Hackers manipulated PLC settings at water treatment plant

Hackers manipulated the programmable logic controllers that managed the amount of chemicals used to treat the water to make it safe to drink.

Hackers breached a water company’s industrial control system and made changes to valve and flow control settings, Verizon revealed in its latest Data Breach Digest.

The unnamed water district had asked Verizon to assess its networks for indications of a security breach. It said there was no evidence of unauthorized access, and the assessment was a proactive measure as part of ongoing efforts to keep its systems and networks healthy.

Verizon examined the company’s IT systems, which supported end users and corporate functions, as well as Operational Technology (OT) systems, which were behind the distribution, control and metering of the regional water supply.

The assessment found several high-risk vulnerabilities on the Internet-facing perimeter and said that the OT end relied heavily on antiquated computer systems running operating systems from 10 or more years ago.

Many critical IT and OT functions ran on a single IBM AS/400 system which the company described as its SCADA (Supervisory Control and Data Acquisition) platform. This system ran the water district’s valve and flow control application that was responsible for manipulating hundreds of programmable logic controllers (PLCs), and housed customer and billing information, as well as the company’s financials.

Interviews with the IT network team uncovered concerns surrounding recent suspicious cyber activity and it emerged that an unexplained pattern of valve and duct movements had occurred over the previous 60 days. These movements consisted of manipulating the PLCs that managed the amount of chemicals used to treat the water to make it safe to drink, as well as affecting the water flow rate, causing disruptions with water distribution, Verizon reported.

An analysis of the company’s internet traffic showed that some IP addresses previously linked to hacktivist attacks had connected to its online payment application.

Verizon said that it “found a high probability that any unauthorized access on the payment application would also expose sensitive information housed on the AS/400 system.” The investigation later showed that the hackers had exploited an easily identified vulnerability in the payment application, leading to the compromise of customer data. No evidence of fraudulent activity on the stolen accounts could be confirmed.

However, customer information was not the full extent of the breach. The investigation revealed that, using the same credentials found on the payment app webserver, the hackers were able to interface with the water district’s valve and flow control application, also running on the AS/400 system.

During these connections, they managed to manipulate the system to alter the amount of chemicals that went into the water supply and thus interfere with water treatment and production so that the recovery time to replenish water supplies increased. Thanks to alerts, the company was able to quickly identify and reverse the chemical and flow changes, largely minimizing the impact on customers. No clear motive for the attack was found, Verizon noted.

The company has since taken remediation measures to protect its systems.

In its concluding remarks on the incident, Verizon said: “Many issues like outdated systems and missing patches contributed to the data breach — the lack of isolation of critical assets, weak authentication mechanisms and unsafe practices of protecting passwords also enabled the threat actors to gain far more access than should have been possible.”

Acknowledging that the company’s alert functionality played a key role in detecting the chemical and flow changes, Verizon said that implementation of a “layered defense-in-depth strategy” could have detected the attack earlier, limiting its success or preventing it altogether.

 

 

 

Cyber criminals steal $25 million from Russian banks

A cyber criminal gang stole $25.7 million (£17.8 million) from Russian banks in 13 attacks conducted between August 2015 and February 2016.

Buhtrap as the gang has been called by Group-IB used spear phishing emails to send infected Word documents to financial institutions. When opened, these documents downloaded malware that ultimately enabled the attackers to create fraudulent transfer orders so that the bank would unknowingly send money to accounts that the criminals controlled.

The threat of phishing

Banks aren’t the only institutions that are susceptible to phishing attacks. Whatever your line of business, phishing is a threat you need to take seriously: if one of your employees mistakenly opens a phishing email, your entire corporate network could be put at risk. This is why it is so important to ensure that your staff understand the threat that phishing poses and can recognise phishing emails.

Hackers compromising official email accounts using Olympic Vision malware

Hackers are running a Business Email Compromise Campaign in ASIA, MIDDLE EAST and US to steal money!

This is a malware based campaign and hackers are targeting head employees of companies.



According to a well-known security software company Trend Micro, Hackers are running a BEC (Business Email Compromise) Campaign with the help of Olympic Vision keylogger. Hackers are targeting companies of Asia Pacific and Middle East. Security Experts of Trend Micro have also seen some cases in United States too.

Hackers are using malware in a BEC (Business Email Compromise) attack, to hijack the email accounts of victims. If hackers successfully got the access of official’s email accounts, they are able to send emails for financial transactions. Hackers can also steal sensitive data of companies, but in this campaign they are focusing on financial transactions. These attacks have been traced back to Kuala Lumpur and Lagos, security researchers said.

In this attack, hackers mostly target that companies which are working with foreign suppliers and doing their transactions through emails. These payments are called, wire transfer payments.

How emails are compromised?
Hackers are targeting head employees of companies by sending them a malicious email. Hackers are sending a keylogger within the email. Once they got access of victim’s account, they tricks other employees, business partners and Suppliers to perform wire transfer payments. Hackers are spreading an “Olympic Vision” named keylogger through the emails. Hackers have targeted key employees of 18 different countries till the day.

Hackers are sending emails to business partners and suppliers from the compromised email accounts. In emails, they are writing that they there is a problem with your recent bank transfer. By tricking them, hackers are collecting important information related to financial accounts and then they are doing illegal transactions.
Actually hackers are running a BEC (Business Email Compromise) campaign in Middle East, Asia and United States. Hackers have high social engineering skills, therefore they are targeting employees with the help of spear phishing. Hackers are spreading info stealing malware to access the wire transfer payements”.

About “Olympic Vision” Malware
“Olympic Vision” Malware is available on Black Market, just for 25 Dollars. It is also not very advanced threat but it have many features due to which it is capable to steal a variety of important information from its target. It has two main functions. First, it records the keystrokes and second it is capable to take screenshots after few seconds in order to steal information, researchers also said that this is the fourth malware, which we have seen on BEC attacks.

Security Researchers of Trend Micro said that we are tracing the users of “Olympic Vision” keylogger and we have successfully traced the identities of two Nigerian bad actors. One from them was operating this malware from Lagos and the other one was operating from Kuala Lumpur.
BEC (Business Email Compromise) attacks are big threat for the companies. According to a study of FBI, companies had lost over a billion dollars in past two years just because of these attacks. 55 Millon US Dollars theft at FACC is biggest example of BEC attacks.

Read: http://www.cyberintelligence.in/Hackers-steal-55million-dollars-from-FACC/