to Critical Information Infrastructure Haythem EL MIR, CISSP CEO, - - PowerPoint PPT Presentation

▶
to critical information infrastructure
SMART_READER_LITE
LIVE PREVIEW

to Critical Information Infrastructure Haythem EL MIR, CISSP CEO, - - PowerPoint PPT Presentation

Sep 02, 2023 143 likes •523 views

Building the Digital Keystone Cyber Threats to Critical Information Infrastructure Haythem EL MIR, CISSP CEO, keystone Group & CISRT.tn www.keystone.tn Building the Digital Keystone State Sponsored Attacks Political Warfare

slide-1
SLIDE 1

www.keystone.tn Building the Digital Keystone

Cyber Threats to Critical Information Infrastructure

Haythem EL MIR, CISSP CEO, keystone Group & CISRT.tn

slide-2
SLIDE 2

www.keystone.tn Building the Digital Keystone

Multi-stage-Attack State Sponsored Attacks Crypto-jacking Social Engineering Email Compromise AI Botnets CIIP Attacks APT Groups IoT Malware ATM Fraud Supply Chain Attack Political Warfare Commercial Espionage ICO/Smart Contract Attack

slide-3
SLIDE 3

www.keystone.tn Building the Digital Keystone

Industrial Projection

This is how ICS/OT people see it

slide-4
SLIDE 4

www.keystone.tn Building the Digital Keystone

Hacker Projection

This is how Hacker looks at is

slide-5
SLIDE 5

www.keystone.tn Building the Digital Keystone

OT - real-life convergence

Modern OT:

  • ICS/SCADA
  • Telecom
  • Transportation
  • IoT

Business process is not limited by ICS/SCADA. Around you can see lot of accompanying technology which help to operate business process and brings new threats!

Critical infrastructure is a part of society. And now, it is fully convergence

slide-6
SLIDE 6

www.keystone.tn Building the Digital Keystone

Taking the Challenge

BEFORE Threat Model for separate ICS  Challenging NOW Threat Model for ALL industries!  Is it possible?

slide-7
SLIDE 7

www.keystone.tn Building the Digital Keystone

Security Threats landscape

Today’s reality on Critical Infrastructures & Enterprises

slide-8
SLIDE 8

www.keystone.tn Building the Digital Keystone

Industrial and Energy sector

slide-9
SLIDE 9

www.keystone.tn Building the Digital Keystone By January 2016 more than 150 000 of industrial systems were found to be accessible through the Internet. Among them, about 15 000 are vulnerable with a high

risk level

Time to patch vulnerabilities

Cutting Sword of Justice attacked Saudi Aramco 2012 Mexican Pemex suffered from targeted attack 2014 DUQU 2011 STUXNET 2010

Most of these components were accessible via HTTP, Fox, Modbus, and BACnet, and in most cases, a dictionary password was used for authentication.

slide-10
SLIDE 10

www.keystone.tn Building the Digital Keystone

Modes of attack

Cyber systems may be subject to unauthorized access through various means:

  • remotely, via the Internet, or

unsecured telecom networks.

  • at close hand, through direct

contact with infrastructure (e.g. through a USB port).

  • locally, through unauthorized

access to physical infrastructure, or insider threat (infiltration).

The Impacts and consequences

Successful cyber attacks could result in:

  • Utilities interruption
  • Plant sabotage / shutdown
  • Production disruption
  • Threats to safety
  • Economic loss
  • Reputational damage
  • Loss of real-time monitoring and

control

  • Potential to cause death and injury

Key risks for ICS

slide-11
SLIDE 11

www.keystone.tn Building the Digital Keystone

Internet

Corporate network SCADA network Field units

HMI

TCP/IP

Modbus TCP

Wireless Teleworking Remote maintenance

SCADA Modbus Gateway

Modem RTU/PLC RTU/PLC RTU/PLC

Network access

slide-12
SLIDE 12

www.keystone.tn Building the Digital Keystone

Internet

Corporate network SCADA network Field units

HMI

TCP/IP

Modbus TCP

Wireless Teleworking Remote maintenance

SCADA Modbus Gateway

RTU/PLC RTU/PLC RTU/PLC

Final targets Intermediate targets Entry points Attack vectors

Modem

Attack vectors

slide-13
SLIDE 13

www.keystone.tn Building the Digital Keystone

TCP/IP Modbus, DNP3, OPC, S7, EtherCAT, FL-net, etc. Typical network

slide-14
SLIDE 14

www.keystone.tn Building the Digital Keystone

Exposed and vulnerable

  • 100% of tested SCADA networks are exposed to

Internet/Corporate network

  • Network equipment/firewalls misconfiguration
  • MES/OPC/ERP integration gateways
  • HMI external devices (Phones/Modems/USB Flash) abuse
  • VPN/Dialup remote access
  • 90% of tested SCADA can be hacked with Metasploit
  • Standard platforms (Windows, Linux, QNX, BusyBox, Solaris…)
  • Standard protocols (RCP, CIFS/SMB, Telnet, HTTP…)
  • Standard bugs (patch management, passwords, firewalling, application

vulnerabilities)

slide-15
SLIDE 15

www.keystone.tn Building the Digital Keystone

Train hacking

slide-16
SLIDE 16

www.keystone.tn Building the Digital Keystone

Plain Line Station

Computer Based Interlocking

to peripherals: signals, point machines, etc.

