LogicLocker

LogicLocker, is a cross-vendor ransomware worm that targets Programmable Logic Controllers (PLCs) used in Industrial Control Systems (ICS). First described in a research paper released by the Georgia Institute of Technology, the malware is capable of hijacking multiple PLCs from various popular vendors. The researchers, using a water treatment plant model, were able to demonstrate the ability to display false readings, shut valves and modify Chlorine release to poisonous levels using a Schneider Modicon M241, Schneider Modicon M221 and an Allen Bradley MicroLogix 1400 PLC. The ransomware is designed to bypass weak authentication mechanisms found in various PLCs and lock out legitimate users while planting a logicbomb into the PLC. As of 14 February 2017, it is noted that there are over 1,400 of the same PLCs used in the proof-of-concept attack that were accessible from the internet as found using Shodan.

Attack method

The attack method used with LogicLocker employs five stages. Initial infection, Horizontal and Vertical movement, locking, encryption and negotiation. Initial infection can take place through various vulnerability exploits. As ICS devices are typically in an always on state, this gives Cyber-criminals ample time to attempt the compromise of the PLC. PLCs generally do not have strong authentication mechanisms in place to assist in protecting themselves from potential attack. Initial infection could take place through a users clicking of a potentially malicious email attachment. Upon initial infection of the PLC, horizontal or vertical movement can be achieved from the PLC to the corporate network depending on the capabilities of the PLC. The next stage of the attack is locking in which the attacker locks out legitimate users to inhibit or prevent restoration efforts. This can be done through password changes, OEM Locking, over-utilization of PLC resources or changing IP/Ports.