If Sony Had Been a Chemical Plant

The infosec world is still buzzing about the recent hack of Sony and how completely their information systems were owned by the attacker. Researchers will be pouring over this attack for a while trying to figure out how it all happened and what could have been done to prevent it.

The Hack

The Sony hackers took, among other things, valuable intellectual property (high quality digital copies of yet to be released films), thousands of internal documents (one source said 1 terabytes worth), and system access information to include log-in credentials and passwords. The attack was so thorough that Sony was forced to shut down all computer systems for days while they went through and inspected/cleaned every machine.

The TWITERVERSE is all agog, of course about #SonyHack. I’ve made my own small contribution (sans hashtag, of course). The one tweet of mine that I would like to look at in more detail came on Saturday:

“I guess we should be glad that Sony didn't make dangerous chemicals or supply something really important....”

XYZ Chemical Company

So what would have been different if it had been XYZ Chemical Company that had attracted the ire of the GOP attackers? Other than differences in what IP was stolen, probably not much in the immediate results of the attack. The longer term results could have been much more serious to communities around XYZ plants and possibly to the nation.

Intellectual property theft? Well, formulations come to mind first. The wholesale release of formulations would give every competitor here and around the world a leg up in understanding how XYZ makes their products. Even for fully mature product lines, the little tweaks to the formulation a company makes can make a major difference in pricing and performance. This could make for a serious change in competitive status.

The public publishing of the formulations could have other consequences as well. There are a number of chemicals being used in the chemical industry that have raised concerns among environmental activists. If a formulation list included such chemicals the company could come under additional scrutiny from these activists, potentially leading to image issues. Worse yet, if any of the chemicals being used were on the lists of chemicals offensive to various environmental wacko fringe groups, the facility could become a target for varying degrees of physical attacks.

Control System Insecurity

From a security perspective the IP that is of more concern, however, would be process flow diagrams and control system working documents. Those pieces of information would make it much easier for an attacker that has gained access to the control system to figure out how to manipulate the controls in that system in a manner that could disrupt the facility in the worst possible way.

Since most corporate types use a single set of login credentials across the entire spectrum of company computer systems, it is very likely that even if the control systems were not directly breached in the attack, there would be useable log-in credentials for the control systems to be culled from the corporate log-ins. Once an attacker can gain legitimate access to a control system, the various ‘insecure-by-design’ problems become very large vulnerabilities.

If the control system had been directly breached as well the problems become much worse. The shut down and start-up of a chemical control system, particularly with continuous chemical processes like refineries, is not something that is done lightly or quickly. And searching control systems for logic bombs, back-doors, and forms of re-programing is a much more time consuming task than for an IT system of comparable size. The larger the number of PLCs involved the more difficult the task becomes.

Physical Insecurity

One set of computer data files that no one wants to see released are physical security plan files. Password and log-in credentials can be changed fairly easily, but making significant changes to a site security plan are very expensive and time consuming. The public availability of site security plans would make the facility much more susceptible to physical attack or theft of chemicals.

While there are some people that claim that the Sony attackers had at least some physical access to the corporate computer system that would not necessarily mean that that access included detailed information about the site security plan. Most folks entering a facility are aware of only a small part of the over-all security plan for the facility.

For many chemical manufacturing facilities a major source of security concerns can be found in the computer systems of the order handling folks. The timing and sourcing of inbound and outbound chemical shipments makes them that much more vulnerable to off-site attack. Those attacks may allow for inbound shipments to be intercepted and converted to a method of attack (VBIED) or simply diverted to some other nefarious or illegal end.

The Big Picture

The major take away from this attack is that this was no longer a hack to deface a web site, steal money or credentials. This was a full scale attack on a company with the intent of seriously harming the company for some as of yet unknown reason. The scope and scale of the attack is unlike anything we have seen in the corporate world. Unfortunately, as with all things cyber, it will undoubtedly set the new gold standard for serious attacks as it give other groups and hackers ideas about what can be accomplished with a successful cyber attack.