SCADA Security Incidents and Critical Infrastructure Insecurities

A decent article on the topic of the most hyped cyberterrorism threat of them all - direct attack on the critical infrastrcture of a country by attacking the SCADA devices -- despite increased connectivity and integration with third-party networks, for the time being misconfigurations and failures in maintainance make their impact. What is critical infrastructure anyway? In the days when it used to be a closed network, that is one isolated from the Internet and performance-obsessed top management, dealing with threats was benefiting from the controlled environment compared to the open Internet. Converging both infrastructures to maximize performance, project demand and supply, thus achieving cost-cutting and profits results in the basic truth that poluting the Internet would inevitably influence the what used to be closed critical infrastructure one -- and it already happened on several occasions. Incident in Australia :

"That was the case in Australia in April 2000. Vitek Boden, a former contractor, took control of the SCADA system controlling the sewage and water treatment system at Queensland's Maroochy Shire. Using a wireless connection and a stolen computer, Boden released millions of gallons of raw sewage and sludge into creeks, parks and a nearby hotel. He later went to jail for two years. Not surprisingly, U.S. companies are hesitant to talk about the security of their SCADA networks for fear they may give clues to hackers. But security consultants say problems with them are widespread. Allor's company, for instance, regularly does audits of SCADA systems at major installations such as power plants, oil refineries and water treatment systems.

Almost invariably, Allor said, the companies claim their SCADA systems are secure and not connected to the Internet. And almost invariably, he said, ISS consultants find a wireless connection that company officials didn't know about or other open doors for hackers. Realizing the growing threat, the federal government two years ago directed its Idaho National Laboratory to focus on SCADA security. The lab created the nation's first "test bed" for SCADA networks and began offering voluntary audits for companies."

And more security incidents courtesy of Filip Maertens - Cyber threats to critical infrastructures slides :

1992 -- Chevron -- Emergency system was sabotaged by disgruntled employee in over 22 states
1997 -- Worchester Airport -- External hacker shut down the air and ground traffic communication system for six hours
1998 -- Gazprom -- Foreign hackers seize control of the main EU gas pipelines using trojan horse attacks
2000 -- Queensland, Australia -- Disgruntled employee hacks into sewage system and releases over a million liters of raw sewage into the coastal waters
2002 -- Venezuela Port -- Hackers disable PLC components during a national unrest and general workers strike, disabled the country's main port
2003 -- U.S East Coast blackout -- A worm did not cause the blackout, yet the Blaster worm did significantly infect all systems that were related to the large scale power blackout
2003 -- Ohio Davis-Besse Nuclear Plant -- Plant safery monitoring system was shut down by the Slammer worm for over five hours
2003 -- Israel Electric Corporation -- Iran originating cyber attacks penetrate IEC, but fail to shut down the power grid using DoS attacks
2005 -- Daimler Chrysler -- 13 U.S manufacturing plants were shut down due to multiple internet worm infections (Zotob, RBot, IRCBot)
2005 -- International Energy Company -- Malware infected HMI system disabled the emergency stop of equipment under heavy weather conditions
2006 -- Middle East Sea Port -- Intrusion test gone wrong. ARP spoofing attacks shut down port signaling system
2006 -- International Petrochemical Company -- Extremist propaganda was found together with text files containing usernames & passwords of control systems

Go through the results of the Cyberstorm cyber exercise, and a previous post on The Biggest Military Hacks of All Time to grasp the big picture of what cyberterrorism and asymmetric warfare is all about.

Terrorist Letters and Internet Intentions

A juicy recently de-classified letter to Zarqawi courtesy of the Combating Terrorism Center, reveals possible intentions for Internet based communications :

"We advise you to maintain reliable and quick contact, with all the power you can muster. I am ready to communicate via the Internet or any other means, so send me your men to ask for me on the chat forum of Ana al-Muslim, or others. The password between us is that thing that you brought to me a long time ago from Herat. Then, after that, we would agree with them about e-mails, or you should instruct your men who are in the country that I live in to develop communications with us. We are ready to write to you and to consult with you regarding opinions anytime directly. “By the time, Surely man is at a loss, Except for those who believe and do good, and exhort one another to Truth, and exhort one another to patience."

Rather primitive suggestion compared to the alternatives, it sounds more of a loyal jihadist trying to demonstrate his determination of making an impact. The other day I came across to an article mentioning the possibility of "suicidal hackers", that is hackers who doesn't care whether they'll be caught or not in a possible information warfare scenario -- chinese hackers have been utilizing the power of masses, thus disinforming on the actual sophistication of the attack and directing the traceback efforts to script kiddies.

However, in this case that's an example of a suicidal jihadist.

Filtering "Good Girls" and IM Threats

Respecting your kids' right to privacy while wanting to ensure you're aware of the type of people they IM with? Consider a recently launched initiative, IMSafer aims to filter, not spy on kids :

"Keeping children safe from predatory adults in online communication is a service in high demand, but in order for children to participate the parental control needs to be kept to a minimum. IMSafer is a service that launched today and promises to filter IM communication for conversation deemed potentially predatory. The company says it worked with law enforcement specialists to develop its filtering rules and some of them are quite interesting - the phrase “you’re a good girl” is believed to be common language for building a dominance/submission based relationship, for example. Only questionable excerpts from IM conversations will be shown to parents; the company hopes that this relative privacy will help buy-in from kids."

Yet, this is a great example of marginal thinking when it comes to detecting potential child abuse activities with respect to little princess's -- why not prince? -- right to digital privacy. Whereas in the spirit of Web 2.0, the concept is primarily driven by the collective wisdom of parents participating and shaping the service's database and increasing interactions, IMSafer has already predefined categories of alerts :

"1. Someone looking to make direct contact (i.e. coming to your house)
2. Someone looking to make indirect contact (i.e. calling a phone)
3. Personal information (i.e. phone numbers)
4. Obscene language
5. Specific and sexual references to body parts
6. Specific references to sexual acts
7. Anything related to pedophilia"

Issues to keep in mind :
- the differently perceived dangerous or offensive conversation by parents
- the presumption that the "predator" would be using the same username next time, thus establishing long-lasting reputation
- how kids feeling in the middle of a silent war with their parents could simply IM from another location, one without the software installed excluding the possibilities of bypassing it with nerdy talk or vulnerabilities and hacks appearing on-the-fly
- monitors IM only, thus email, IRC, and forums remain an option for further communication

Don't emphasize on spying, not even filtering, but on educating your kids, thus gaining their participation in the process of building awareness on what's are potentially dangerous IM activities. From another perspective, do bored or adventurous kids spend time chatting with strangers? I think boringness, loneliness, the lack of strong, even developed communications with their folks is the root of the problem. And yes, predators acting as online stalkers, thus improving their chances of utilizing a long-lasting conversation.

Related posts:
What's the potential of the IM security market? Symantec thinks big
"IM me" a strike order