on this talk we're going to talk about
the latest and wildest iot attacks I've
observed over the last year
specifically it was starting about
recent years but just last year we've
been enough to to make a hell of a talk
so
with that in mind let's Dive In
so first about me my name is Brock
Steinberg I'm a Founder at White pointer
Security Services Company I also have
this funny title of akarin residence at
Venture Capital wild Ventures
uh I was offered at sentiment one labs
and speaker at conferences and and love
sharing knowledge and working with uh
with people towards that I did my
masters in algorithms in in computer
science and I love doing research from
algorithms to analyze manager in the
wild and much much more
um I'm also a DJ and party lover so make
sure you check out my Mixcloud
afterwards
and that's it so with that in mind iot
attacks so iot attacks are anywhere
literally anywhere
increased over these uh so much
um so
why attackers are threatening and
targeting iot infrastructure so first
they possess so many critical systems
inside of them so it increased the
probability for more damage more damage
more probability
to payouts because it's a critical
infrastructure and you need it to be
recovered fast so maybe ransomware
attackers thinking about that as well
critical damage also nation-state
involved of course if they want to harm
some damage second it's harder to detect
and protect and they have this unique
environments and architectures it can
also give initial compromise initial
access to Organization for example the
iot the iot router VPN servers or
um or many uh devices like that can give
you uh in to enter the the environment
the organization and the scale many
devices have the same configuration all
over again because you don't really know
how to configure everything on the deep
inside of these iot devices so many of
these are completely the same
environment perspective
so what are attackers using that for so
first deploying ransomware double
extortions many many stuff like that
that deploying DDOS attacks
still in a source called technological
source code and much more crypto mining
damaging critical infrastructure we're
gonna see that and much much more so
according to Kaspersky report more than
billion attempts to infection has been
done on the first half of 2021 and the
most targeted industry not surprising
critical manufacturers large companies
and Facilities
hundreds of cves as well
so our first White story is going to be
about well yes the Ukraine Invasion by
Russia but specifically on the cyber
warfare behind all of that and the
industry or two so recap uh the the
attack starting targeted uh Banks
government entities internet satellites
energy providers actually what is what
was critical was targeted so they tried
to Target Target anything uh
specifically when I mean them I mean
Russians
to do Ukrainian critical infrastructures
and they try to disable electricity well
virgin's the only tried they disabled
satellite internet connectivity they
damaged and why political infrastructure
data from uh for making it slow recover
and they use so many different malwares
developed For the First time seen there
in the story of two which was uh I will
discuss it much much more later
which was controlling able to control
iot devices that there are the power
grid and substations to make them
unavailable and damage them wipers
multiple OS versions and also they've
disabled the services inside this PC so
whenever they reach to some computer
network
they would disable or communication
outgoing and in-going so for example if
it's a Linux server it would be much
harder to recover gain control of the
system and try to recover the the damage
that has been done currently uh that's
the way the the wipers would work like
disable Communications wipe all the
system and then it's harder to get back
so a little bit intro about the group is
soon to be behind it the send room apt
group uh they soon to be the part of the
giu uh wanted by the FBI as well unit
74455 multiple attack since 2007 causing
blackout in Ukraine Adidas ransomware
and much much more
so on these scenarios uh the main
efforts we're focusing on first the
banking Ukraine governments usually
we've intentioned to make the most harm
they could do using the caddy wiper and
their medical wiper uh the caddy wiper
is the Rd swiper for the windows the
aromatic wiper was uh was another
version uh doing doing uh doing that and
also they're using uh Linux wipers to uh
maliciously harm and and destroy all
these in in Solaris in Orca environments
in uh in Linux servers and much more
energy providers were attacked as well
uh of course also by the in destroyers
and the caddy wiper in a second version
um so much much attack has been done
concurrently uh the first line of
attacks I want to speak about is that
the wipers themselves so the first
Cherry wiper was an interesting piece of
malware recursively iterate in the Years
overwriting maximum of 10 megabytes
probably to make it faster
remember keep in mind the main intention
was to just make your computer
unavailable for the longest period they
