A mysterious mechanical failure one fateful night in a Saudi Arabian chemical plant leads a cast of operational technology researchers down a strange path towards an uncommon, but grave, threat. In this episode, we hear how these researchers discovered this threat and tried to identify who was responsible for the malware behind it. We also consider how this kind of attack may pose a threat to human life wherever there are manufacturing or public infrastructure facilities around the world.
A big thanks to Julian Gutmanis, Naser Aldossary, Marina Krotofil, and Robert M. Lee for sharing their stories with us.
Sponsors
This episode was sponsored by IT Pro TV. Get 65 hours of free training by visiting ITPro.tv/darknet. And use promo code DARKNET25.
This episode was sponsored by Linode. Linode supplies you with virtual servers. Visit linode.com/darknet and when signing up with a new account use code darknet2020 to get a $20 credit on your next project.
Sources
- https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html
- https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html
- https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html
- https://dragos.com/wp-content/uploads/TRISIS-01.pdf
- Video S4 TRITON - Schneider Electric Analysis and Disclosure
- Video S4 TRITON - Mandiant Analysis at S4x18
- Video S4 TRITON - Reverse Engineering the Tricon Controller by Dragos
- Video S4 TRITON - A Report From The Trenches
- Video - Safety Orientation video for the Chemical Plant
- https://home.treasury.gov/news/press-releases/sm1162
Attribution
Darknet Diaries is created by Jack Rhysider.
Sound design by Garrett Tiedemann.
Episode artwork by odibagas.
Theme music created by Breakmaster Cylinder. Theme song available for listen and download at bandcamp. Or listen to it on Spotify.
Equipment
Recording equipment used this episode was the Shure SM7B, a cloudlifter, Motu M2, Sony MDR7506 headphones, and Hindenburg audio editor.
Transcript
[START OF RECORDING]
JACK: At this point, every single one of my listeners has been the victim of some kind of data breach; [MUSIC] whether that’s getting your personal data stolen from the Equifax breach or some other company that had info on you but that got stolen. But how impacted are we when this happens? At the least, you should change your passwords and tighten up your own personal security and stuff like that. But there’s not much more you can do after that, so we’re kind of stuck waiting for whoever stole our data to see what they do with it. Sometimes nothing happens; we’re just not impacted at all, but I’m willing to bet in the future we’ll all each be impacted by a different kind of hack, something that will certainly impact our daily lives in a major way, like one that might take out our electricity or water, or a hack that might cause a major disaster. Like, what if a dam got opened up and let out a bunch of water and flooded a whole city? That would have a big impact on our lives.