TRITON and the forgotten Tier 0
May 19th, 2019 by Jesper Kråkhede
Back in April 2019 FireEye told the world that the group behind TRITON had been found in yet another critical infrastructure facility. Who and where was never disclosed. TRITON is the malware that went after the safety systems at a petrochemical plant in Saudi Arabia in 2017, the systems that are supposed to stop a plant from blowing up.
What caught my eye wasn´t the OT part. It was everything before it. The attackers had been in the corporate network for almost a year before they got to the engineering workstation of the safety system. And how did they get there? Mimikatz, RDP, PsExec and SSH tunnels. They renamed their tools to look legit, cleaned up the logs after themselves and did the risky stuff during off-hours when fewer people were on site. Nothing you wouldn´t find in any standard Active Directory breach.
So the scary OT attack was in reality a credential theft attack with a very bad ending.
This is what I keep telling my customers in manufacturing and energy. OT is not protected just by being ‘different’. If your OT admins use the same accounts, the same laptops and the same jump servers as the rest of IT, your safety system is exactly as safe as your weakest domain admin. Separate the identities, use dedicated admin workstations for the engineering stations and monitor the border between IT and OT like it was your Tier 0.
Because in a plant, it is.