could to make the most damage they use
write file with zero just Cisco right
price with zeros they also rewrite the
old partition table the MBR and the GPT
to zero again and the second version has
its own loader I don't know if it's a
kind of a trolling mechanism but they
use their patched Ida debugger binary
they use the win32 remotes binary from
the the plugin from Ida and patched it
with their own Shell Code loader they
use also a key and a circle path is an
argument to decrypt the Shell Code on
the Fly and also a time to execute any
actually that's an interesting point
because that's the way they try to avoid
a scheduled tasks so they didn't use
scalar stocks in this in second version
but just using this time to X acute
argument and execute it after some time
probably has passed okay the Linux
wipers were using like uh leaving off
the land kind of techniques uh the
shredder Shredder binaries they use DD
um like to completely destroy uh uh out
drives they do it primarily they disable
also the communication as I told you and
they also try to remove system the unit
configurations to make sure no Auto
reloads are at the name so this is part
of this bash scripts inside
so this was the wipers what about the in
Destroyer itself so timeline speaking we
don't know much because not much was
actually published out there but Russia
invades Ukraine on the 24th of February
until the end it is uh pursuing that
send home apt compromised some energy
facility with high voltage substations
and the attack starts actually on the
8th of February
um so when the attack is starting they
try to do a scheduled task it is
immediately actually as we know detected
and removed and only a couple of days
after the Ukraine said informs about it
and one day after actually the FBI then
say many groups like that actually
inform about the new threat about the
new uh malware that might would be used
might want to be used called pipe dream
which can actually have much more damage
fortunately we didn't see any evidence
for it in the white so the industry to
just recall it uh goes way back to 2016
uh caused the blackout for an hour an
hour in the Ukrainian capital and this
cool ability to speak IEC 104 I see 110
uh OPC away many many like kind of PLC
ICS protocols it directly controls
switches and circuit breakers I think
one of the most uh amazing point about
this uh about this attack is that they
were trying to uh maliciously harm the
protection relays so they use this zero
day to destroy the protection relays
closed and shut down switch off all the
electricity devices and then when you
manually open up these electricity
devices all your system would break up
because you don't have protection relays
so they used zero day specifically here
dcv those packets Siemens to uh crush
the protection relays inside the system
and you can see actually uh or it's from
the beautiful dragons paper on the left
you can see a crushed those pocket crash
device after sending this doors packet
this was the in Destroyer the first
installer and now we go a little bit
high level in a sense for electricity
grow electric growth agreed their
operations so like in a deep kind of
sense we have discovered the Scout
clients controlling the security and
stuff like that they usually speak well
sometimes they speak with a tcpap
connection this is just an extension to
the real ICS protocol which is IEC 101
so the scada kinds communicate with the
router the IEC 104 router which actually
transfer and convert the communication
itself into the IEC 101 protocol and
being sent to the rtu so on the third
bullet here you can see the rtus which
are directly connected in Sands to the
substations to the electricity
electrical substations and therefore
from controlling the scada system you
can infiltrate and cause damage to the
rtus cool so in much more higher level
this is how probably a templated kind of
uh energy facility electricity energy
facility would look like so an
innovation facility would compromise uh
would uh compromise for many uh composed
from excuse me for many many things
inside so the HMI uh the the energy in
the engineer workstation OPC servers
much much more many of them working
again as TCP connection through the
router to the slaves the ltus some
communicate fully with the PLC the OPC
with its own protocol to the plcs
themselves and what the attackers try to
do in the first in Destroyer also in the
second we didn't manage that
successfully in the second fortunately
they try to attack any of them they try
to use any of them to shut down the
facility and not just shutting it down
but to damage it for the the longest the
longest they could
so the original 10 by the may also asset
blackhead talk this year was uh that the
original intent was to de-energize the
power lines uh deny operators visibility
and control this was the original intent
in the new version they were also trying
to wipe all the outrights and all the
artists so even if you could like get
control again of your system of your
scada it would be much much harder to
recover and make control again because
