GRID ICS Specific Malware & Attack Techniques

Question 1

Which malware was specifically designed to target industrial control systems and manipulate PLCs?

Accepted Answer

Stuxnet

Answer

Stuxnet was a highly sophisticated malicious computer worm discovered in 2010, specifically designed to target and manipulate industrial control systems. It famously targeted Siemens PLCs (Programmable Logic Controllers) used in Iran's nuclear program, causing physical damage to centrifuges by altering their operational speeds.

Question 2

What is a key feature of the Triton malware?

Accepted Answer

Targets safety systems

Answer

Triton (also known as TRISIS or HatMan) is malware specifically designed to target Triconex safety instrumented systems (SIS) used in critical infrastructure. Its unique capability is to manipulate or disable these safety systems, which are intended to prevent catastrophic failures, thereby posing a direct threat to human life and environmental safety.

Question 3

What technique is commonly used by ICS attackers for lateral movement?

Accepted Answer

Credential reuse

Answer

Credential reuse is a common technique where attackers compromise credentials in one part of an organization (e.g., IT network) and then attempt to use those same credentials to gain access to other systems, including those in the ICS/OT environment. Many ICS environments still rely on shared or weak credentials, making this an effective method for lateral movement.

Question 4

Which malware disrupted Ukraine’s power grid in 2015?

Accepted Answer

Industroyer

Answer

Industroyer (also known as CrashOverride) is a sophisticated malware specifically designed to attack industrial control systems, and it was responsible for the 2016 cyberattack that caused power outages in Ukraine. It leveraged various industrial protocols to directly interact with and disrupt electrical substations, demonstrating its capability to cause widespread physical damage.

Question 5

Why are ICS devices more vulnerable to cyberattacks?

Accepted Answer

They lack frequent updates

Answer

ICS devices often operate for extended periods without updates due to concerns about system stability, vendor support, and the complexity of patching critical operational systems. This lack of frequent patching leaves them vulnerable to known exploits and security flaws, making them easier targets for cyberattacks compared to regularly updated IT systems.

(GRID) GIAC Response and Industrial Defense Practice Test

(GRID) GIAC Response and Industrial Defense Practice Test

GRID ICS Specific Malware & Attack Techniques