Trend Micro creates factory honeypot, traps malicious attackers
Six-month investigation results can help inform protection strategy for industrial environments.
Trend Micro (TYO: 4704;TSE: 4704), a global leader in cyber security solutions, today announced the results of a six-month honeypot imitating an industrial factory. The highly sophisticated operational technology (OT) honeypot attracted fraud and financially motivated exploits.
The six-month investigation revealed that unsecured industrial environments are primarily victims of common threats. The honeypot was compromised for crypto-currency mining, targeted by two separate ransomware attacks, and used for consumer fraud.
“Too often, discussion of cyber threats to industrial control systems (ICS) has been confined to highly sophisticated, nation-state level attacks designed to sabotage key processes. While these do present a risk to Industry 4.0, our research proves that more commonplace threats are more likely,” said Greg Young, vice-president of cyber security for Trend Micro. “Owners of smaller factories and industrial plants should therefore not assume that criminals will leave them alone. A lack of basic protections can open the door to a relatively straightforward ransomware or crypto-jacking attack that could have serious consequences for the bottom line.”
To better understand the attacks targeting ICS environments, Trend Micro Research created a highly realistic, industrial prototyping company. The honeypot consisted of real ICS hardware and a mix of physical hosts and virtual machines to run the factory, which included several programmable logic controllers (PLCs), human machine interfaces (HMIs), separate robotic and engineering workstations and a file server.
“Africa still boasts highly active industrial businesses, from manufacturing to mining and engineering. While many are ramping up their use of IOT systems, some are still grappling with upgrading their backend infrastructure,” states Indi Siriniwasa, vice-president, sub-Saharan Africa for Trend Micro. “By using a honeypot to detect unauthorised use of these industrial systems paired with continued diligence and utilising secure computing techniques, industries can increase their security posture to be able to deflect and defend against attacks to their OT environments.”
Trend Micro urges smart factory owners to minimise the number of ports they leave open and to tighten access control policies, among other cyber security best practices. In addition, implementing cyber security solutions designed for factories, like those offered by Trend Micro, can help further mitigate the risk of attack.
To read more about the research, including the design and deployment of the honeypot itself, please visit: https://www.trendmicro.com/vinfo/us/security/news/internet-of-things/fake-company-real-threats-logs-from-a-smart-factory-honeypot.
Trend Micro Incorporated, a global leader in cybersecurity solutions, helps to make the world safe for exchanging digital information. Our innovative solutions for consumers, businesses, and governments provide layered security for data centers, cloud environments, networks, and endpoints. All our products work together to seamlessly share threat intelligence and provide a connected threat defense with centralized visibility and control, enabling better, faster protection. With more than 6,000 employees in over 50 countries and the world’s most advanced global threat intelligence, Trend Micro secures your connected world. For more information, visitwww.trendmicro.com.