Ukrainian Power Grid Hack

 

US intelligence and security agencies are investigating whether Russian government hackers were behind a cyber attack on the Ukrainian power grid last month, say multiple sources familiar with the investigation.

Computer security experts at the Central Intelligence Agency, the National Security Agency, and the Homeland Security Department are examining samples of malicious software recovered from the networks of a power company in western Ukraine, which said on Dec. 23 that a large area of the country had been left without electricity due to “interference” in its systems. Approximately 700,000 homes were without power for several hours.

If the blackout is positively attributed to the work of hackers, it will be the first documented case of a cyber attack on an electrical power facility that led to a loss of electricity. While hackers are suspected of having caused a blackout at least once in the past, there has never been a publicly confirmed case with technical data to back it up.

“It is a milestone,” John Hultquist, the director of cyber espionage analysis at computer security company iSIGHT Partners, which is analyzing hacking tools used in the intrusion, told The Daily Beast.

A confirmed cyber attack that caused a power outage would put pressure on President Obama to speak publicly about the event and say whether Russia was to blame. In 2014, Obama publicly identified North Korea as the culprit in a cyber attack on Sony Pictures Entertainment that destroyed company property and exposed private communications of executives. Obama ordered sanctions on North Korea, and US government hackers attacked key portions of North Korea’s fragile Internet in response.

Spokespersons for the CIA and the Homeland Security Department declined to comment for this article. A spokesperson for the National Security Agency didn’t respond to a request for comment. The Ukrainian government has publicly blamed Russia for the attack.

The attack in Ukraine could be a bad omen for the US power grid. Malicious software that was found on the networks of the company, Prykarpattyaoblenergo, was also used in a campaign targeting power facilities in the U.S. in 2014. It caused no damage but it set off alarms across the security and intelligence agencies.

At the time, the Homeland Security Department warned companies about the malware, known as BlackEnergy, which it said had been used in a hacking campaign that “comprised numerous industrial control systems environments…”

Industrial control systems are used to regulate the flow of electricity and to remotely control critical systems at power facilities. Security experts have warned for years that they could be commandeered via the Internet and give a hacker the ability to turn off electricity to whole cities.

“If you’re connected, you’re likely infected!” the department warned in another bulletin to power companies in the spring of 2015, urging them to disconnect any control systems that were still connected to the Internet in light of the BlackEnergy threat.

Attacks that cause loss of electrical power on a large-scale are one of a handful of nightmare scenarios that US national security officials have been trying to ensure don’t come to pass in America. They fear that cities could go without power for months or even weeks if equipment that generates or distributes electricity were taken offline and couldn’t be quickly replaced.

Among the questions the US government analysts want to answer in the Ukrainian case is how exactly the hackers were able to penetrate the company’s systems and whether they were acting on behalf of the government in Moscow or with its implied consent.

There is no doubt, multiple experts said, that the BlackEnergy malware that has been linked to intrusions into power facilities in the US was found in the Ukrainian company’s systems.

But US, and corporate analysts are proceeding cautiously given the momentousness of the event and the geopolitical implications of the Russian government’s involvement or complicity in a historic act of aggression. They’re also aware of the fact that most power outages in the US ultimately attributed to natural causes, such as storms and overgrown tree limbs, and that for all the hand-wringing about cyber attacks on the grid there has never been a proven instance. An outage in Brazil that was attributed to hackers was later said to be caused by dirty equipment.

Experts in government and at least three security companies are still compiling technical data that would show conclusively that the blackout was the result of a malicious cyber attack and not some other factor, such as human error or a mechanical failure.

But something close to a consensus view that the power outage was deliberately caused was forming among independent analysts on Tuesday. iSIGHT as well security company ESET have linked the blackout to hackers. And the SANS Institute, a respected research group that trains US government security experts, while not conclusively identifying the cause of the blackout said in a blog post last week, “The Ukrainian power outage is more likely to have been caused by a cyber attack than previously thought.”

Hultquist, of iSIGHT, said the hackers were likely part of a group that the company dubbed Sandworm and that it tracked in 2014, during the probes of US power facilities that prompted the government warning.

