Story image

Remote administration tools bring unexpected threats to industrial networks

Legitimate remote administration tools (RAT) pose a serious threat to industrial networks: they are installed on 31.6% of industrial control system (ICS) computers, but often remain unnoticed until the organisation’s security team finds out that criminals have been using a RAT to install ransomware or cryptocurrency mining software, or to steal confidential information or even money. 

This was discovered by Kaspersky Lab security experts, who conducted dedicated research into the problem.

RATs are legitimate software tools that allow third parties to access a computer remotely. They are often used legitimately by employees at industrial enterprises to save resources, but can also be used by malicious actors for stealthy privileged access to targeted computers.

According to a report published by Kaspersky Lab ICS CERT, RATs are incredibly widespread across all industries: nearly one-third of ICS computers protected by Kaspersky Lab products have RATs installed on them. 

Even more importantly, almost one RAT in five comes bundled with ICS software by default. This makes them less visible to system administrators and, consequently, more attractive to threat actors.

According to the research, malicious users utilise RAT software to:

1. Gain unauthorised access to the targeted network.

2. Infect the network with malware to conduct espionage, sabotage and make illegal financial profits through ransomware operations or by accessing financial assets via the networks attacked.

The most significant threat posed by RATs is their ability to gain elevated privileges in the system attacked. In practice, it means gaining unlimited control over an industrial enterprise, which can result in significant financial losses, as well as a physical catastrophe. 

Such capabilities are often gained through a basic brute force attack, which involves trying to guess a password by trying all possible character combinations until the correct one is found. While brute force is one of the most popular ways to take control of a RAT, attackers can also find and exploit vulnerabilities in the RAT software itself.
 
To reduce the risk of cyber attacks involving RATs, Kaspersky Lab ICS CERT recommends implementing the following technical measures:

1. Audit the use of application and system remote administration tools used on the industrial network, such as VNC, RDP, TeamViewer, RMS / Remote Utilities. Remove all remote administration tools that are not required by the industrial process.

2. Conduct an audit and disable remote administration tools which came with ICS software (refer to the relevant software documentation for detailed instructions), provided that they are not required by the industrial process.

3. Closely monitor and log events for each remote control session required by the industrial process; remote access should be disabled by default and enabled only upon request and only for limited periods of time.

Oracle Java Card update boosts security for IoT devices
"Java Card 3.1 is very significant to the Internet of Things, bringing interoperability, security and flexibility to a fast-growing market currently lacking high-security and flexible edge security solutions."
Sophos hires ex-McAfee SVP Gavin Struther
After 16 years as the APAC senior vice president and president for McAfee, Struthers is now heading the APJ arm of Sophos.
Security platform provider Deep Instinct expands local presence
The company has made two A/NZ specific leadership hires and formed several partnerships with organisations in the region.
Half of companies unable to detect IoT device breaches
A Gemalto study also shows that the of blockchain technology to help secure IoT data, services and devices has doubled in a year.
Stepping up to sell security services in A/NZ
WatchGuard Technologies A/NZ regional director gives his top tips on how to make a move into the increasingly lucrative cybersecurity services market.
Huawei founder publically denies spying allegations
“After all the evidence is made public, we will rely on the justice system.”
Malware downloader on the rise in Check Point’s latest Threat Index
Organisations continue to be targeted by cryptominers, despite an overall drop in value across all cryptocurrencies in 2018.
IoT breaches: Nearly half of businesses still can’t detect them
The Internet of Thing’s (IoT’s) rapid rise to prominence may have compromised its security, if a new report from Gemalto is anything to go by.