Scourge · December 14 2017

The Scourge of TRITON, Enemy of Safety

Chronicle

On 14 December 2017 FireEye and Dragos revealed malware that had reprogrammed Schneider Electric Triconex safety instrumented systems at a Saudi petrochemical plant. These controllers exist for one reason only: to shut a plant down before an explosion or a toxic release. The intrusion was discovered because in 2017 it accidentally triggered a plant shutdown. FireEye later linked the tool to a Russian government research institute, TsNIIKhM.

Lesson learned

It was the first known malware built to disable the defences that protect human lives in industrial plants, and forced the industry to treat safety systems as possible targets.

Prayer of reparation

For those who work every day beside dangerous processes and rely on the systems that protect them, we ask protection and vigilance. Let no one ever again tamper with what exists to save lives. Amen.

How it is remembered

Remembered by keeping safety controllers in run mode rather than program mode, isolating their networks and investigating every unexplained shutdown.