Leading expert on network threats and web developer

[tanjimajuha20]

A representative of the press service of "ShchLZ" drew attention to the fact that the management companies operating the elevators are engaged in the management of the dispatching systems. The ComNews correspondent asked for a comment from OOO NPO Tekon-avtomatika, which specializes in the development of automated control and dispatching systems used in elevators, among other things. However, representatives of OOO NPO Tekon-avtomatika did not respond to the request.

According to Kai Mikhailov, head of the information security department at Infozashchita JSC (iTPROTECT), a high level of skills in Linux systems helps to carry out an attack unnoticed, hiding malware in legitimate tasks for the script launch table (cron) or by reassigning commands.

Vasily Kochkanidi, south africa whatsapp resource an analyst at RuSIEM, agrees with him. He said that using hacker utilities requires knowledge of the principles of infrastructure operation, means and methods of protection. The high level of knowledge of Linux systems, which is mentioned in the study, makes it possible to find and use the system's flaws.

However, Kai Mikhailov noted that the attackers did not hack the PLC itself, but used the standard password from the manufacturer's instructions to penetrate the system and move on. He noted that specialists in autonomous process control systems do not always pay enough attention to changing the default password, since they hope that the industrial network is isolated from the outside world.

"This method of obtaining credentials is appealing in its simplicity," said Vasily Kochkanidi. "When the system is compromised and a separate server becomes a "Trojan," and the administrator during a session on such a server, without even suspecting it, can give hackers keys to move further into the domain."

"Scale expansion" occurs during any hacker attack or network compromise. Proper segmentation of the internal network, use of external scanners to find vulnerable assets, and analysis of potential attack surfaces can prevent this development.

"This would allow us to find assets that look into the external network with a default password (low complexity for a hacker). We must not forget that the reason for the attack was not the lack of information protection tools, but the insecure configuration of the PLC by administrators," noted Kai Mikhailov.

Vasily Kochkanidi added that suspicious network connections and activities on the SCADA server can be detected using a comprehensive use of various security measures. "Multifactor authentication, the creation of a zero-trust environment and strict regulation of user rights play an important role in organizing the security system," Vasily Kochkanidi noted.

"Finally, users of the equipment should change passwords immediately as soon as the system starts working," concluded Dmitry Marichev.