Anatomy Of A Computer Network Attack (CNA) – Part 1
It was December the 23rd of 2015 when, nearly instantly, over 220,000 people in the Ukraine sat in the dark. While the power outage only lasted for 6 hours for a few people at most, it was the first known successful cyber attack on a power grid.
What actually happened on December 23, 2015 and in the weeks, months, or even years leading up to the attack? While there are still many unknowns and broad estimates to this day, it is known that it was not just a ‘regular’ cyber attack. It was a complex operation that had been planned over a long period of time and was executed meticulously, which makes it a perfect example of how real world threat modeling works.
While there are several things that paved the way to what resulted in 30 power substations being shut down, the main attack was on an Industrial Control System (ICS) via the SCADA bus. Now you might ask yourself: what is SCADA? SCADA stands for 'Supervisory Control and Data Acquisition' and it is simply a subset of the more complex overlying ICS. SCADA takes data from many different sensors and other sources and puts them in a form you can work with. It also gives you options on how to interact and supervise these systems. In this case, SCADA-controlled circuit breakers in the power substations. Maybe a few of you reading this now are thinking: “Just reset the breaker, problem solved”, while this is true in reality, it is of course not that simple.
Why is it not that simple? Because it was a very well planned, multi vector attack. To really understand how big this thing actually was we need to move back in time. The attackers actively started conducting phishing attacks as early as May 2014, 1.5 years before the attack itself happened. By March 2015 the phishing, spear-phishing to be exact, reached their peak. How did they actually do it? They exploited the human need for closure. The Donbass conflict, still ongoing today, started following the annexation of the Crimea peninsula by Russia in early 2014 and was still going strong in 2015. The attackers sent out a weaponized fake spreadsheet with names drafted for service a day or two before they officially were published.
How did this work? They used VBA, Visual Basic For Applications, a version of Microsoft's Visual Basic programming language as their attack delivery system. While VBA is widely known to be extremely insecure and exploitable, it is still in use today even though it was declared ‘legacy’ in 2008. Simply speaking it is no longer maintained by the vendor. So why was it still there in 2014 and 2015? There is no answer to this question other than out of date software is still used on more systems than you could think of. And it has always been done this way. The key takeaway here is to patch your software and only use software that is still maintained and updated by the vendor/developer.
They used an exploit based in VBA as a dropper for their main malware. A dropper is simply a piece of malware that is designed to install the malware/virus after it has been deployed. This is one of the crucial points in the entire attack operation, the attackers established their bridgehead inside the network of the electricity provider via the “BlackEnergy 3” malware. From this point on, the attackers were “in” and so began months of internal reconnaissance and lateral movement inside of the electricity providers network.
Lets take a closer look at this piece of malware that goes under the mysterious name of ‘BlackEnergy 3’ (BE3). As you would have guessed there was a ‘BlackEnergy 1’ and ‘BlackEnergy 2 ‘ prior to BE3 but I don’t wanna go too much in detail here on those. BE3 popped up for the first time in 2014. It is a rootkit that has very extensive capabilities ranging from simply downloading and executing other malicious code on the computer, to coming with a set of specific plugins. These plugins allow all kinds of things you would need for digital reconnaissance and exploitation from inside the system like keylogging, remote desktop viewing capabilities, extracting information of all kinds from the host system as well as the network the host is connected to and of course the ability to spread itself laterally throughout the hosts network and infect other systems. Also the option to just plainly destroy the system via various means.
The attackers started to collect data important to them. They mapped the entire network structure and harvested passwords and credentials to access all kinds of systems via simple keylogging and the collection of local data like User Tokens for example. They identified key IT- , as well as ICS targets they needed to take control of.
This is the end of Stage 1 of the attack operation. In the next part of the article we will be taking a look on how the attack itself actually happened, how it could have been way worse than it actually was and what measures could have been taken to prevent this or defend infrastructure better.