“I believe at the time they were preparing for an escalating event with US and Europe,” Hultquist said. It’s still not clear why the hackers didn’t follow through and cause a power outage, but Hultquist described their probes as a “reconnaissance” mission that would give them the lay of the land should they have chosen to launch an assault.

Russian hackers have been blamed for cyber attacks in the past, including against Pentagon networks last year in an apparent attempt to steal military secrets.

Given that Russia has demonstrated both the will and the expertise to use cyber attacks, US officials are paying especially close attention to the event in Ukraine.

“I’m confident they and the Ukrainian government have a lot of data and a lot of technical evidence that’s not yet public,” Robert M. Lee, the founder and CEO of Dragos Security, who has worked in the intelligence community and the military as a cyber warfare operations officer, told The Daily Beast.

White House officials declined to comment for this article. But Obama has stressed for years that US electrical systems are vulnerable to cyber attacks. In May 2009, in his first major address about cyber security after taking office, Obama said, “We know that cyber intruders have probed our electrical grid and that in other countries cyber attacks have plunged entire cities into darkness.”

He did not name those countries.

In 2008, Tom Donohue, then the CIA’s chief cyber-security officer, said that hackers had breached computer systems of utility companies outside the US and had demanded ransom or else they’d shut down the power.

Donohue, who spoke at a gathering in New Orleans of security executives from government agencies and large US utilities and energy companies, said that in at least one case an intrusion had caused a power outage that affected multiple cities. The CIA didn’t know who was behind the attacks, “but all involved intrusions through the Internet,” Donohue said.

Daily Beast: http://thebea.st/1Oc1pdh

« TalkTalk Hack Revisted
Cyber Security In Modern Railways »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

ThreatConnect

ThreatConnect

ThreatConnect is an enterprise threat intelligence platform by Cyber Squared bridging incident response, defense, and threat analysis for InfoSec & DFIR teams.

Ciklum

Ciklum

Ciklum provide specialist software QA and testing services including Security QA and Performance QA, QA Automation and Manual QA.

Axiomatics

Axiomatics

Axiomatics provides dynamic authorization and access control solutions to protect critical data assets.

CANVAS Consortium

CANVAS Consortium

The CANVAS Consortium aims to unify technology developers with legal and ethical scholar and social scientists to approach the challenges of cybersecurity.

Onspring

Onspring

Onspring is the cloud-based platform of choice for governance, risk and compliance (GRC) teams and business operations experts across multiple industries.

Cyjax

Cyjax

Cyjax monitors the Internet to identify the digital risks to your organisation, including cyber threats, reputational risks and the Darknet.

KIOS Center of Excellence (KIOS CoE)

KIOS Center of Excellence (KIOS CoE)

KIOS carries out top level research in the area of Information and Communication Technologies (ICT) with emphasis on the Monitoring, Control and Security of Critical Infrastructures.

Arab Information & Communication Technologies Organization (AICTO)

Arab Information & Communication Technologies Organization (AICTO)

The Arab ICT Organization (AICTO) is an Arab governmental organization working under the aegis of the league of Arab States.

Early Birds

Early Birds

Early Birds is a Business to Business (B2B) marketplace for Innovators (Startups/Scaleups) and Early Adopters to exchange value early on.

Gordian Networks

Gordian Networks

Gordian Networks offers complete managed IT services and IT support for small to large businesses.

Phy-Cy.X Security Group

Phy-Cy.X Security Group

Phy-Cy.X specialize in the “Physics” of Information Security through both physical and cyber domains. We are not an IT company, we ARE an Information Security company.

Dynatrace

Dynatrace

Dynatrace provides software intelligence to simplify cloud complexity and accelerate digital transformation.

Berezha Security Group (BSG)

Berezha Security Group (BSG)

BSG is a cybersecurity consulting firm specializing in all aspects of application security and penetration testing.

InfoSec4TC

InfoSec4TC

InfoSec4tc is an online Information Security Courses, Training, and Consultancy provider.

StealthMole

StealthMole

StealthMole is a deep and dark web threat intelligence company that delivers a cloud-based, unified platform for digital investigation, risk assessment, and threat monitoring.

US Cyber Games

US Cyber Games

US Cyber Games is committed to inform and inspire the broader community on ways to develop tomorrow’s cybersecurity workforce.