you don't have uh you don't have all the
system you need you don't have the
binaries they disable the protection
layers and waited waited for what for
manual operation many operations done
and then physical damage would cause
because the protection the protection
relays are now going to be disabled they
actually involve it with more fins but
it's if you want to read it it's it's
more in the asset paper they they try to
switch on and off multiple times of the
substations to make abruptions in the in
the power grids themselves so auto
shutdown of specific substations will
occur
that's that's astonishing a way to do
that so in this story to specifically
reverse engineering is the story to uh
shows us many many interesting things
they're doing task scheduling that was
detected uh and the logs debugs log
anywhere like a little bit obscure but
kind of understandable non-privileged
account was needed so no admin account
because they were speaking through the
internet like that sorry the land
communication through the router
themselves so no admin access was needed
you can actually see that on the XML
schema which is the correspond to this
task scheduler on the right here
um so uh this was in Destroyer too and
its way of operation dynamically
speaking we can see here uh how it works
so the the as we know there are two
samples uh targeting around 11
substations uh with this TCP IEC 100 104
protocol they knew from before
everything they want to do and this is a
key point they knew what other says they
want to Target they knew uh the devices
they knew the iOS the new internal
physical things they want to attack they
add this knowledge it's like they have
this routine looping all over again just
trying to make the things their own way
they actually funny thing is that they
don't even kind of listen to the
responses which is more like giving you
the feeling that they didn't really need
that they they had the all the
assumptions they had all the knowledge
they needed before
so you you can see the the packet sniff
from the in Destroyer 2 and this way of
fork just shutting down things on and
off corresponding to what they want to
do so I I don't know like we don't know
sorry we don't know specifically what
was the purpose in every single
ltu on and off switch but we for sure
know that some of them were trying to
Target it by kind of island island kind
of attacks there's on and off with goes
on because the uh much much things would
be in the system overuse of the system
uh and and would make crashing happens
the off switches were probably for the
protection relays to make them not
working so again when they manually turn
on switch will turn on an arm would
cause because the protection relays
protect you from high voltage and
shortages and stuff like that okay so
this is about the in Destroyer too
an interesting ttps attack is used
they enumerate
rules domain gpus and domain using a
non-admin required technique with adci
adapter in Powershell and we're doing
schedule tasks without task scheduler
and they have prepared passwords and iot
addresses and they're doing this cool
mimicas no mimikats technique to dump
credentials with the mini dump technique
really cool really cool technique
actually to use kind of again leaving of
the land counter technique to me to get
credentials and passwords
okay so this was our first story uh our
next story is going to be about uh well
the unfortunate attack about the Ireland
hospitals so the HSC attack on 2021 uh
started as the attack about the old
Public Health institution in England
more than the HSC compo comprised of
more than 35 hospitals around 70k
employees the high level attack is quite
simple fishing malicious Excel being
opened by uh by employee attackers are
inside eight weeks in the network later
moving I.T ignoring alerts
big mess out there and one County run
somewhere starts up at a single moment
so the higher level attack story you can
see the image here as well the fishing
uh the fishing opportunity gave gave a
chance to attackers to do what they want
the attacker just wander around the
network for more than eight weeks they
deploy eventually they run somewhere but
it was much much after they compromised
so many systems and servers in the
network
so on the 19th of May the CEO of HSC is
going out uh as a press release and he
says that well attack has occurred we
don't know uh what data was taken we we
know uh some data was taken
um and we won't pay
that's not a good that's not a good PR
release it's like it's really make uh
many many people like unclear and unsure
of what is happening really behind the
hood and it makes sense because middle
of the day they didn't know anything
almost as far as I know at that moment
so the timeline is again so phishing
email
um
clicked on merge 18 open up
sorry the Excel file in the email
on the end of on the end of March the
attacker execute Cobra strike and
mimikats Cobra so I can remember cuts
out of the box the AV oh amazing AV
monitor mode style doesn't block
anything great job on the 7th of May
look the timeline it's like there have
been so many so many time in the network
