The impact of WannaCry on industrial control systems (ICS)

The impact of WannaCry on industrial control systems (ICS)

As the WannaCry ransomware (MS17-010) has spread globally in the last 24 hours and severely impacted the National Health System and locked hospital workers out of critical healthcare patient data,  Brad Hegrat, IOActive’s Director of Advisory Services, explains the impact of WannaCry on industrial control systems (ICS).  

The impact of WannaCry on ICS

A few weeks ago back in mid-March (2017), Microsoft issued a security bulletin (MS17-010) and patch for a vulnerability that was yet to be publicly disclosed or referenced.  According to the bulletin, “the most severe of the vulnerabilities could allow remote code execution if an attacker sends specially crafted messages to a Microsoft Server Message Block 1.0 (SMBv1) server. This security update is rated Critical for all supported releases of Microsoft Windows.”  https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Normally, when Microsoft issues a patch or security there is an acknowledgement on their website regarding the disclosure. Below is the website and it is an interesting process at this point to make a visit – https://technet.microsoft.com/en-us/library/security/mt745121.aspx

Notice anything? MS17-010 is conspicuous in its absence.

It is often said that timing is everything, and in this case, Microsoft beat the clock. Exactly one month later, on 14 April 2017, ShadowBrokers dropped a fifth in a series of leaks supposedly associated with the NSA which included an exploit codenamed ETERNALBLUE. Flashing forward to today almost one full month later, this payload has been weaponized and over the last few hours, has been used in a rash of ransomware attacks throughout the UK, mainland Europe and western Asia.

https://krebsonsecurity.com/2017/05/u-k-hospitals-hit-in-widespread-ransomware-attack/

https://www.forbes.com/sites/thomasbrewster/2017/05/12/nsa-exploit-used-by-wannacry-ransomware-in-global-explosion/

https://www.theregister.co.uk/2017/05/12/spain_ransomware_outbreak/

Considering the timing, one could be inclined to consider that this was not just Microsoft’s good fortune.

While pretty much the entire wired world is rushing to patch MS17-010, even though that patch has been out for almost two months, there is one technology area that is cause for particular concern especially when it comes to ransomware. This area of concern are the global industrial environments.

Historically, general purpose, run of the mill malware that leverages SMB and NetBIOS interfaces in the industrial environment are particularly troublesome, with many systems remaining infected many years later.  Besides ICS environments being in an operational state that complicates the life of those seeking to patch them, some of these legacy systems often use a protocol called or Object linking and embedding for Process Control (OLE for Process Control, or OPC for short). OPC Classic (a legacy protocol implementation), relies on the Distributed Component Object Model (DCOM) which makes heavy use of the Distributed Computing Environment / Remote Procedure Calls (DCE/RPC) protocol. In addition to NetBIOS and depending on both configuration and implementation, SMB is one of the interfaces that can be leveraged by these other services. Because both NetBIOS and SMB are needed in some manner by ICS software and protocols, many ICS systems have been negatively impacted by malware leveraging SMB and NetBIOS attacks reaching back well over a decade.

Consider the major, well known examples of malware impacting the ICS space.

In November of 2008, the first variant of Conficker was publicly identified and due to the ICS requirements of keeping the NetBIOS and SMB ports open, Conficker is still found to this day. Conficker exploited MS08-067 and due to its password brute forcing capability, is incredibly resilient to remediation attempt at the system level.  Another major example that utilized the attack vector in MS08-067 was Stuxnet. We all know how that turned out. MS17-010 has the potential to be every bit as damaging, and in some ways much worse.

Further reading: Critical Infrastructure and ICS Security Remain a Network Segmentation Problem

With the WannaCry/WanaCrypt ransomware in the wild, crossing into industrial control systems would be particularly devastating. Systems requiring real-time interfacing and control influence over physical assets could face safety/critical shutdown, or worse.  When thinking about critical services to modern society (power, water, wastewater, etc.), there is a real potential, potentially for the first time ever, where critical services could be suspended due to ransomware.  It may be time to rethink critical infrastructure cybersecurity engineering, because if MS17-010 exploiting malware variants are successful, we are clearly doing something wrong.