Robert Lipovsky

Anton Cherepanov

Senior Malware Researcher

Senior Malware Researcher@Robert_Lipovsky@cherepanov74

Robert M. Lee

Ben Miller

Joe Slowik

CEODirector, Threat Operations Center

Senior Threat Research Analyst@RobertMLee@electricfork@jfslowik• ICS-targeting malware• The story of INDUSTROYER:Ukrainian blackout• INDUSTROYER analysis• CRASHOVERRIDE impacts• Predictions moving forward

ICS

MALWAREOPERATOR

INTERNET

INDUSTRIAL SITEICS

MALWAREOPERATOR

INTERNET

POWER
INDUSTRIAL
DISTRIBUTION
SITE COMPANY2010201420152016

2010201420152016

2010201420152016

2010201420152016

201020142015

2016

2010

2014

2015

2016

2010

2014

2015

on December 23, 2015
in Ukraine

2016

2010

2014

2015

2016

2010

2014

2015

2016

2010

2014

2015

2016

A few days later

17 Dec 201618 Jan 201712 Jun 2017

8 Jun 2017

ICS

MALWAREOPERATOR

INTERNET

POWER
INDUSTRIAL
DISTRIBUTION
SITE COMPANY

M AIN BACKDOORExecute process
Execute process using specified user accountDownload file from C&C server
Copy & upload file
Execute shell command
Execute shell command using specified user account
Quit
Stop service
Stop service using specified user accountStart service using specified user accountReplace "Image path" registry value for specified service

Start service using specified user accountReplace "Image path" registry value for specified service
M AIN BACKDOOR

M AIN BACKDOORM AIN BACKDOORADDITIONALBACKDOORM AIN BACKDOORPORT SCANNER

DOS TOOLM AIN BACKDOORADDITIONALBACKDOORM AIN BACKDOORPORT SCANNER

DOS TOOLM AIN BACKDOORADDITIONALBACKDOORM AIN BACKDOORPORT SCANNER

DOS TOOLLAUNCHER

17 Dec 2016 - 22:27 (UTC)M AIN BACKDOORADDITIONALBACKDOORM AIN BACKDOORPORT SCANNER

DOS TOOLLAUNCHER

17 Dec 2016 - 22:27 (UTC)M AIN BACKDOORADDITIONALBACKDOORM AIN BACKDOORPORT SCANNER

DOS TOOLLAUNCHER

101 PAYLOAD

104 PAYLOAD

61850 PAYLOADOPC DA PAYLOAD

•Serial•IOA (Information Object Address) ranges•101 PAYLOAD

104 PAYLOAD•single command (C_SC_NA_1)•double command (C_DC_NA_1)
OFF -> ON -> OFF

61850 PAYLOADOPC DA PAYLOAD

101 PAYLOAD

104 PAYLOAD•TCP/IP•Modes:61850 PAYLOAD•Range•Shift•Sequence

OPC DA PAYLOAD

101 PAYLOAD

104 PAYLOAD

61850 PAYLOADOPC DA PAYLOAD

101 PAYLOAD

104 PAYLOAD

61850 PAYLOADOPC DA PAYLOAD

101 PAYLOAD

104 PAYLOAD

61850 PAYLOADOPC DA PAYLOAD

Auto-discovery••••

101 PAYLOAD

104 PAYLOAD

61850 PAYLOAD

CSW, CF, Pos, and Model
CSW, ST, Pos, and stVal
CSW, CO, Pos, Oper, but not $T
CSW, CO, Pos, SBO, but not $T

OPC DA PAYLOAD

• Discovers OPC servers• COM interfaces:• IOPCServer• IOPCBrowseServerAddressSpace• IOPCSyncIO• ctlSelOn (Select on command)• ctlSelOff (Select off command)• ctlOpenOn (Operate on command)• ctlOperOff (Operate off command)• \Pos and stVal (Switch position status)

