Maybe not. Over the past year and a half, researchers have been following a new strain of malware called \u201cTriton\u201d<\/a> (or sometimes \u201cTrisis\u201d) that can shut down industrial safety instrumented systems. These systems are comprised of physical controllers and associated software that are designed to prevent life-threatening disasters in various industrial contexts.<\/p>\n\n\n\n In the original incident, in the Summer of 2017, a petrochemical plant in Saudi Arabia came perilously close to one such disaster when components like pressure-release mechanisms and shutoff valves became disabled. Were it not for a small error in the code there\u2019s a very good chance that people working at the plant, as well as those unfortunate enough to live in the surrounding area, could have been injured or possibly even killed. <\/p>\n\n\n\n And it’s likely that, at one point, the attackers used spearphishing to compromise key credentials. Credentials that gave them direct access to the safety instrumented systems<\/p>\n\n\n\n So, today we\u2019re going to discuss\nTriton, killer phish and how to secure you organization\u2019s email. <\/p>\n\n\n\n Let\u2019s hash it out.<\/span><\/p>\n\n\n\n Triton Malware is a specific strain\nof malware that targets industrial safety systems in an effort to cause a\ncatastrophe. As we just touched on, its debut \u2013 for lack of a better term \u2013\ncame in 2017 against an unnamed Saudi chemical company. To this day the name of\nthe company has never been disclosed. This has been done to avoid discouraging\nother companies from reporting these kinds of attacks.<\/p>\n\n\n\n Triton was hamstrung by a small flaw in its code, which shut down the plant and alerted the company to the attack before it could result in any physical harm. This happened in June 2017. At the time it was thought to be a simple mechanical glitch. But in August the plant shut down again and this time the company opted to bring in investigators<\/a>. <\/p>\n\n\n\n [Julian] Gutmanis recalls that dealing with the malware at the petrochemical plant, which had been restarted after the second incident, was a nerve-racking experience. \u201cWe knew that we couldn\u2019t rely on the integrity of the safety systems,\u201d he says. \u201cIt was about as bad as it could get.\u201d<\/p><\/blockquote>\n\n\n\n While the attack wasn\u2019t disclosed publicly until December of\nthat year, security firms and researchers have been scrambling to unpack the\nmalware and learn how it works since its discovery. <\/p>\n\n\n\n What makes this malware scary is that it\u2019s intended to cause\nreal harm. This isn\u2019t holding someone\u2019s files ransom or stealing their personal\ndata \u2013 this could get somebody killed. <\/p>\n\n\n\n And it\u2019s exceptionally sophisticated. <\/p>\n\n\n\n For starters, the people behind Triton have a ton of resources\nat their disposal and given some of the high-level techniques that have been\nstrung together, researchers believe that a nation-state is behind them.\nExactly which nation is still a point of debate. While it was initially attributed\nto Iran, FireEye \u2013 who\nwas brought in when the malware was first discovered<\/a> \u2013 has now pointed the\nblame at Russia.<\/p>\n\n\n\n Regardless of who is behind it, it\u2019s part of a trend where state-sponsored\ncyber attackers have targeted private sector businesses. The Marriott breach\nlast year being another example.<\/p>\n\n\n\n The attack actually began in 2014, when the attackers gained access to the plant operator\u2019s corporate network. At some point they gained access to the targeted plant\u2019s network, then \u2013 using credentials potentially acquired in a spearphishing operation \u2013 the attackers gained access to an engineering workstation. <\/p>\n\n\n\n That engineering workstation interfaced directly with the plant\u2019s safety instrumented systems, which informed the attackers of the makes and models being used, as well as their firmware versions. Their persistence in the network allowed the attackers to maintain visibility over any updates being made, too.<\/p>\n\n\n\n The attackers ultimately chose to focus on a Schneider\nElectric safety instrumented machine called the Triconex safety controller.\nHence the malware\u2019s name. It\u2019s likely, per\nthe MIT Technology Review<\/a>, that the attackers acquired one of the Schneider\nTriconex machines to test its malware before deploying it. This helped them to\ncreate code that could elude malware scanners and other security safeguards.