Easy availability of ICS hacking tools poses major threat to industrial sector, researchers warn

Most tools are 'vendor agnostic' and can target products from some of the largest ICS original equipment manufacturers, warns FireEye

Easy accessibility of ready-made tools for hack industrial control systems (ICS) has increased the risk for major industrial companies.

That's according to the cyber security firm FireEye, which has warned that a large number of vendor-agnostic ICS hacking tools have become easily available on the web. These tools have been designed to either exploit existing security flaws in ICS or to interact with the equipment in a way to support intrusions by threat actors.

Some of the ICS intrusion tools that FireEye researchers analysed were created as early as 2004, although the majority of them have been developed over the last 10 years.

The researchers found most of these tools to be vendor agnostic, meaning that they can target products from some of the largest ICS original equipment manufacturers. But cyber criminals have also developed intrusion tools to target systems developed by some specific ICS vendors.

Siemens is currently the most targeted ICS vendor, according to FireEye, with 60 per cent of the vendor-specific tools targeting its products.

GE, Schneider Electric, ABB, Rockwell Automation, Digi International, and Wind River Systems are other manufacturers who products that also being targeted by vendor-specific hacking tools.

The researchers said they also noticed a wide array of purposes for which ICS intrusion tools are used by the attackers. They include tools for exploiting security bugs in ICS equipment, tools for scanning networks for ICS-specific devices, tools for interacting with mesh radio networks, and so on.

More than 25 per cent of these hacking tools are being used for network discovery.

"Given the simplicity and accessibility of exploit modules, they are attractive to actors with a variety of skill levels," the researchers state in the report.

"Even less sophisticated actors may take advantage of an exploit module without completely understanding how a vulnerability works or knowing each of the commands required to exploit it."

ICS is a general term used to describe different types of control systems and associated equipment used to operate and/or automate industrial processes in various fields such as oil and gas, electrical, chemical, manufacturing and pharmaceutical.

Like other systems that are networked to the Internet, ICS must also be properly secured. But, sometimes, the security aspect of ICS is overlooked, which eventually results in having a system that is unpatched, out of date, and vulnerable to attacks.

Last year, researchers from cyber security firm Tenable said that they had discovered 12 vulnerabilities in four major ICS, which could enable remote attackers to take control of critical infrastructure systems.

In a report, researchers said that vendors of SCADA (Supervisory Control and Data Acquisition) systems had left gaping holes in their PLC and HMI development environments, which could create "great opportunity for future attackers and the next high-profile attack on an industrial control system".