Triton/TriSIS: the new Stuxnet

The recent discovery of ICS-specific malware targeting the Schneider Electric Triconex safety instrumented systems (SIS).
They have demonstrated the ability to modify the logic and programming of the system.

It should prompt us to ask: “Am I doing everything I can? Am I safe? What is missing?”

What is Triton?

Is the malware known as Triton (or TriSIS) really an isolated incident, or are we facing a possible and much more sinister future?

Triton is the name of a piece of malware, short for malicious software. To date it is the deadliest malware in the world, and the bad news is that it is spreading.

Triton is malicious software that can disable the safety systems designed to prevent possible industrial accidents with catastrophic outcomes.
The main targets are large plants, which often provide essential services.

Discovered in the Middle East, this malware is mainly used to target companies in North America and other parts of the world.

Triton uses a library of protocol calls to download instructions into the safety controller in order to run its own programming.
In particular, it made it possible to take control of these systems remotely, and the code allowed intruders to disable or tamper with them.

Everyone is surprised that hackers would spend time focusing on developing malware to attack a safety system.

Safety products have historically been more isolated than the Distributed Control System (or DCS) in a plant.

Context matters: why target an SIS controller?

• Triggering a safety shutdown by lowering thresholds, etc.
• Preventing the system from stopping a process in dangerous conditions.

You realise that a larger and more accessible Distributed Control System is an easier target for bringing about a process shutdown.

A Distributed Control System offers many more attack options for bringing about a controlled shutdown of a process.