Could Hackers Turn the Lights Out?

For a long-time computer security experts have warned about the threat hackers pose to the systems that help control the power stations, water treatment plants and transport systems we rely on.

Just before Christmas 206 that theoretical threat became all too real for more than 225,000 Ukrainians who were plunged into darkness by a sophisticated attack on one of the nation's power companies.

The attackers struck late in the afternoon on 23 December and used the remote access they had gained to computers in the control centre of power firm Prykarpattyaoblenergo to flip circuit breakers and shut down substations.

In total, about 30 substations were turned off, including those that served one of the control rooms for Prykarpattyaoblenergo, so staff struggling to get the lights back on were forced to find a fix in the dark.

Even now, months after the attack, computer systems at the Ukrainian energy company are not quite fixed because the "Killdisk" malware used in the attack deleted key files.

Uncovering holes

It would have taken significant time and effort to carry out this sophisticated attack, said Stephen Ward, a senior director at security firm iSight Partners, which has analysed the sequence of events leading up to the attack.

The good news is that remotely shutting down power stations or similar infrastructure systems is really hard, he said.

"To make something happen on any of these systems you have to gain information to understand their processes. Those processes are completely different from industry to industry and even facility to facility.

"The basic software may be the same but you have to write the logic to control and create the process and that's unique to the installation itself," said Mr Ward.

That was certainly true in Ukraine. Reports into the attack reveal that the hackers behind it spent months inveigling their way into Prykarpattyaoblenergo's computer systems so their co-ordinated strike would be as effective as possible.

The gang behind the Ukraine attack got in by tricking key staff into opening booby-trapped attachments on email messages crafted to look like they came from friends and colleagues.

Data Police

But, said Sergey Gordeychik, deputy chief technology head at Kaspersky Lab, there are other ways to get at industrial control systems (ICS).

Mr Gordeychik helps co-ordinate Scada Strangelove, a community of security researchers who seek out ICS systems openly exposed online. Scada (Supervisory Control and Data Acquisition) systems are used to oversee plant and machinery in industrial installations.

"We can discover more than 80,000 different kinds of ICS systems connected to the internet directly," he told the BBC.
That's bad, he said.

"If we are trying to compare the standard security of the logic controllers found in ICS systems with Windows or Apple laptops, it's like Windows 95," he said. "They are like a desktop operating system 10 years ago when the level of security was very low."

Scada Strangelove's scanning work to find these vulnerable systems has got many of them taken offline, said Mr Gordeychik. For example, he said, work that the group did on net-connected rail control systems means many of them are now inaccessible.

Its work has also prompted some hardware makers to update the software controlling their equipment to make it more secure. Some have even gone as far as uploading it to their devices to harden them even if customers do not ask for it.

Despite these successes, Mr Gordeychik said the group was not set up solely to police these vulnerable systems.

"The main idea is not trying to remove systems case-by-case," he said. "The main idea is to raise awareness and to force vendors to create more secure-by-design systems."

New Skills

That might be tricky, said Ian Glover, head of the Crest organisation that certifies ethical hackers for work on corporate and government networks.

Crest is currently carrying out research on the security of the computerised parts of the UK's infrastructure. The report is a survey of security practices at those essential plants and organisations to see if the ethical hackers who probe the digital defences will need new skills to make sure they find all potential bugs and vulnerabilities.

What had been a surprise, said Mr Glover, was the attitude of many companies who run the nation's infrastructure.

"That's what's been most disturbing to me," he said. "That people did not think they were going to be attacked."

This despite the fact that many security firms that investigate data breaches frequently find evidence that criminals and state-backed hackers are lurking in the networks.

But that danger to the systems directly connected to the net should not be overstated, a spokesman for GCHQ, the UK's intelligence and security base, said.

Digital Defences

"The single biggest vulnerability is connecting poorly protected corporate IT to operational technologies," he said.

Operational technologies (OT) refers to the machinery in the field or on an industrial plant that keeps processes going or helps manage that remote installation.