101 PAYLOAD

104 PAYLOAD

61850 PAYLOADOPC DA PAYLOAD

Source: ABB IEC 61850 Master (OPC) User's Manual

101 PAYLOAD

104 PAYLOAD

61850 PAYLOADOPC DA PAYLOAD

Source: ABB IEC 61850 Master (OPC) User's Manual

101 PAYLOAD

104 PAYLOAD

61850 PAYLOADOPC DA PAYLOAD

101 PAYLOAD

104 PAYLOAD

61850 PAYLOADOPC DA PAYLOAD

Github: https://github.com/eset/malware-research/tree/master/industroyer• Identifies OPC Data Access LIBIDs, CLSIDs, IIDs in binary• Creates OPC DA structures and enums in IDA Pro• Can be used for general purpose reverse engineering

101 PAYLOAD

104 PAYLOAD

61850 PAYLOADOPC DA PAYLOAD

101 PAYLOAD

104 PAYLOAD

61850 PAYLOADOPC DA PAYLOAD

101 PAYLOAD

104 PAYLOAD

61850 PAYLOADOPC DA PAYLOAD

M AIN BACKDOORADDITIONALBACKDOORM AIN BACKDOORPORT SCANNER

DOS TOOLDATA W IPER

101 PAYLOADLAUNCHER

104 PAYLOAD

61850 PAYLOADOPC DA PAYLOAD

Potential Impact Scenarios ofCRASHOVERRIDE and Moving Forward

Dragos Timeline• Dragos learns of malware
08 June • Samples located, analysis starts

09 June• Early Warning sent to Dragos Customers• Preliminary analysis concludes; CRASHOVERRIDE name used
10 June • Confidential notification to customers and stakeholders begins• Multiple CERTs and other organizations notified
11 June • Initial TLP:AMBER report released

12 June• Public whitepaper published and ICS-CERT Advisory

“But Ukraine is on the Other Side of the Internet”

Dragos Investigation
Activity Group

ELECTRUM

Malware Name

CRASHOVERRIDECapabilities



Manipulation of Control
Denial of Control
Denial of View
Data wiping

Stage 1 - Intrusion

Stage 2 – ICS Attack

Reconnaissance

Develop
Weaponization

Targeting
Test
Delivery
Deliver
Exploit
Install / Modify

Install / Modify

Execute ICS Attack
C2Act
Discovery

Movement

CaptureCollect

Install &Execute

LaunchExfiltrate

Clean &Defend

Enabling

Initiating

Supporting

Trigger

ModifyHideDeliver

InjectAmplifyStage 1 - Intrusion

Stage 2 – ICS Attack

Reconnaissance

Develop
Weaponization

Targeting
Test
Delivery
Deliver
ExploitInstall / Modify

Install / Modify

Execute ICS Attack
C2Act
Discovery

MovementCapture

Collect

Install &ExecuteLaunch

Exfiltrate

Clean &Defend

Enabling

Initiating

SupportingTrigger

ModifyHideDeliverInject

AmplifyPayload Modules

Payloads in Context

IEC 104 Module• Usage:• Communication between control station and substation• TCP/IP implementation of IEC 101 with subset of commands• Features:• Master slave architecture• On-demand or spontaneous transmission• Remote command functionality• File Transfer

IEC 104 Module Execution Flow

IEC 104 Module Configuration File
• Configuration file required• Needs a target IP, other value• Can contain multiple targets• Requires manual staging• Manipulates target by changing state
to ON or OFF

Grid Scenarios• De-energize Substation• Loss of Control (ICS modules)• Loss of View
• Restoration Capability Degraded(Wiper)• Scalable but Human Operations• Does not rely on vulnerabilities• Codified grid operations• Limitation in human run ops

Grid Scenarios: Impact ofCRASHOVERRIDE• Cascading power failures?
• NO, but can affect multiple stations• Can it affect the Europe, Asia, and mostof the Middle East?
• YES, immediately• Can it affect the US?
• YES, with slight modification

What Comes Next?

Learning from CRASHOVERRIDE