security ukraine claims hackers caused christmas power outage · kaspersky also suggested...
TRANSCRIPT
http://onforb.es/1MPmmZF
SECURITY 1/04/2016 @ 12:15PM 8.080 views
Ukraine Claims Hackers CausedChristmas Power OutageJust before Christmas, power went out acrosswestern Ukraine. Soon after, the energy ministryconfirmed it was exploring claims a cyber attackdisrupted local energy providerPrykarpattyaoblenergo, causing blackouts acrossthe IvanoFrankivsk region on 23 December. TheSBU state intelligence service said Russianattempts to disrupt the country’s power grid hadbeen deflected, but did not comment on anyspecific attack.
The details were patchy. But today, the ComputerEmergency Response Team of Ukraine – CERTUA – told FORBES the outages were caused by
Thomas FoxBrewster Forbes Staff
I cover crime, privacy and security in digital and physical forms.
an attack. National CERTs are in charge ofcoordinating responses to and investigations intocyber attacks. Eugene Bryksin, a member of thegovernment organization, said it was workingwith Prykarpattyaoblenergo on the investigationbut could provide no information other than toconfirm the accuracy of the reports.
If his information was accurate, the attack is arare public example of hackers taking out criticalinfrastructure and another sign of the risingdigitization of warfare. NeitherPrykarpattyaoblenergo nor the SBU could becontacted at the time of publication.
Bryksin also said research by somewhat scepticalUSbased researchers looking for digital clueswas accurate, in particular the attribution to agroup of hackers using the socalled“BlackEnergy” malware.
Robert M Lee, 27yearold cofounder ofconsultancy Dragos Security and former cyberwarfare operations officer for the US Air Force,told FORBES he had obtained a piece of malwarethat had found its way onto thePrykarpattyaoblenergo network. On initialanalysis, it did not appear to contain functions
that would have switched off power, but wasdesigned to wipe systems to render postattackforensics ineffective. Nevertheless, he believedthe evidence indicated hackers really wereresponsible for taking out the power in IvanoFrankivsk.
“When this first came out, I was extremelysceptical,” Lee said. “But with a sample comingforward and that sample being new and unique…there’s a really high chance it was directlyinvolved in the attacks.”
The malware was soon linked to a knownhacker tool BlackEnergy – that had previouslybeen used in attempts to breach energy providersthe world over, including US organizations.Security firm ESET said the hackers had usedbackdoors to spread the KillDisk wiper malwareacross energy companies in the Ukraine, not justPrykarpattyaoblenergo. The initial point ofinfection with the BlackEnergy malware occurredafter employees opened Microsoft Office filescontaining malicious macros – single computerinstructions that define sets of instructions forparticular tasks.
A file surreptitiously serving the BlackEnergy malware. Ukraine sayshackers using BlackEnergy breached an energy company to shut offpower in the west of the country.
ESET researcher Anton Cherepanov also foundthe KillDisk variant detected in various electricitycompanies in the region contained “functionalityspecifically intended to sabotage industrialsystems”. It looked to kill two “nonstandardprocesses” – executable files called ‘komut.exe’and ‘sec_service.exe’. Whilst the antivirus firm’sresearchers couldn’t determine what komut.exedid, it said the second process name may belongto software called ASEM Ubiquity, a platformoften used in industrial control systems (ICS).
Where that latter process was found, the wiperwould terminate it and overwrite the executablewith random data.
Cherepanov said his employer could “assumewith a fairly high amount of certainty” that arange of tools had been used by the BlackEnergygroup to cause the power outage in the IvanoFrankivsk region.
Jake Williams, principal consultant at whitehathacker firm Rendition Infosec, also analyzed themalware from the Prykarpattyaoblenergonetwork, noting it sought to wipe a variety offiles. He confirmed the sec_service file wastargeted. Once the malware had infected aWindows system, it would force a reboot. “Inmost cases that machine is not going to comeback up,” Williams said.
Beware BlackEnergy
The BlackEnergy malware, which has been usedin attacks dating back to 2007, was originallythought to be focused on cyber espionage. But in2014, hackers updated the toolset to include
malicious code targeting SCADA ICS, knowntobevulnerable kit used to control power stationsand other critical infrastructure.
A link between BlackEnergy and the KillDiskmalware was first reported by CERTUA inNovember when news publications were attackedaround the 2015 Ukrainian local elections. Thisadded to suspicions Russiansponsored hackerswere involved in the group.
Intelligence provider iSight Partners said itbelieves a hacker collective called SandwormTeam has been using BlackEnergy over the lasttwo years. The company said today it believed thegroup was Russian and that it targeted US andEuropean industrial control systems from 2014onwards. “Renewed BlackEnergy activity, whichwe believe is Sandworm Team, was uncoveredthroughout 2015 in Ukraine affectinggovernment, telecommunications, and energysector organizations in the country,” it wrote in astatement to media.
But Russian individuals and businesses have alsobeen targeted by hackers using the BlackEnergymalware, according to November 2014 researchfrom Russian firm Kaspersky. It said the list of
victims is long and diverse, with power facilities,government bodies, emergency services andacademics also targeted, across a wide range ofcountries. Kaspersky also suggested BlackEnergyhad been used for criminal enterprises but sometime in 2014 was used in attacks that appeared tohave government backing.
Tit for tat attacks?
During the last two weeks of December, powerwas also taken out in Crimea, a region recentlyannexed by Russia in 2014. One attack appearedto be the result of physical disruption. Ukrainewas accused of carrying out the hit. Leewondered whether the digital hit on Ukrainecould have been a response to the earliersabotage.
Causing explosions is an obvious if blunt way tocause disruption, but attribution is fairly obvious.When it comes to digital attacks, however, tryingto conclude who was responsible is far trickier.This is one of many reasons nation states areheavily investing in offensive cyber resources:when they strike they can easily deny culpability.
Meanwhile, cheap attack tools and widespreadinsecurity across critical infrastructuretechnology make a devastating attack on energycompanies feasible. Recent reports that anAmerican dam was targeted by Iranians showedno country can be complacent.
Shodan’s ICS Radar, highlighting a vast number of industrial controlsystems in the US accessible over the Internet. Some may be vulnerableto foreign cyber attacks.
“[The Ukraine attack] is fairly significant,”Williams added, who described general industrialcontrol system security as a “train wreck as far assecurity goes”. “The odds are good that you couldpop into ICS networks… and replicate this kind ofattack.
“I do think this is a wake up call for a lot ofenergy companies and not just energycompanies.” There is certainly a growing list ofcompanies severely damaged by destructiveattacks, from Sony Pictures to Saudi Aramco tothe Sands Casino. All industries are vulnerable.
Tips and comments are welcome at TFox[email protected] [email protected] for PGP mail.Get me on Twitter @iblametom [email protected]chilli.net for Jabberencrypted chat.
RECOMMENDED BY FORBES
Want Some Nuclear Power Plant 'ZeroDay'Vulnerabilities? Yours For Just $...
How The Internet Of Things Will Turn YourLiving Room Into The Future Cyber...
Massive Security Breach At Sony Here's WhatYou Need To Know
What We Should Learn From The Attack OnPacific Gas And Electric's Transformer...
The Richest Person In Every State
This article is available online at: http://onforb.es/1MPmmZF 2016 Forbes.com LLC™ All Rights Reserved
$7.8 Million Fee For Lawyers, 7Cent Check ForOne Lucky Class Member
2016 30 Under 30: Retail & ECommerce