"The vast majority of attacks actually go after the corporate IT and then will act as if they were legitimate users to get the ICS or operational technologies to do something," he said.

There were good reasons why attackers chose this route, he added.

"It's much easier to exploit the corporate IT because there are so many tools you can download and use to do that," he told the BBC.

A firm with good defences against the threats that are aimed at its corporate systems will also help to defeat attempts to subvert that remotely operated plant and machinery.

GCHQ regularly advised the companies running the various parts of the UK's national infrastructure on better ways to organise their digital defences. And sometimes, he said, it helped them get ahead of potential attacks.

"As we go about prosecuting our intelligence mission and function if we get information that appears to show a threat to the CNI we will pass it on to the relevant company," he said.

These rare incidents showed that the threat to CNI was real and that there were people with the capability to launch cyber-attacks on the UK's national infrastructure. In addition, he said, there was no doubt that other groups had the intent to do the UK harm.

"Should we be worried? Yes," he said. "There are people with the capability. There are people out there with the intent. But at the moment we are not in the position where we are seeing groups with both the intent and capability.

"We are doing all we can to harden the UK should these two things, capability and intent, come together."

BBC

Critical Infrasctructure: UK and US Power Grids - Under Cyber Attack Every Minute:

A Threat No One Is Talking About - Attack On the Power Grid:

 

 

« The CIA Has Lost Control Of Its Cyber Weapon Documents
Italian Bank Cyber Spy Attacks »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Security Affairs

Security Affairs

Security Affairs is a blog covering all aspects of cyber security.

Security Innovation

Security Innovation

Security Innovation is a leader in software security assessments and application security training to top organizations worldwide.

Swedish Civil Contingencies Agency (MSB)

Swedish Civil Contingencies Agency (MSB)

MSB's Information Assurance Department is responsible for supporting and coordinating work relating to Sweden's national societal information security.

Beame.io

Beame.io

Beame.io is an information security company that distributes open source authentication infrastructure based on encryption.

Intelligent Waves

Intelligent Waves

Intelligent Waves holds and manages contracts to provide an array of intelligence, operational, communications and IT support to the USG in austere, forward-deployed, hazardous duty environments.

Socure

Socure

Socure’s identity verification increases auto approval rates, reduces false positives and captures more fraud. In real time.

Maritime Transportation System Information Sharing and Analysis Center (MTS-ISAC)

Maritime Transportation System Information Sharing and Analysis Center (MTS-ISAC)

MTS-ISAC promotes and facilitates maritime cybersecurity information sharing, awareness, training, and collaboration efforts between private and public sector stakeholders.

Silent Sector

Silent Sector

Silent Sector is a cybersecurity services company that specializes in providing a wide range of managed security services.

Innefu Labs

Innefu Labs

Innefu is an Information Security R&D startup, providing cutting edge Information Security & Data Analytics solutions.

Avalanchio Technologies

Avalanchio Technologies

The Avalanchio platform gives you a complete solution to collect, process, and analyze security data to detect threats in real-time and analyze historical data using security DSL or SQL.

Imageware

Imageware

Imageware is a leader in biometric cybersecurity. Protect against costly, damaging ransomware hacks by employing biometric cybersecurity solutions.

Endure Secure

Endure Secure

Endure Secure is a managed cyber security & information security consultancy. Our passion for IS and our understanding of the threat landscape is reflected in the services that we provide.

Klaatu IT Security (KITS)

Klaatu IT Security (KITS)

Klaatu IT Security is a boutique provider of cyber security services, empowering our clients to prioritise and reduce their cyber risk.

Somerville

Somerville

Somerville are a full service IT partner with over 40 years experience delivering exceptional service and value to our customers.

Aquia

Aquia

Aquia are on a mission to enable innovation and drive transformative change to solve the world’s most pressing and complex cybersecurity challenges.

Tech Data

Tech Data

Tech Data, a TD Synnex company, is a leading global distributor and solutions aggregator for the IT ecosystem.