What You Don’t Know Can Hurt You: Triton Malware
Everyone has heard the aphorism that “What you don’t know can’t hurt you.” Of course, the expression is patently false in a wide variety of contexts – and it’s especially false when it comes to hidden cybersecurity threats, some of which are capable of inflicting damage far more severe than data breaches and identity theft. One such cyber threat that could potentially hurt millions, not just financially but physically, is the malware known as Triton.
Triton Discovered in Industrial Safety Instrumented Systems
Triton is a particularly malicious piece of malware that targets IIoT including safety instrumented systems, which generally comprise physical controllers and the software that runs them. These systems are deployed in a wide variety of industries and are meant to provide a safety net that first detects dangerous conditions and then takes action to ameliorate those conditions. When Triton’s existence was first publicly revealed in late 2017, for example, it had been found on safety controllers at a petrochemical plant – and because the controllers were physically capable of controlling a variety of plant infrastructures like pressure-release and shutoff-valve mechanisms, whoever was controlling the malware could have taken a variety of actions that could have led to an explosion or a release of toxic gases that could have proved fatal to many in the plant and its surrounding area.
Although researchers have not released the name of the petrochemical plant, they have published some of the details regarding how hackers were able to get into the system and install Triton – and those details provide a classic example of why privileged access management (PAM) is a crucial part of a comprehensive cybersecurity strategy.
How Triton Infiltrates Industrial IoT
Here is a high-level overview of how the Triton hackers were able to exploit a series of common vulnerabilities to achieve their goal, along with a discussion on how an appropriate PAM solution could have helped to put a stop to them by ensuring that only the right users, doing the right things at the right times, have privileged access to network systems.
1. Hackers Likely Had Been in the Petrochemical Company’s Corporate Network for Years
It’s unclear how the hackers first gained entrance to the corporate network, but very often in cyberattacks, such entrance is gained either through brute-force attacks or stolen credentials. Thus, it’s at least possible that initial multi-factor authentication (MFA) might have kept them out in the first place by validating their identity and thus helping to secure potential access points. Regardless of how they gained entrance, though, it’s likely that once inside the network they would have generated unusual session traffic as they probed for further weaknesses. Session monitoring and management, which is an important part of PAM, would have flagged and terminated such sessions, potentially stopping them from proceeding any further into the network.
2. From the Corporate Network, Hackers Found and Accessed the Plant Network
One of the key concepts of PAM is of course that non-privileged users can’t gain access to privileged resources, and a robust PAM implementation goes even further: Not only are users denied access to a privileged resource they aren’t authorized on, but they also will not even be aware of the existence of that resource in the first place; it’s not visible on the network. This is an important point: If hackers can see privileged resources, they are often able to bounce across the network and access them through simple brute force attacks. Thus, although how the hackers got into the plant network from the corporate network isn’t published information, it’s at least feasible that PAM could have prevented this from occurring.
3. Once Inside the Plant Network, Hackers Took Over an Engineering Workstation
Once again it’s unclear how the hackers were able to accomplish this, but it’s possible that they ultimately got to the workstation through a series of lateral moves around the network – that is, they may have been able to essentially move from one resource to the next on the network. However they got there, ultimately either they saw the machine on the plant network and were able to exploit a flaw in Windows, or else they were able to steal employee credentials for the machine in question. Either way, it’s possible that a PAM solution would have hidden the machine, as a privileged asset, away from the hacker’s view. It’s also possible that, if the hackers did access the engineering workstation via stolen credentials, an MFA solution could have kept them out of the workstation by simply requiring more than a username and password.
4. Once into the Workstation, the Hackers Accessed the Safety Instrumented Systems
As a principle of secure design, the safety instrumented systems (SIS) should have required access from a privileged user account in order to get at their firmware, which is how the hackers ultimately got Triton into the SIS. Regardless of whether a user-based or machine-based account was used by the hackers, proper PAM might have stopped the hackers at this point through a combination of access management and session management, and alerted security teams that something wasn’t right.
Triton and Similar Malware Still a Threat in the Wild
As it happens, Triton only revealed itself in this particular installation because, on two separate occasions, the hackers inadvertently tripped other safety systems, shutting the plant down and instigating a hunt for the cause. If that had not happened, it’s plausible that Triton would still be installed and silently waiting to be used to catastrophic ends – and indeed, cybersecurity researchers have seen evidence of Triton and Triton-derived malware around the world.
Of course, PAM by itself will not eliminate cyber threats. But as the above details, PAM is an absolutely vital part of a complete cybersecurity toolkit. Far from “What you don’t know can’t hurt you,” cybersecurity teams would do well to keep another aphorism in mind as they go about designing and implementing secure systems: “An ounce of prevention is worth a pound of cure.”
