Stuxnet Attack Exposes Inherent Problems In Power Grid Security

Worm sheds light on ongoing targeted attacks against critical infrastructure, and Iranian news reports infections among nuclear power plants employee machines

Second installment in a two-part series on the Stuxnet attacks
While the Stuxnet worm attack has raised the bar for targeted attacks on the critical infrastructure, its not the first time the power grid has been in the bulls eye. Attacks against these systems are actually quite common -- its just that they are mostly kept under wraps and rarely face public scrutiny like Stuxnet has.
Nearly 60 percent of critical infrastructure providers worldwide, including oil and gas, electric, and telecommunications, say they have been targeted by representatives of foreign governments, according to
a study published earlier this year by The Center for Strategic and International Studies and commissioned by McAfee
. More than half of the respondents had experienced a targeted, stealthy attack akin to the Aurora attacks that hit Google, Adobe, and nearly 30 other companies earlier this year. In addition, nearly 90 percent of the respondents said their networks had been infected with malware, and more than 70 percent had been hit with low-level DDoS attacks and vandalism, insider threats, leakage of sensitive data, and phishing or pharming.
As reported last week,
Stuxnet has shed light on just how vulnerable their control systems really are
, and as the first known malware attack to target power plant and factory floor systems, it has been a wake-up call for the potential damage that could be inflicted on a power plant and the potential consequences to the physical world. Though no one knows for sure who created and launched it (speculation has pointed to nation-state sponsorship) or what the endgame really was, the concentration of infections has mostly been in Iran and India. Nearly 60 percent of Stuxnet infections were located in Iran, according to Symantec.
Speculation that the worm was specifically gunning for Irans nuclear power plant gained a bit more traction in the past couple of days: Irans official news agency reported over the weekend that Stuxnet had infected employee machines at the plant, according to
an AP report
. And some 30,000 IP addresses had been across Iran, according to other reports.
A German security researcher has
said the attack was likely aimed at the Iranian nuclear plant
. The IRNA news agency said the head of the Bushehr nuclear plant said the malware didnt damage any major systems of the plant.
But its just as likely the attackers were casting a wider net and not just targeting the Iranian plant, researchers say. I think they were targeting multiple similar systems, says Liam O. Murchu, manager of operations for Symantec Security Response, which has performed in-depth analysis of the Stuxnet malware.
Siemens, whose
SIMATIC WinCC and PCS 7 programs are what Stuxnet
searches for and tries to alter, said in an update to its security advisory on Stuxnet that the malware is targeting a specific process or a plant and not a particular brand or process technology and not the majority of industrial applications.
The worm was pinpointed in about 15 plants around the globe, according to Siemens, and no actual operations were affected.
PLCs and control systems had been considered relatively insulated from the outside world and attack because they arent typically Internet-connected. But Stuxnet drove home the worst-kept secret that these systems still are connected to Windows or other machines that can get infected -- in this case, by a USB stick -- and therefore arent as protected as they had seemed.
It draws attention to the necessity to understand whats connected to what, what power systems supply that nuclear facility, and whats connected to it, says Phyllis Schneck, vice president and director of threat intelligence for the Americas at McAfee. This is an example of a very targeted attack. Operation Aurora showed us a lot as the first attack of that level of sophistication to the private sector. We are seeing more and more carefully crafted targeted attacks.
The attackers likely didnt mean for it to spread so widely and go so public. But any time you unleash malware, its tough to control, notes Dave Marcus, research and communications director for McAfee Labs.
So what does this mean for SCADA and process control systems? That traditional defense-in-depth approaches of firewalls and IDS systems wont catch these application-level attacks, says Eddie Schwartz, CSO for NetWitness, a founding member of the Energy Sec interest group, where power companies swap threat information. Theres no doubt SCADA companies had a rude awakening, Schwartz says.
Power companies and organizations that run these process control systems face challenges securing this traditionally proprietary technology. Many of these products have been known to carry vulnerabilities for years, and typical security tools cant drill down into this often-closed software, Schwartz says. If they are hit with malware, there needs to be a way to catch it, he says.
A lot of the industry unfortunately is still based on old-style serial interfaces for communication, he says. The SCADA and power industry will have to follow what retail did with its old POS systems when PCI hit and they needed security. They suddenly had to implement security ... and some of the interfaces were serial or other types of things that complicated matters, Schwartz says.
Eric Knapp, director of critical infrastructure markets for NitroSecurity, concurs that access to PLCs is needed to secure them properly. Some utilities are better than others, but there are still a lot of vulnerable control systems out there, Knapp says, pointing to
research on SCADA vulnerabilities
that was presented this summer at Black Hat USA by Red Tiger Security. The average age of vulnerability was 311 days for a control system. There were some vulnerabilities over 3 years old.
Meanwhile, downtime from an attack costs critical infrastructure organizations more than $6 million a day, and up to $8 million a day for the oil and gas industries, according to The Center for Strategic and International Studies and McAfee report. Some two-fifths of these organizations said in the report that they expected a major attack in their industry within the next year.
Combating attacks like Stuxnet requires collaboration among victim organizations, the security community, and process control vendors. Its important to emphasize that the Stuxnet response was a community effort. A variety of public and private entities worked together to understand and assess this issue, and then provide improved protections, said Dave Forstrom, director of Microsoft Trustworthy Computing in a statement. As the threat landscape evolves, we strongly believe that collaboration is the key to the best possible computer security. After all, in the end we and our competitors share a common goal: protecting customers and maintaining the safety of the computing ecosystem.
But while Stuxnet is a major turning point in critical infrastructure security, its not a foreshadowing of massive power grid destruction, security experts say. The power grid, like the Internet infrastructure, is highly resilient and difficult to take down en masse, says McAfees Marcus. If the power grid was [so] fragile, it wouldnt be up now. It would be going up and down all the time, Marcus says. Does Stuxnet expose weaknesses in it? Absolutely. Is it a wake-up call? Youre darn right.
Have a comment on this story? Please click Discuss below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Stuxnet Attack Exposes Inherent Problems In Power Grid Security