and compromising
wireless networks is an effective technique for accessing so‑called
air‑gapped networks.
In the 2000 attack against the Maroochy Shire water services network,
a disgruntled employee disrupted a radio‑controlled sewage processing system
by issuing commands with stolen two‑way radio equipment.
The attacker was also able to communicate with and set the frequencies of the
target's repeater stations and manipulate equipment that controlled the
discharge of sewage. Supply chain attacks use a third party to reach a target.
An adversary attacks company A because they provide a product or service and
therefore a route through to company B, which is the ultimate target.
Historic examples include Target in the US where customer
credit card information was stolen by an adversary who
compromised an air conditioning contractor.
In 2014, F‑Secure Labs analyzed the approach the Energetic Bear threat actor
took to compromise Target's systems with Havex malware.
The adversary planted Trojanized software on legitimate ICS vendor websites.
After being downloaded, this software infected the host
computer with a Remote Access Trojan, or RAT.
If you'd like to learn more about the techniques for gaining
access to and exploiting a target environment,
then Pluralsight has lots to offer to support your learning. Attacks and
Exploits as part of the CompTIA PenTest+ certification path and covers
network, wireless, application, and cloud attacks, as well as
specialized attacks and post exploitation.
Hacking Wireless Networks is one of a number of courses on the Certified
Ethical Hacker certification path presented by Dale Meredith.
Other courses on this path cover recon, scanning,
enumeration, and vulnerability analysis.