RBC

Fixed Eurobalise RBC MMI Fixed Eurobalise GSM-R GSM-R

Onboard

ETCS Onboard Data GSM-R

ETCS level2

slide-17
SLIDE 17

www.keystone.tn Building the Digital Keystone

Plain Line Station

Computer Based Interlocking

to peripherals: signals, point machines, etc.

RBC

Fixed Eurobalise RBC MMI Fixed Eurobalise GSM-R GSM-R

Onboard

ETCS Onboard Data GSM-R

GSM-R: signaling and telemetry

slide-18
SLIDE 18

www.keystone.tn Building the Digital Keystone

Plain Line Station

Computer Based Interlocking

to peripherals: signals, point machines, etc.

RBC

Fixed Eurobalise RBC MMI Fixed Eurobalise GSM-R GSM-R ETCS Onboard Data GSM-R

OpenBTS MitM/Jamming/Replay

slide-19
SLIDE 19

www.keystone.tn Building the Digital Keystone

Plain Line Station

Computer Based Interlocking

to peripherals: signals, point machines, etc.

RBC

Fixed Eurobalise RBC MMI Fixed Eurobalise GSM-R GSM-R

Onboard

ETCS Onboard Data GSM-R

When you connect to the Internet – the Internet connects to you

slide-20
SLIDE 20

www.keystone.tn Building the Digital Keystone

Plain Line Station

Computer Based Interlocking

to peripherals: signals, point machines, etc.

RBC

Fixed Eurobalise RBC MMI Fixed Eurobalise GSM-R GSM-R

Onboard

ETCS Onboard Data GSM-R

Passenger attacking the infrastructure

slide-21
SLIDE 21

www.keystone.tn Building the Digital Keystone

Plain Line Station

Computer Based Interlocking

to peripherals: signals, point machines, etc.

RBC

Fixed Eurobalise RBC MMI Fixed Eurobalise GSM-R GSM-R ETCS Onboard Data GSM-R

Attacks from the Internet

slide-22
SLIDE 22

www.keystone.tn Building the Digital Keystone

More hacking on ICS to come

slide-23
SLIDE 23

www.keystone.tn Building the Digital Keystone

Telcos Critical Infrastructure Threats

slide-24
SLIDE 24

www.keystone.tn Building the Digital Keystone 2 4

slide-25
SLIDE 25

www.keystone.tn Building the Digital Keystone Main threats of 2018 Predicted threats of 2019 and beyond

  • AI used against the industry
  • IoT attacks on the rise
  • Uneducated overreliance on cloud
  • 5G threats
  • Quantum and the Public Key Infrastructure (PKI)
slide-26
SLIDE 26

www.keystone.tn Building the Digital Keystone

SS7 HLR

A B

MSC VLR Gateway MSC Billing SMS-C

CS Core UTRAN

PS Core IMS

LTE Wi-Fi WiMAX PON DSL Femto

GRX/IPX OAM Remote support Internet IT network

Traffic

Attacker Attacker Attacker Attacker Attacker Attacker

slide-27
SLIDE 27

www.keystone.tn Building the Digital Keystone

slide-28
SLIDE 28

www.keystone.tn Building the Digital Keystone

slide-29
SLIDE 29

www.keystone.tn Building the Digital Keystone

Financial Sector

slide-30
SLIDE 30

www.keystone.tn Building the Digital Keystone

slide-31
SLIDE 31

www.keystone.tn Building the Digital Keystone

Attack vectors

CBS

Web Portal

GRH

Unpatched vulnerabilities Misconfiguration Lack of encryption Lack of assessment End-of-life systems Employee errors Lack of awareness Weak authentication and access control Weak filtering

slide-32
SLIDE 32

www.keystone.tn Building the Digital Keystone

OLB: Critical Threats

5% 10% 15% 15% 30% 25%

Theft of funds by an external attacker Theft of funds by an authorized user Access to DBMS or OS Theft of funds by an authorized user Access to business secrets Access to DBMS or OS Access to business secrets Access to DBMS or OS Access to private information of certain clients

OLB information security threats

Theft of funds Access to payment card data Access to users’ personal data OLB denial of service Compromise of business secrets and/or client privacy

slide-33
SLIDE 33

www.keystone.tn Building the Digital Keystone

SWIFT attack case (2016)

US$81 million

Lazarus group could have made off with $1 billion

slide-34
SLIDE 34

www.keystone.tn Building the Digital Keystone

― Spear phishing  Old vulnerabilities exploitation, ― Remote command execution (screenshot capture while accessing sensitive web application, cookies theft, etc.) ― Install a RAT (Ammyy Admin ) for lateral attacks to access the banking accounts processing systems, ― On the target, the attacker record the screen activities to get familiar with procedures and banking workflow via the stolen data. ― These information is used to steal money via SWIFT network.

APT: Carbanack case

A billion-dollar APT

slide-35
SLIDE 35

www.keystone.tn Building the Digital Keystone

Blackbox, jackpotting

“Black box attack”: unauthorized cash withdrawal is possible with a cheap and popular

  • computer. The credit-card sized and fast programmable device can be easily hidden

inside an ATM. Sometimes it can be plugged even outside an ATM. USB-based microcontroller – the most HIDden jackpotting device

slide-36
SLIDE 36

www.keystone.tn Building the Digital Keystone

Other critical sectors

Mass Media Healthcare Transport Gouvernement

slide-37
SLIDE 37

www.keystone.tn Building the Digital Keystone

é é

Merci pour votre attention