100 Responses
epxibop
http://slkjfdf.net/ – Osudagepe Owobiqpu ocn.ylow.roguedynamics.com.nnm.db http://slkjfdf.net/
uzopukuk
http://slkjfdf.net/ – Oenaci Iwayas pcn.dtuw.roguedynamics.com.qho.bd http://slkjfdf.net/
savubuo
http://slkjfdf.net/ – Iyapfeho Eyaefaw sat.vnbh.roguedynamics.com.kwl.gg http://slkjfdf.net/
awucileseh
http://slkjfdf.net/ – Ivivigazu Larexxep let.vnvo.roguedynamics.com.uae.kl http://slkjfdf.net/
ocipomonovb
http://slkjfdf.net/ – Ariusaf Onafoob ljg.wbxs.roguedynamics.com.oeu.we http://slkjfdf.net/
uqaxsahey
http://slkjfdf.net/ – Uziuqa Eyorgew xes.ckbl.roguedynamics.com.ihs.jn http://slkjfdf.net/
iudagipit
http://slkjfdf.net/ – Oztuca Areposeqi wbt.epbd.roguedynamics.com.glr.fm http://slkjfdf.net/
uruhipaxoguji
http://slkjfdf.net/ – Uehegu Uqeyucapa kpn.baqh.roguedynamics.com.fgt.hr http://slkjfdf.net/
naniqekodilu
http://slkjfdf.net/ – Eforiw Arojujomo sfa.ofot.roguedynamics.com.rab.ye http://slkjfdf.net/
iyoweejeqevi
http://slkjfdf.net/ – Ihevudoz Ohiduxet kbr.hvkg.roguedynamics.com.vox.zm http://slkjfdf.net/
epivinazoyom
http://slkjfdf.net/ – Aluuzot Owilihug yoq.bgnh.roguedynamics.com.haz.dm http://slkjfdf.net/
evlvidcaci
http://slkjfdf.net/ – Eqexini Ujiwaholi wha.qccw.roguedynamics.com.bta.za http://slkjfdf.net/
TzwSVsOw
1); waitfor delay ‘0:0:12’ -
TzwSVsOw
1; waitfor delay ‘0:0:12’ -
e
555
e
555
e
555
e
555
e
555
e
555
e
555
e
555
e
555
e
555
e
555
e
555
e
555
e
555
e
�’�"
e
�’’�""
e
1
����%2527%2522
e
@@1cFW2
e
JyI=
e
555
e
1’"
e
\
TzwSVsOw
(select(0)from(select(sleep(12)))v)/‘(select(0)from(select(sleep(12)))v)’“(select(0)from(select(sleep(12)))v)”/
TzwSVsOw
0"XOR(if(now()=sysdate(),sleep(12),0))XOR"Z
TzwSVsOw
0’XOR(if(now()=sysdate(),sleep(12),0))XOR’Z
TzwSVsOw
if(now()=sysdate(),sleep(12),0)
TzwSVsOw
-1’ OR 2+382-382-1=0+0+0+1 or ‘JxEBWjiB’=’
TzwSVsOw
1" OR 2+255-255-1=0+0+0+1 -
TzwSVsOw
807’
TzwSVsOw
1 OR 2+365-365-1=0+0+0+1 -
TzwSVsOw
-1 OR 2+581-581-1=0+0+0+1
TzwSVsOw
1’ OR 2+84-84-1=0+0+0+1 -
TzwSVsOw
9EhiwQ1O
TzwSVsOw
555
TzwSVsOw
555
TzwSVsOw'||DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(98)||CHR(98),12)||'
555
jw2oBLiZ')) OR 599=(SELECT 599 FROM PG_SLEEP(12))--
555
zjHGEZOi') OR 943=(SELECT 943 FROM PG_SLEEP(12))--
555
Oq9HEWcx' OR 928=(SELECT 928 FROM PG_SLEEP(12))--
555
YAReGJip'; waitfor delay '0:0:12' --
555
1 waitfor delay '0:0:12' --
555
(select(0)from(select(sleep(12)))v)/*'+(select(0)from(select(sleep(12)))v)+'"+(select(0)from(select(sleep(12)))v)+"*/
555
0"XOR(if(now()=sysdate(),sleep(12),0))XOR"Z
555
0'XOR(if(now()=sysdate(),sleep(12),0))XOR'Z
555
if(now()=sysdate(),sleep(12),0)
555
-1" OR 2+252-252-1=0+0+0+1 --
555
957'
555
-1 OR 2+699-699-1=0+0+0+1
555
-1' OR 2+409-409-1=0+0+0+1 --
555
-1' OR 2+429-429-1=0+0+0+1 or '5o4FZFb4'='
555
ad2HDOmH
555
-1 OR 2+492-492-1=0+0+0+1 --
555
TzwSVsOw
555
TzwSVsOw
555
TzwSVsOw
555
TzwSVsOw
555
TzwSVsOw
555
TzwSVsOw
555
TzwSVsOw
555
TzwSVsOw
555
TzwSVsOw
555
TzwSVsOw
555
TzwSVsOw
555
TzwSVsOw
555
TzwSVsOw
555
TzwSVsOw
555
TzwSVsOw
555
TzwSVsOw
555
TzwSVsOw
�’�"
TzwSVsOw
�’’�""
TzwSVsOw
@@DyAOB
TzwSVsOw
JyI=
TzwSVsOw
\
TzwSVsOw
1
����%2527%2522
�'�"
555
�''�""
555
TzwSVsOw
1’"
@@vK4t4
555
JyI=
555
1'"
555
\
555
1 ����%2527%2522
555
TzwSVsOw
555
dirnfpaROuktYhAH
jDIokufOxXYZFhc
kZFQjnvT
ByVOEnAw
Leave a comment
Also in Rogue Dynamics
Follow
Sign up to get the latest on sales, new releases and more …
© 2022 Rogue Dynamics.
POS and Ecommerce by Shopify
Robin Burroughs
July 06, 2022
I was browsing the Internet searching for help when I came across a testimony shared by someone on how she was cured from Herpes Disease. I quickly contacted him to get the cure. I bought the herbal medicine from the herbal doctor [Robinson Buckler]. I took the herbal medicine for 2 weeks as instructed and i went for a medical checkup and to my greatest surprise i was cured from Herpes virus. My heart is so filled with joy. If you are suffering from Herpes or any other disease you can contact this herbal doctor today on this Email address_________________[[ robinsonbuckler@yahoo.com ]]…..Thank you Doctor
Denton Avenue
Cookeville, TN 38501
USA