so so much time in the network the
attacker first gained admin privileges
probably with known password so the
attacker goes on looking over the dark
web uh finding the password and go back
and just enter the password amazing on
the 8th that I can continue lateral
movement exploit more servers in more
hospitals
um on the 10th again attacker execute
Cobra strikes at One hospital so it
execute the cover strike the antivirus
detects that it doesn't run in monitor
mode and
quarantine fails
quarantine fails like
well
it's a mess
so the whole story is about really
showing or really shown here that the
cyber security maturity level was not
enough it was really really not enough
on the 10th of May One hospital stock
actually noticed again corbel Striker
that So eventually the soft team get
involved they asking the security
provider whoever they should be
concerned but the security for everybody
says that well we removed the Cobra
strike from your OPC so the risk is low
what with other PCS what if other
networks what we've cleaning up the PC
itself nothing so the the whole
corresponding about the security was way
way uh better in my perspective attacker
again one day after attacker brute first
domain passwords it fails and then
execute one one day popular one day
successfully on the system because
systems were kind of a medical Mimi
system so no updates uh many many times
no updates so uh system were really
unupted
and updated use antivirus rules and much
much more uh I think one of the most
astonishing thing is that on the 13th of
May uh the security provider itself said
to the soccer team look you have
intrusion to your system they are there
are threat actors threatening in your
system cover strike stuff whatever and
you know what they did they just
restarted the servers they just get get
the server team and tell them okay we
have we haven't compromise so let's do
full-on restart
that's really really bad
uh one more thing it's all but by the
way it's all based on the PWC report uh
uh over 160 Pages amazing to read so
many conclusions so many things to to
get from it and understand how we need
to do better security uh one Hospital
detects the attack it twisted all the
password you do do all things correctly
but it doesn't inform any other hospital
it doesn't inform any other systems any
other uh
networks so it protects itself the
hospital but it doesn't help the others
they don't share the knowledge
uh on the 13th day execute ransomware
with all the exploited hospitals this is
about the quantity ransomware so the
county ransomware encrypts file
parallelly
um it used the charger 8 cinematic
encryption it removed backups it
actually have this cool ability to
encrypt uh uh remotely the backups in
the Vim backups but probably for more uh
service backups as well it removed
backups also locally it also look all
over them it also have this cool partial
encryption feature to make it probably
faster and and avoidable and
non-detectable in a sense so it do
encryption with jumps of of one megabyte
each so it doesn't encrypt anything it
just encrypts part of it but it will
still doesn't help you to recover your
systems right it's all its needs uh it's
it's all what it needs cool
um so the impact was really bad uh many
cancellations ctxris uh x-ray x-ray MRI
appointments and many many more can sell
because the I.T system was interrupted
uh I think more than 20 hospitals
infected also comments in the web which
made me many cry because like people
waiting for treatments and then cyber
security attack happens and they can't
get the treatment uh eventually uh um
the attacker uh I don't know if they
they gain conscious but they sent out
the keys eventually because they tell
them we don't pay they send out the keys
but still it didn't help because it took
so long to recover the whole systems so
in conclusion more than 20 hospitals got
impacted uh appointment and I.T system
got shut down the academic demand
initially 20 90 million dollars but sent
out the keys uh not nevertheless we
without payout it took them three months
to recover more than thousand servers
and thousand different applications
really really bad attack estimated
damages without even the payouts for the
ransomware itself for more than 600
million dollars as estimated out there
and also data leaks for 500 internal
records and stuff
so the red flags and Main takeaways from
this is well configure your security
tools do updates
um they didn't have uh rules new rules
for the antivirus for more than 12
months
regard regarding like besides the the
the fin that they use antivirus they
they don't have edrs so like
increase your cyber security maturity
level uh get personal and highly highly
skilled personnels that can help you
mitigate threats prioritize and prepare
for the walls prepare for the Emergency
prepared for emergency plan and
communicate
uh with that in mind we're going to our
last attack so our last attack is going
to deal with the colonial oil pipeline
attack uh the current old piping attack
is a really interesting attack it starts
with well Colonial who so Colonial is
