POWER September 2015 - 57

CYBERSECURITY
focusing on the last three methods of compromise-all
of which involve a more sophisticated
remotely based attack without
the benefit of an easily accessible port or the
help of a malicious insider to facilitate. It is
these methods that require more advanced
skills in order for the attacker to succeed,
and ones that power companies might overlook
or under-prioritize, particularly if they
think current security controls have already
accounted for them.
Breaking Down the Attacks
How does an attacker actually inject malware
into the ICS or break into the software used
to access or monitor it?
Most of the time it boils down to this:
finding the weakest link, which is employees
(Figure 1). But wait, some might say, our
company puts all of our employees through
rigorous security awareness training programs;
we also use modern/advanced malware
detection systems with anti-phishing
controls, strong firewalls, and intrusion detection
systems.
That doesn't matter.
Attacks like cross-site scripting, drive-by
downloads, watering holes, and wrappers/
packers can often bypass those defenses. To
outsmart security tools and employees, they
utilize legitimate websites and/or software to
conceal themselves and make it much harder
to detect them, even if the company is doing
a lot of things right. Here's a brief overview
of these attacks.
Cross-Site Scripting (or XSS). In this
attack, a hacker takes advantage of weak security
in a legitimate web application (which
could be running on the company's internal
network as a vendor-provided application,
or on a third-party website) to sneak in malicious
code that will instantly attack anyone
who uses it.
For example, in recent years DHS' Industrial
Control Systems Cyber Emergency
Response Team (ICS-CERT) has issued
multiple alerts about XSS vulnerabilities
in supervisory control and data acquisition/human-machine
interface (SCADA/
HMI) products. The XSS attack itself may
hijack the employee's ICS software session
directly, or it will steal stored credentials
or cookies, trick the employee into
entering a login and password, which will
be sent to the hacker, or cause malicious
code to be installed on the employee's
computer hard drive.
This attack is highly dangerous because
of its ability to hijack the employee's access
to key systems, like ICS, either through session
hijacking, password/credential theft,
or computer infection. It's also difficult for
employees to realize they've been attacked,
CIRCLE 27 ON READER SERVICE CARD
September 2015 | POWER
www.powermag.com
57
because XSS is unlikely to be detected by
security programs because it originates
from a legitimate application that (without
getting too technical) basically tells the security
program that it's not a threat. XSS
attacks may also be spread via phishing
emails, but they aren't easy to spot either,
because the malicious URL will look completely
legitimate, and cybercriminals also
use professional " phishing kits, " which look
identical to emails sent by real companies
and government agencies.
Drive-by Downloads. Similar to the
cross-site scripting attack, a drive-by download
often takes advantage of a legitimate
website in order to dispense malware to anyone
who visits it. In some cases, the driveby
occurs when a user clicks on a pop-up
window or a third-party ad, but this isn't required;
simply visiting the infected website
will immediately activate the malware installation
on the employee's computer.
This attack is particularly dangerous to energy
companies because drive-bys are one of
http://www.powermag.com
POWER September 2015

Table of Contents for the Digital Edition of POWER September 2015
