Cyber Attacks on SCADA Systems

Listen to this article

When it comes to cybersecurity, attacks on SCADA (Supervisory Control and Data Acquisition) and ICS (Industrial Control Systems) may not readily come to mind. In this article I want to look at two of the most important attacks on SCADA systems in history to stress that the scope of cybersecurity, or of the cyber threat, is in fact much wider than thought.

The first of these is Stuxnet. Perhaps one of the most important SCADA/ICS attacks in history was the attack on the programmable logic controllers (PLC – Programmable Logic Controller) used in Iran’s nuclear enrichment facilities at Natanz. The attack used the computer worm known as Stuxnet, whose main target was Iran’s nuclear facilities and which has since kept reappearing in updated forms and spreading to other industrial and energy facilities.

With this attack Stuxnet took control of the machinery running the centrifuges that separate the uranium-235 isotope, which can produce a bomb effect, from the uranium-238 isotope. Subtly and imperceptibly, it desynchronised the spinning of about a thousand of these centrifuges, causing them to stop, collide and destroy themselves. According to experts, this led to the temporary shutdown of the Natanz facility and delayed for years Iran’s acquisition of enough U-235 to possess a nuclear weapon.

Multi-part Stuxnet was a worm that infiltrated and spread through the Windows operating system via USB devices. After finding computers with Siemens PLCs installed on the network it had infiltrated, it updated its own code over the internet and began sending commands that would damage the electro-mechanical parts controlled by the computer. At the same time it sent false feedback to the main controllers so that those monitoring the damaged parts would not see these errors in the system until the parts destroyed themselves.

Another important SCADA attack is BlackEnergy 3 (BE3). As is known, in 2014 clashes broke out between Russia and Ukraine over the status of Crimea. Leaving the armed conflict side of the issue to the experts, let us examine a seemingly highly sophisticated attack carried out via ICS/SCADA.

Certain regions of Ukraine were plunged into darkness in 2015, and the malware BlackEnergy 3 was named as the cause. The first variant of BlackEnergy, BE1, was written as a criminal tool to create botnets used for DDoS attacks and began to be sold on the Russian cyber(crime) market in 2007.

The second variant, BE2, was rewritten in 2008, giving BE1 a protective layer, a kernel-mode rootkit and a modular architecture. (A rootkit is software used by cybercriminals to take control of a target computer or network.) BE3 is a more advanced variant of BE2, a piece of malware without a kernel-mode component.

The attackers used BE3 as a weapon and CVE-2014-4114 in Microsoft Office 2013 as the vulnerability. Microsoft designated the same vulnerability MS14-060. Describing this vulnerability, Microsoft says: “An attacker who successfully exploited this vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.” In IT terms, this means that the system’s administrator is no longer its legitimate administrator.

This attack, which targeted Ukraine’s electricity distribution centres, left around 225,000 Ukrainian citizens without electricity. According to claims about the attack, in the spring of 2015 the attackers sent malicious emails to the IT department managers of various electricity distribution companies in Ukraine through spear phishing (baiting employees of a particular department of an organisation with a lure, as in fishing). When employees tried to open the attachments in these emails, they received the warning “Enable macros to open the document” on their screens. Employees enabling the macros allowed BE3 to infect their computers and created a backdoor on the computers for the attackers. This meant the attacker could now connect to the infected computers whenever he wished. Although the attackers did not get what they wanted at first, by carrying out reconnaissance in the system they eventually seized the user accounts through which network accounts were managed (Windows Domain Controller).

After seizing this, they obtained the employees’ user credentials, which were the VPN credentials system staff used to manage the SCADA network remotely. The attackers were so clever and had thought of everything that they even launched a DDoS attack on customer services to prevent customers from calling the centre and complaining about the power cut.

We do not know whether any sanctions were imposed on the perpetrators of the two incidents mentioned above, but both caused serious problems in the countries where they occurred.