<\/p>\n\n\n\n And truly rounding out the attack, a new Zero-day was found\nin the Triconex safety controller, furthering Triton\u2019s chances of success. <\/p>\n\n\n\n The result was the intruders maintained a persistent presence in the network and injected code that could order the safety instruments to shut themselves down as other malware wreaked havoc on the plant, creating what could have been a very deadly situation.<\/p>\n\n\n\n The results could have been horrific. The world\u2019s worst industrial disaster to date also involved a leak of poisonous gases. In December 1984 a Union Carbide pesticide plant in Bhopal, India, released a vast cloud of toxic fumes, killing thousands and causing severe injuries to many more. The cause that time was poor maintenance and human error. But malfunctioning and inoperable safety systems at the plant meant that its last line of defense failed.<\/p><\/blockquote>\n\n\n\n Let\u2019s start with email security. While it\u2019s yet to be confirmed that the compromised engineering credentials were obtained via spearphishing, there has been some reporting that this was the case<\/a>. While there are other methods that could have been used to access the terminal, spearphishing would appear to be the likeliest culprit.<\/p>\n\n\n\n Spearphishing is basically phishing + social engineering. The attacker does some research on the target, oftentimes using sites like LinkedIn<\/a>, in order to craft a convincing situation in order to obtain the targeted information. This type of phishing typically includes a convincing fake website<\/a>, often with HTTPS security indicators<\/a>, that is meant to harvest the information.<\/p>\n\n\n\n This just underscores the importance of proper internet security. There\u2019s a very good chance, given their presence in the network itself, that the attackers could have sent a convincing email from a trusted email server, which could have fooled SPF<\/a> or DKIM<\/a>. S\/MIME and email signing<\/a> could have helped prevent this though.<\/p>\n\n\n\n Teaching employees to sign emails and look for signatures on emails, as well as educating them about email security best practices in general is critical to maintaining a good organizational security posture. Your employees, regardless of their intent, are your biggest threat<\/a>. <\/p>\n\n\n\n\n\n While it\u2019s been said and written so many times that it\u2019s become trite at this point, it still bears repeating: securing the Internet of Things needs to be a priority for everyone from manufacturers to vendors to end users. Eventually, one of these attacks is going to get someone killed and it\u2019s likely going to be an IoT device or component that gets compromised and causes it. <\/p>\n\n\n\n This potentially could have been the cyber attack that achieved\nthat unfortunate milestone, were it not for a small glitch, or perhaps more\nappropriately an oversight, that shut the entire plant down in the face of the\npending emergency. Next time we might not be so lucky, which has security\nresearchers losing sleep at night.<\/p>\n\n\n\n Even the most disruptive malware has historically not\nattempted to cause harm to humans.<\/p>\n\n\n\n \u201cTargeting safety systems just seemed to be off limits morally and really hard to do technically,\u201d explains Joe Slowik<\/a>, a former information warfare officer in the US Navy that now works for cybersecurity firm, Dragos.<\/p><\/blockquote>\n\n\n\nWhat is Triton Malware?<\/h2>\n\n\n\n
What makes Triton Malware so sophisticated?<\/h2>\n\n\n\n
![\"Network](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/03\/bigstock-211692241-300x300.jpg\")
<\/figure><\/div>\n\n\n\nFirst Takeaway \u2013 Email Security has never been more critical<\/h2>\n\n\n\n
![\"Killer](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/03\/bigstock-Phishing-Personal-Mail-Icon-S-262123960-300x300.jpg\"){kind=icon}
<\/figure><\/div>\n\n\n\nSecond Takeaway \u2013 IoT Security cannot be overlooked<\/h2>\n\n\n\n
![\"Beating](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/03\/Beating-a-dead-horse-300x257.jpg\")
<\/figure><\/div>\n\n\n\n
![\"Hashed](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/08\/bigstock-222348568-1024x267.jpg\")
<\/figure>\n","protected":false},"excerpt":{"rendered":"