Company’s industrial heating system hacked via backdoor
An FBI memo circulated internally and shared with New Jersey law enforcement this last summer has recently been published and tells of a compromise of the industrial control system of a New Jersey air conditioning company via a publicly documented backdoor.
“The intruders were able to access a backdoor into the ICS system that allowed access to the main control mechanism for the company’s internal heating, ventilation, and air conditioning (HVAC) units. [The company] was using the Tridium Niagara ICS system, which has been widely reported in the media to contain multiple vulnerabilities that could allow an attacker to remotely control the system,” it is stated in the memo.
The attackers are thought to have used a link posted by a user that goes by the online moniker @ntisec, which was one of the results of a search via Google and the Shodan computer search engine to search for indications of Internet-facing Niagara systems.
“[The company] had a controller for the system that was password protected, but was set up for remote/Internet access. By using the link posted by the hacktivist, the published backdoor URL provided the same level of access to the company’s control system as the password-protected administrator login. The backdoor required no password and allowed direct access to the control system,” says the memo.
The attackers had access to the control systems’ GUI, which offered a detailed and clearly labeled floor plan layout of the office and shop area but, as luck would have it, apparently did nothing to interfere with the settings.
“According to the Tridium website, over 300,000 instances of Niagara AX Framework are installed worldwide in applications that include energy management, building automation, telecommunications, security automation and lighting control,” the memo points out.
Given the convenience of having the possibility of remotely administrating such systems, it is likely that many of them have access to the Internet.
It is common knowledge that researchers have barely scraped the surface of the mountain of vulnerabilities that seemingly affect SCADA systems in use today. They repeatedly warn about the documented and undocumented flaws that are bound to get exploited by attackers looking to have some fun or, worse yet, to do some serious damage.
As is the usual way of this world, it will probably take an incident of near-catastrophic proportions to make decision-makers pay heed to these warnings, but in the meantime the best we can do is publicize incidents that have already happened.