actually one of the biggest oil
companies which is a part of the
colonial group you can actually see here
in the map where the pipeline is
actually moving forward and you can see
that uh
around 50 of the fuel in the east coast
in the United States uh is using this
pipeline so this is a really critical
infrastructure if these things get hurt
something really really bad can go uh
and happen they are the largest pipeline
system for refined oil they they
transfer oil probably also gas and Fuel
and much much more
and on the 19th they shut down their
pipeline so what's happening uh probably
assumed to be the the PC managing the
colonial pipeline got attacked by one
somewhere uh and and attacked really bad
and they decided to minimize exposure
shut down the whole system they were
just using unused VPN password unused
VPN username and password
they found it in the dark web
they don't they didn't have uh
multi-factor Authentication
that's it that's all needed to
infiltrate one of the huge systems the
huge critical infrastructure in the
states responsible for the oil pipelines
that's really astonishing also the Biden
and the FBI uh was corresponding and
involved immediately so the FBI and by
then are really like mad right now and
they are in that point of time they are
really involved in all of that working
together with Colonial on the sixth uh
the first institution intrusion is uh
presumed to be a data is stolen and also
leaked at the dark web itself
um and to again to uh to convince them
that the threat is exist and to convince
them to pay
and on the seventh the ransomware
actually starts uh the U.S government is
involved in all of that the pipeline is
taken down to minimize the exposure and
couple of hour laters they pay so over
supervised by the FBI they pay around
four uh 4.4 million dollars 75 Bitcoin
at the time uh to these threat actors
supervised by the FBI remember that
point we will come to that later so uh
only five days after the pipeline was
fully restored
and like if you take down a whole
Pipeline and it takes you five days to
restore that
it can cause problems it can cause real
real problems so we talk about these
problems a little bit later now I want
to speak about the APT group the APT
group behind it is soon to be a kind of
a Russian Related Group Dark Side black
matter uh dark side was the the kind of
the old named black matter is the the
new uh the new thing
um they seem to work on from Eastern
Europe or Russia uh operators around
somewhere as a service so they can
compile for you the binaries and the
ransomware you need if you give them the
initial access they can manage the
operation behind the ransomware attacks
themselves you can see here an example
of uh of a note they leave
and interestingly enough the way they
walk the malware itself uh you can see
that they delete the shadow copies the
windows Shadow copies they delete all
the backup Services as well they uh
query all these backup services and
delete them one by one and they use fast
symmetric encryption
um they have their publicly embedded
inside uh inside the the mirror itself
so the private key is only in their
server in their side and when they come
into some PC and some computer they
generate randomly generated uh symmetric
keys in a good manner back then it
wasn't that good but now it's a good
manner they encrypt this symmetric keys
with the public infrastructures and
remove from the disk and delete all
these symmetric key from the disk itself
and that way they can encrypt really
fast your hard drives and backups
probably as well again this was about
this apt group the impact the impact was
huge temporary food shelters around the
East Coast for five days more than 70
percent of the filling stations were ran
out of gas in areas from North Carolina
to South Virginia this was a really
critical damage really critical damage
by then was actually involved and and
mentioned that in the news responding to
uh uh to Finns and talking about that
out there
one of the main things was happening is
because uh because the new Cyber attack
was happening there was Panic buying
more that led to more shortage and also
the gas prices were highest in ease
three dollars per gallon
so as I told you remember that the FBI
was was also involved in that so it was
supervised by the FBI and they were
threatening them that uh
we will we will take care of that we
will manage and we take care of that and
actually that's kind of thing that
happened a couple of days after the
payout and stuff like that the whole
service went down uh some money was
stolen and and one day after uh Biden
Biden was spreading them and stuff like
that so
Dark Side probably did a messed up thing
messing up with the with the US
government
so the aftermath of all this story is
that on the 7th of June look it took it
took much it took time it took a lot of
time do we have a 60 63 Bitcoins which
are which at that point in time was only
two million dollars worth uh the FBI
assumed to uh to uh seem to be estimated
as uh uh this this amount and they
acquired uh the private keys for the
