https://arstechnica.com/information-technology/2017/12/game-changing-attack-on-critical-infrastructure-site-causes-outage/It appears a group of hackers with backing developed malware to target a Triconex safety interlock system at an industrial plant. The malware was not designed to get info, but to disable the system potentially causing damage. To me, this looks more like a warfare capability rather than typical hacking. There was a comment at the bottom that mentioned if we ever see another major war between two high tech nations, everything is subject to attack.
Hackers who may have been working on behalf of a nation recently caused an operational outage at a critical-infrastructure site, researchers said Thursday. The attackers did so by using a novel piece of malware to target the system that prevents health- and life-threatening accidents.
The accidental outage was likely the result of the Triconex SIS, or "safety instrumented system." The SIS shut down operations when it experienced an error that occurred as the hackers were performing reconnaissance on the facility. Although the hackers were likely seeking the ability to cause physical damage inside the facility, the November shutdown was likely not deliberate.
For those non-industrial people, SIS systems are a compartmented part of the control system or a separate system. If a shut down condition exists, it causes everything in the unit to shutdown and go to fail safe condition. That usually means all motors stop, isolation valves close, and vent valve vent pressure to flare. If that doesn't work or a high pressure/ high temperature condition doesn't cause a trip, it could result to equipment damage at the least. The likely result is extended downtime for repairs. Maybe worse with some processes.
