Editor's Choice


Nick Denbow’s European report: Process plants as weapons of war

February 2018 Editor's Choice News

Malware over the Internet has replaced the large gunboat that was dispatched in previous times – say 200 years ago – to send a message to the heart of a rival nation, indicating that relationships were becoming a little frosty. Then submarines and ICBMs were introduced, as less vulnerable to counter-attack, and providing hidden strength to be activated when necessary. The same applies to malware, in that once it is in place the weapon can be hidden and remain dormant until required. However, with any new missile system or weapon, the routing, targeting and performance of the latest versions have to be tested, and often this testing can be observed and monitored.

For any nation or group with an evil intent against another, this gives a major opportunity to cause chaos or damage to the infrastructure or manufacturing operations of a target country. This was seen in 2010 with Stuxnet, the Malware targeted at Siemens controllers in Iranian nuclear centrifuge installations. The source of the virus (officially) was never traced, but it was thought to have been from Israel, possibly with support from the USA. So Iran saw the effectiveness of this approach, and then developed the Shamoon virus, which caused major damage to all networked PCs at Aramco in Saudi Arabia in 2012. A further variant of Shamoon was unleashed in 2016/17, targeting ordinary computer systems around the Persian Gulf, as well as in Saudi Arabia.

Malware at dawn the new weapon of choice

Following these events, many cybersecurity service businesses and departments appeared, in addition to those which were developing anti-virus systems to protect computers from hacking by fraudsters and criminals. Both of these types of company monitor any new attacks and intrusions, and normally report that state sponsored hacking is known to have originated from Israel, Iran, Russia, USA, and North Korea. Indeed some of the most active hacking has been from a Russian group known as Sandworm, particularly disrupting networks and systems in the Ukraine starting in 2014. Malware called ‘Industroyer’ was used in 2016 to cause a power blackout in Kiev, by modifying the ABB configuration files in the electricity supply grid network systems.

Two such cybersecurity service businesses are FireEye and Dragos, based in the USA. In December 2017 they reported on a new attack (actually seen several months before) delivering malware into an unnamed petrochemical plant control system in the Middle East. Others have reported this malware was most likely to have been developed in Iran and targeted at a Saudi Arabian installation. The FireEye investigation team from their Mandiant subsidiary found that the plant safety system, a Triconex SIS, had caused an unexpected safety shutdown. Triconex is a company within Schneider Electric, following their acquisition of the Invensys Group: their triple-redundant safety systems protect major hazardous installations such as petrochemical plants. They also are the ultimate shutdown safety system for many nuclear power plants around the world, including most of those in China.

Safety systems could become the prime target

FireEye called the malware they found Triton, also known as Trisis. The implication of their report was that the Triton attack framework gained remote access to an SIS engineering workstation, sought out the Triconex controllers, and tried to inject new commands into their operations. It seems that the workstation (on site) was in program mode at this time, hence opening a potential window. There was no indication that the malware used any vulnerability in the Triconex system or its program code. In fact the triple redundant safety system reacted properly: the new single instruction did not pass the built-in validity checks, and so Triconex shut down the plant operations safely, as is the requirement of such a safety system.

FireEye interprets that this attack, which shows persistence, the lack of any clear monetary goal, and the technical resources necessary to create such an attack framework, as suggesting the origin is a well-resourced ‘nation-state’ actor. Either this current attack is reconnaissance development testing of part of what would need to be a significantly expanded multi-point approach to penetrate and control Triconex, or at a minimum, it is designed to be economically disruptive to the target plant. Other commentators have suggested that Triton could prevent the Triconex SIS from carrying out its safety function, and drive the plant to destruction. Whilst this is unlikely, and not supported by current knowledge, the malware is undoubtedly aimed at the safety system, and Triconex is the omnipresent safety system used in most of the hazardous plants across all countries, whatever the origin of the plant control system.

Industrial control systems – for petro-chemical plants, nuclear and other power stations, water treatment plants, power grids – are standardised across the world, so that they can accept inputs from equipment from many manufacturers: this is good, because there are no monopolies. It is also bad, because anyone can learn how to access these systems.

While there are maybe 10 major DCS suppliers worldwide, the SIS supplier base is much smaller – there are two or three suppliers. Of these, Triconex is by far the largest supplier, making them a very tempting target for anyone intent on world domination!

Nick Denbow spent 30 years as a UK-based process instrumentation marketing manager, and then changed sides – becoming a freelance editor and starting Processingtalk.com. Avoiding retirement, he published the INSIDER automation newsletter for five years, and then acted as their European correspondent. He is now a freelance Automation and Control reporter and newsletter publisher, with a blog on www.nickdenbow.com





Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Swiss watchmaking meets hypercar power
Horne Technologies Editor's Choice
The display of Bugatti’s upcoming luxury model, Tourbillon will be something truly special. Instead of a digital version, the driver will see a genuine Swiss timepiece behind the steering wheel.

Read more...
Reinventing the wheel
Editor's Choice
Once a curiosity in the early automotive age, in-wheel motors are now re-emerging with real promise. From electric cars to commercial vehicles and even aircraft, they are on the verge of transforming transportation engineering.

Read more...
Creating new magnets for electric motors
Editor's Choice
Innomotics, a global specialist in electric motors and large drive systems, is coordinating a consortium for a research project on ‘Integrated Product and Process Innovation for Electric Drives’.

Read more...
Sustainability is transforming fluid power
Editor's Choice Motion Control & Drives
Sustainability is reshaping the future of fluid power. With the growing demand for cleaner, more efficient technologies and tightening global regulations, fluid power systems are being re-engineered for higher efficiency, lower emissions and reduced material usage.

Read more...
The power of water
Editor's Choice Electrical Power & Protection
The Alpenglow Hy4 is the world’s first water-based hydrogen combustion engine, offering a convincing alternative to traditional battery-electric vehicles and established hydrogen fuel cell designs.

Read more...
Optimising purification for green hydrogen production
Parker Hannifin - Sales Company South Africa Editor's Choice Electrical Power & Protection
Parker Hannifin delivers advanced purification and thermal management components that enhance green hydrogen production.

Read more...
A new chapter in geothermal engineering
Editor's Choice Electrical Power & Protection
The town of Geretsried in southern Germany has become a focal point in the global shift toward renewable energy. While the world’s attention often turns to wind turbines and solar panels, a quieter but no less powerful force is at work deep beneath the surface, geothermal energy.

Read more...
Harnessing the ocean with wave energy
Editor's Choice Electrical Power & Protection
Wave energy is emerging as one of the most promising yet underutilised renewable sources. Tapping into the rhythmic, predictable power of ocean waves, this technology offers a clean, reliable alternative to fossil fuels and a valuable complement to wind and solar energy.

Read more...
Leading the way to the all-electric mine
ABB South Africa Editor's Choice IT in Manufacturing
Decarbonising the mining sector requires more than just new technology. ABB eMine provides a strong portfolio of electrification and automation solutions, consulting, partnerships and technology applications to support mining operations to reduce emissions and achieve operational cost savings and superior efficiency.

Read more...
Speeding up warehouse automation
Rockwell Automation Editor's Choice Motion Control & Drives
Bastian Solutions designs and delivers world-class material handling systems. The company was engaged by a high-end global fashion brand to implement a new warehouse system. Bastian used Rockwell Automation Emulate3D digital twin software to test the system before it was installed and went live.

Read more...









While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd | All Rights Reserved