Why You Should Care About Pipedream - A Specialized Malware Threat

In the hit song, Sweet Dreams (Are Made of This), Eurythmics produced a bop that encourages everyone to stay optimistic and to keep working towards their goals.

(You’re already singing it in your head, aren’t you?)

Unfortunately, the message recently sent out regarding what’s called Pipedream is a serious departure from that cheerfulness. That being said, it’s still important that you hear it.

In April 2022, the Department of Energy, the FBI, the NSA, and CISA released a joint advisory statement regarding a toolset called Pipedream being used by attackers to specifically target industrial control systems (ICS).

If that sounds serious, it is. Industrial control systems use some off-the-shelf computing and some specialized hardware and software to connect to critical infrastructure systems like power generation and distribution, oil pipelines, water utilities, factory machinery, and the like.

As part of our cybersecurity practice, Schellman stays apprised of the latest developments and threats with a modus operandi to spread the word about emerging and sustained problems that threaten the digital landscape.

Sweet dreams are not “made of” Pipedream, but don’t worry. In this article, we will break down the threat this toolset poses and why exactly ICS systems are vulnerable. Using this deconstruction, stay ahead of the latest cyber threats and the elements that make them so dangerous.

Where Are ICS Systems Vulnerable to Pipedream?

So where is all this coming from? How did this start?

Most ICS systems use what are called programmable logic controllers (PLCs), which act as intermediates between the computers and the sensors or controls in the industrial system itself. From what we know, Pipedream targets PLCs offered by Schneider Electric and OMRON—two very large players in the ICS market.

Pipedream also appears to target the computing components that interact with these PLCs—specifically, a system type called Open Platform Communications Unified Architecture (OPC UA). However, experts from Dragos, Mandiant, Palo Alto Networks, and Microsoft analyzed the threat and found that these vulnerabilities actually reside in an underlying software component called Codesys.

The bad news is that Codesys components don’t merely reside in Schneider or OMRON ICS systems—they’re also in numerous other PLCs and industrial control systems. That means it’s likely that Pipedream or its future iterations will be able to exploit many other types of systems.

Pipedream as the Latest of ICS Threats

Given these targets and the importance of the systems it threatens, Pipedream bears the hallmarks of a state-sponsored threat actor. In fact, industrial cybersecurity expert Dragos has given this threat actor the name Chernovite because analysis shows that Pipedream has many similarities to CRASHOVERRIDE, previously identified as nation-state malware targeting ICS systems—namely power generation systems—in Ukraine.

In 2016 and 2017, Ukraine experienced electrical outages because of disruption to its power systems thanks to this CRASHOVERRIDE malware. That threat actor, called Electrum, appeared to be associated with the broader threat actor called Sandworm, which is understood to be a unit within the Russian military intelligence agency (GRU).

That was then, and now, Pipedream has been attributed to Chernovite because analysis shows that it appears to possess similar capabilities. It appears to be the latest iteration of malware targeting ICS systems, with the ability to adversely affect power and energy sector control systems.

But as of April 2022, Dragos has concluded that Pipedream has not yet been deployed in the wild, giving defenders an unusual opportunity to prepare for future attacks. Whether organizations managing these kinds of ICS systems take advantage of what is probably a narrow window of time remains to be seen.

How Malware Affects ICS Systems

They should, of course, because like any other cyberthreat, malware targeting ICS systems has a wide range of adverse effects.

We think of attacks against ICS systems as shutting down power or water systems or the like resulting in some inconvenience, and this is certainly true. But the nature of this threat against health and life is both more immediate and broader reaching than this.

Setting aside the harm of long-term outages of power systems, the tools in the Pipedream toolset allow attackers to directly manipulate settings like speed and torque of certain industrial systems by controlling the PLCs. What do we mean by that?

• Imagine a machine set to operate at an unsafe speed or condition resulting in immediate physical danger to those workers or others in its vicinity.
• Imagine the effects of a water utility that opened a valve of a reservoir to flood levels (or worse, opened a valve on a sewage tank). 

We witnessed a spate of largely unsuccessful attacks against small, municipal water utilities in the U.S. in 2021. But now, it’s possible that attackers now have access to better tools, which increases the risks to these utilities and the communities they serve significantly. 

How You Can Protect Your ICS System

So how to avoid these ramifications? Protecting ICS systems requires some very specific elements.

Much of the focus will be on the challenge of applying software updates and that makes sense—that’s a very real concern. But one of the problems raised particularly by Pipedream is the need for a clear understanding of the ICS software supply chain.

A lack of this understanding of the full composition of a software system means that vulnerability management could fail to identify relevant vulnerabilities and correct them.

For example, there is a Common Vulnerabilities and Exposures (CVE) list with information about relevant vulnerabilities exploited by Pipedream that tie directly to the Codesys PLC components. But if you instead searched for relevant CVEs under OMRON or Schneider Electric, you wouldn’t necessarily find those vulnerabilities—your organizations could remain unprotected as a result.

Organizations in the industrial or energy sector or those that make use of ICS systems need a rigorous, tested plan for managing security for ICS systems.

That plan should include:

• How to respond to security incidents by sophisticated threat actors;
• Address disaster recovery and business continuity
• Involve expansive tabletop exercises to consider the sufficiency of incident response and business continuity planning; as well as
• Actual field testing that simulates actual incidents as nearly as possible. 

None of this is easy to do, but failing to prepare accordingly yields increasingly prominent and adverse results.

That includes the less-obvious consequences too—we’ve already seen what happens when organizations don’t have a sufficient plan in place. As of this writing, the U.S. Department of Transportation has issued a preliminary citation to Colonial Pipeline following its 2021 ransomware attack for its insufficient planning for shutting down and restarting its pipeline.

Don’t let that be you—take action now and protect yourself from Pipedream and the like.

Next Steps for Your Cybersecurity

Pipedream is out there, and early analysis believes it’ll bring nothing good. This particular iteration of malware threatens some of society’s most critical systems, and if you’re an organization responsible for any part of the underlying software, you should prioritize plugging any holes within your security plan.

Now you know specific areas that could likely do with some attention, and why the nature of Pipedream’s threat means you should commence with improvement action as soon as possible.

To learn more about the latest cyber developments, check out our other content that addresses threats and other aspects. The information can help you prepare, adjust, and improve your practices so that you sleep better with truly “sweet dreams:”

• Understanding the Latest on Mandatory Reporting of Data Security Incidents (article)
• Cyber Resilience - Preparing for Ransomware and Other Possibilities (full webinar)
• Are Passwords Still Useful?