Ukrainian Power Grid Hack

 

US intelligence and security agencies are investigating whether Russian government hackers were behind a cyber attack on the Ukrainian power grid last month, say multiple sources familiar with the investigation.

Computer security experts at the Central Intelligence Agency, the National Security Agency, and the Homeland Security Department are examining samples of malicious software recovered from the networks of a power company in western Ukraine, which said on Dec. 23 that a large area of the country had been left without electricity due to “interference” in its systems. Approximately 700,000 homes were without power for several hours.

If the blackout is positively attributed to the work of hackers, it will be the first documented case of a cyber attack on an electrical power facility that led to a loss of electricity. While hackers are suspected of having caused a blackout at least once in the past, there has never been a publicly confirmed case with technical data to back it up.

“It is a milestone,” John Hultquist, the director of cyber espionage analysis at computer security company iSIGHT Partners, which is analyzing hacking tools used in the intrusion, told The Daily Beast.

A confirmed cyber attack that caused a power outage would put pressure on President Obama to speak publicly about the event and say whether Russia was to blame. In 2014, Obama publicly identified North Korea as the culprit in a cyber attack on Sony Pictures Entertainment that destroyed company property and exposed private communications of executives. Obama ordered sanctions on North Korea, and US government hackers attacked key portions of North Korea’s fragile Internet in response.

Spokespersons for the CIA and the Homeland Security Department declined to comment for this article. A spokesperson for the National Security Agency didn’t respond to a request for comment. The Ukrainian government has publicly blamed Russia for the attack.

The attack in Ukraine could be a bad omen for the US power grid. Malicious software that was found on the networks of the company, Prykarpattyaoblenergo, was also used in a campaign targeting power facilities in the U.S. in 2014. It caused no damage but it set off alarms across the security and intelligence agencies.

At the time, the Homeland Security Department warned companies about the malware, known as BlackEnergy, which it said had been used in a hacking campaign that “comprised numerous industrial control systems environments…”

Industrial control systems are used to regulate the flow of electricity and to remotely control critical systems at power facilities. Security experts have warned for years that they could be commandeered via the Internet and give a hacker the ability to turn off electricity to whole cities.

“If you’re connected, you’re likely infected!” the department warned in another bulletin to power companies in the spring of 2015, urging them to disconnect any control systems that were still connected to the Internet in light of the BlackEnergy threat.

Attacks that cause loss of electrical power on a large-scale are one of a handful of nightmare scenarios that US national security officials have been trying to ensure don’t come to pass in America. They fear that cities could go without power for months or even weeks if equipment that generates or distributes electricity were taken offline and couldn’t be quickly replaced.

Among the questions the US government analysts want to answer in the Ukrainian case is how exactly the hackers were able to penetrate the company’s systems and whether they were acting on behalf of the government in Moscow or with its implied consent.

There is no doubt, multiple experts said, that the BlackEnergy malware that has been linked to intrusions into power facilities in the US was found in the Ukrainian company’s systems.

But US, and corporate analysts are proceeding cautiously given the momentousness of the event and the geopolitical implications of the Russian government’s involvement or complicity in a historic act of aggression. They’re also aware of the fact that most power outages in the US ultimately attributed to natural causes, such as storms and overgrown tree limbs, and that for all the hand-wringing about cyber attacks on the grid there has never been a proven instance. An outage in Brazil that was attributed to hackers was later said to be caused by dirty equipment.

Experts in government and at least three security companies are still compiling technical data that would show conclusively that the blackout was the result of a malicious cyber attack and not some other factor, such as human error or a mechanical failure.

But something close to a consensus view that the power outage was deliberately caused was forming among independent analysts on Tuesday. iSIGHT as well security company ESET have linked the blackout to hackers. And the SANS Institute, a respected research group that trains US government security experts, while not conclusively identifying the cause of the blackout said in a blog post last week, “The Ukrainian power outage is more likely to have been caused by a cyber attack than previously thought.”

Hultquist, of iSIGHT, said the hackers were likely part of a group that the company dubbed Sandworm and that it tracked in 2014, during the probes of US power facilities that prompted the government warning.