wallets we don't know how but this is
what assumed to happen in they also this
is upon their servers again we don't
know how and who also there was uh one
day after a congressional hearing about
this attack and it's really really
amazing to see how less knowledgeable
how much we don't have enough knowledge
about this kind of threats about this
kind of scenarios we can see that the
the CEO of pipeline is saying out there
in the news we didn't know at the time
at the time of like we didn't know the
answer uh whether the pipeline was
actually changed is it's not just about
the ransomware what if someone was
chained changing the pipeline broke the
pipeline make the pipeline uh uh
properties uh different so I don't know
causing explosions to cover going to
feel the the stuff you know so they were
really didn't know about that but they
were assuming that the daxa group won't
do that that's well that's a nice
assumption but they really really lack
many many data they really like this
cyber security level uh that would help
them to understand the threats
so the lessons learned from that and
from the Congressional hearing and all
of that as do the basic clearer news
password enable two-factor
authentication do backups and add-on
also data guarding and much much more
and the second thing is that attacks
will happen
it's all good attacks will happen
prepare your emergency plans prepare
your incident response plans mitigate
the blast radius minimize these
platforms this blast radius don't expect
the tax won't happen don't expect the
100 it's it's not viable
also look over Legacy entries the legacy
is is the king sometimes for the
attackers Legacy systems old user old
apps fix them update them remove all
users
and get the best out of each expert the
cyber security is so diverse raise your
skill level learn from many experts
every expert in each field learn from
them from different ways and of course
after increase your cyber security
maturity level understand how to
configure security tools and understand
how to educate your personnel and
increase
the skilled Personnel inside your system
that work in here with you
um
with that in mind
this concludes my last story about that
I want to thank you all for uh for being
there for being with me here today uh
this is my my Twitter you can follow on
my LinkedIn as well
um also I have so many credits and I'm
uh uh to to this giant responsible for
uh uh so many public reports and Tech
reports uh concluded and and being used
over this talk
um so uh with that in mind uh that's it
thank you very much
foreign
thank you Barrack for that uh
interesting
presentation with some very serious
topics any questions from the audience
yeah sure
so um I saw the Lessons Learned slide
and if you could just go back to that
yeah I have a question related to this
so why isn't there a line called budget
here because what we understand from all
of these you know incidents is that
neither of those three we could argue
about the electricity sector but not the
hospital nor Colonial had cyber security
budget fitting there
operating profile so have you had any
ideas you know how it changed the cyber
security budget being hacked and coming
in NSA to you know yeah
um so so it's really interesting problem
and again I think I can discuss about
this problem forever I think that one of
the main challenges nowadays in in sub
security areas is that uh how to really
divide your budget corresponding to the
attacks being out there and how to
maximize your budget I don't have a wise
solution for that I can tell you you
know that the cliche I think that
increase the cyber security budget but
it doesn't work like that I think that
uh you need to involve it with with
plans with uh probably uh someone that
leads the efforts that is knowledgeable
and can measure the impact measure the
effectiveness of cyber security efforts
done in your systems corresponds to the
threats and the attacks that you want to
mitigate so for example if I'm uh I
don't know I have this website only for
PR purposes maybe I don't put so much
effort into uh there using this is the
Holy Grail of uh securing this this
website prioritize prioritize your
things when you prioritize you can make
the most of your security budgets but
it's really really hard thing to do it's
not an easy one for sure
thank you
anybody else
uh do you have any knowledge or idea
about how hunger is critical
infrastructure is uh protected or what
shape it is at
so about ongoing critical infrastructure
yes so I'm no uh yeah if someone wants
you you want me to help protect it well
maybe yes but I I don't have any
knowledge specifically in regard to the
very critical infrastructure all of
these uh info is based on public reports
on mean reverse engineering uh binaries
and malware's in the wild and and
reading a lot this is like also in a
hobby for me so yeah
uh
yeah
thank you thank you
time for one more
okay we'll bring that to an end um
thanks Barack great presentation thank
you don't forget to um
listening to his mix cloud
thank you very much
and it's coffee break I think the
presentations start again at 11 15.