# MA-406.072014: MyCERT Advisory - ICS Focused Malware

**Date:** 08 Jul 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-406.072014  
**Advisory ID:** MA-406.072014

---

**1.0Introduction**
ICS-CERT has released detailed information regarding the Industrial Control System Malware Campaign that has been detected uses multiple vectors for infection. NCCIC/ICS-CERT is analyzing malware and artifacts associated with an industrial control system (ICS). These include phishing emails, redirections to compromised web sites and most recently, trojanized update installers on at least three ICSs vendor web sites, in what are referred to as watering-hole style attacks.
**2.0Impact**
According to ICS-CERT information from Symantec and F-Secure, trojanized software known as Havex Trojan (Backdoor.Oldrea).b can allow attackers to access the networks of systems if it is installed by the users. Havex payload has caused multiple common OPC platforms to intermittently crash. This could cause a denial of service (DoS) effect on applications that reliant on OPC communications.
Others malware that identified are Trojan.Karagany and the Lightsout exploit kit. The Trojan.Karagany was previously identified by Cisco as part of another watering hole attack targeting energy and oil sectors.
**3.0List of Affected Products**
- Open Platform Communications Technology Classic (OPC Classic)
- Open Platform Communication Data Access (OPC DA)
**4.0RecommendationICS-CERT strongly recommends that organizations check their network logs for activity associated with this campaign**
Detail information about incident handling or preserving data, please refer:
- [ICS-CERT Incident Handling guidelines](http://ics-cert.us-cert.gov/sites/default/files/documents/Incident_Handling_Brochure_Nov2010a.pdf)
**OPC specific recommendations include:**
- Enforce strict access control lists and authentication protocols for network level access to OPC clients and servers.
- Recommend DCOM/RPC communications are limited via the DCOMCNFG utility, because of well-known vulnerabilities inherent to RPC and DCOM.
- When using OPC.NET-based communications, ensure that the HTTP server enforces proper authentication and encryption of the OPC communications for both clients and servers.
- Leverage the OPC Security specification when possible.
- Avoid wide-scale use of local mirrored user accounts to facilitate DCOM authentication.
- Follow recommended guidelines for securing OPC communications via accounts that possess least-user privileges.
- When tunneling cannot be used, limit the range of DCOM/RPC communications via the DCOMCNFG utility, and pay special attention to the use of OPC “callbacks” across security perimeters.
- Recommended to use OPC Unified Architecture (OPC UA).
**Vendor specific mitigation:**
- Digitally signing code provides a mechanism for detecting software tampering and helps assure recipients that the software does come from the vendor.
- Vendors who have not digitally signed their code should compare cryptographic hashes from their secure software repositories with the cryptographic hashes of files stored on public servers. These cryptographic hashes should also be made available to customers who are downloading the code, so that they can verify the integrity of their download. Vendors may also consider scanning installation files stored on public servers using current antivirus software. ICS-CERT tested 16 common antivirus software applications against the Havex malware and found that most antivirus were able to detect the malware.
**Additional mitigations to consider include:**
- Always keep your patch levels up to date, especially on computers that host public services accessible through the firewall, such as HTTP, FTP, mail, and DNS services.
- Maintain up-to-date antivirus signatures and engines, and apply them based on industrial control system vendor recommendations.
- Build host systems, especially critical systems such as servers, with only essential applications and components required to perform the intended function. Where possible remove or disable any unused applications or functions to limit the attack surface of the host.
- Implement network segmentation through V-LANs to limit the spread of malware.
- Exercise caution when using removable media (USB thumb drives, external drives, CDs).
- Consider the deployment of Software Restriction Policy set to only allow the execution of approved software (application whitelisting)
- Whitelist legitimate executable directories to prevent the execution of potentially malicious binaries.
- Consider the use of two-factor authentication methods for accessing privileged root level accounts or systems.
- When remote access is required, consider deploying two-factor authentication through a hardened IPsec/VPN gateway with split-tunneling prohibited for secure remote access. Be prepared to operate without remote access during an incident if required.
- Implement a secure socket layer (SSL) inspection capability to inspect both ingress and egress encrypted network traffic for potential malicious activity.
- Minimize network exposure for all control system devices. Control system devices should not directly face the Internet.
- Place control system networks behind firewalls and isolate or air gap them from the business network.
- Provide robust logging such as network, host, proxy, DNS and IDS logs.
- Leverage the static nature of control systems to look for anomalies.
- Use configuration management to detect changes on field devices. Produce an MD5 checksum of clean code to verify any changes.
- Prepare for an incident with a dedicated incident response team and an incident response plan. Test both your plan and your team.
- ICS-CERT and US-CERT remind organizations to perform proper impact analysis and risk assessment prior to taking defensive measures.
**ICSâ€‘CERT has provided :**
- Additional mitigation guidance and recommended practices , please refer : [ICS-TIP-12-146-01B-Targeted Cyber Intrusion Detection and Mitigation Strategies](http://ics-cert.us-cert.gov/tips/ICS-TIP-12-146-01B)
- Recommended practices section for control systems on the US-CERT web site. Several recommended practices are available for reading or download, including [Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies](http://ics-cert.us-cert.gov/sites/default/files/recommended_practices/Defense_in_Depth_Oct09.pdf).
Generally, MyCERT advises organizations to observe any suspected malicious activity and should follow their established internal procedures to prevent spreading of malicious malware.
For further enquiries, please contact MyCERT through the following channels:
E-mail :[[email protected]](/cdn-cgi/l/email-protection#8be8f2e9eef9b2b2b2cbe8f2e9eef9f8eee8fef9e2fff2a5e6f2) or [[email protected]](/cdn-cgi/l/email-protection#deb3a7bdbbacaa9eb3a7bdbbacaaf0b1acb9f0b3a7)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 -18:00 MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
**5.0References**
[1] [ICS-CERT: ICS Focused Malware](http://ics-cert.us-cert.gov/advisories/ICSA-14-178-01),
[2] [ICS-CERT: ICS Focused Malware (Update A)](http://ics-cert.us-cert.gov/alerts/ICS-ALERT-14-176-02Aecurity/2974294),
[3] [Product Coverage and Mitigation for ICSA-14-178-01 (Havex/ICS-Focused Malware)](http://blogs.mcafee.com/mcafee-labs/product-coverage-mitigation-icsa-14-178-01-havex-ics-focused-malware),
[4] [Havex Industrial Control System Malware: FAQ from InduSoft](http://www.indusoft.com/blog/2014/07/03/havex-industrial-control-system-malware-and-an-faq-from-indusoft/)