“I believe at the time they were preparing for an escalating event with US and Europe,” Hultquist said. It’s still not clear why the hackers didn’t follow through and cause a power outage, but Hultquist described their probes as a “reconnaissance” mission that would give them the lay of the land should they have chosen to launch an assault.

Russian hackers have been blamed for cyber attacks in the past, including against Pentagon networks last year in an apparent attempt to steal military secrets.

Given that Russia has demonstrated both the will and the expertise to use cyber attacks, US officials are paying especially close attention to the event in Ukraine.

“I’m confident they and the Ukrainian government have a lot of data and a lot of technical evidence that’s not yet public,” Robert M. Lee, the founder and CEO of Dragos Security, who has worked in the intelligence community and the military as a cyber warfare operations officer, told The Daily Beast.

White House officials declined to comment for this article. But Obama has stressed for years that US electrical systems are vulnerable to cyber attacks. In May 2009, in his first major address about cyber security after taking office, Obama said, “We know that cyber intruders have probed our electrical grid and that in other countries cyber attacks have plunged entire cities into darkness.”

He did not name those countries.

In 2008, Tom Donohue, then the CIA’s chief cyber-security officer, said that hackers had breached computer systems of utility companies outside the US and had demanded ransom or else they’d shut down the power.

Donohue, who spoke at a gathering in New Orleans of security executives from government agencies and large US utilities and energy companies, said that in at least one case an intrusion had caused a power outage that affected multiple cities. The CIA didn’t know who was behind the attacks, “but all involved intrusions through the Internet,” Donohue said.

Daily Beast: http://thebea.st/1Oc1pdh

« TalkTalk Hack Revisted
Cyber Security In Modern Railways »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Military Cyber Professionals Association (MCPA)

Military Cyber Professionals Association (MCPA)

MCPA are a team of Soldiers, Sailors, Airmen, Marines, Veterans and others interested in the development of the American military cyber profession.

IP Twins

IP Twins

IP Twins offer a wide range of services related to domain names and online brand protection.

Nemko

Nemko

Nemko offers testing, inspection, and certification services worldwide, mainly concerning products and systems, but also for machinery, installations, and personnel.

Fairfirst Insurance

Fairfirst Insurance

Fairfirst Cyber Insurance protects your business assets against the complexity of cyber threats.

Ergo

Ergo

Ergo is a world-class IT Partner of choice, leveraging the latest technology available in cloud, mobility, big data, analytics, and social media.

Semmle

Semmle

Semmle's code analysis platform helps teams find zero-days and automate variant analysis. Secure your code with continuous security analysis and automated code review.

CYRISMA

CYRISMA

CYRISMA is a revolutionary cybersecurity platform that helps organizations manage risk without the usual headaches associated with enterprise cybersecurity tools.

CyNam

CyNam

CyNam is a platform for enabling the growth and development of people and organisations within Cheltenham’s flourishing cyber technology ecosystem.

Global Cybersecurity Institute - Rochester Institute of Technology (RIT)

Global Cybersecurity Institute - Rochester Institute of Technology (RIT)

At RIT’s Global Cybersecurity Institute, we educate and train cybersecurity professionals; develop new cybersecurity and AI-based knowledge for industry, academia, and government.

ReasonLabs

ReasonLabs

ReasonLabs have created a next-generation anti-virus that is enterprise grade, yet accessible to any personal device around the world.

Purple Team

Purple Team

Purple Team is an expert cybersecurity and managed security service provider focused on arming your IT infrastructure with both red team and blue team services.

DC Two

DC Two

DC Two are a locally operated and supported Australian data centre, offering a suite of vertically integrated services covering every part of the data centre and cloud technology stack.

Alethea

Alethea

Alethea is a technology company helping companies, nonprofits, and democracies protect themselves from harms stemming from disinformation and social media manipulation.

First Focus

First Focus

First Focus is a managed service provider for medium-sized organisations.

Endor Labs

Endor Labs

Endor Labs gives developers and security teams the context they need to prioritize open source risk.

xdr.global

xdr.global

Xdr.global is a cybersecurity consulting firm, focused on promoting and aligning Extended Detection and Response (XDR) security solutions.