Critical Infrastructure : Crashing The System

IN THE HIGH desert some 50 miles west of Idaho Falls, the terrain is so rugged that the vehicle in which your correspondent was touring the facilities at Idaho National Laboratory (INL) ended up with two shredded tyres. Originally set up in the 1940s to test naval artillery, the high-security government lab now worries about weapons of a different kind. Some of its elite engineers help protect power grids, telecoms networks and other critical infrastructure in America against cyber-attacks and other threats.

The lab boasts its own 61-mile (98km) electrical grid and seven substations. It also has a wireless network and an explosives test bed. These can all be used by government agencies and businesses to run experiments that would be hard or impossible to conduct in an operational setting. “There are not many places in the world where you can crash a power system without incident,” says Ron Fisher, who oversees the Department of Homeland Security’s programme office at the lab.
The tour covers the site of a 2006 experiment that subsequently got a lot of attention. Known as the Aurora test, it demonstrated how it was possible to launch a cyber-attack on a big diesel generator by exploiting a weakness in a supervisory control and data acquisition (SCADA) system. Such systems are used to monitor and control physical equipment in everything from power stations to water-treatment plants. In a video of the attack on YouTube, bits can be seen flying off the generator, followed by black smoke.

Teams from the INL and other engineers have since been advising utilities on how to secure SCADA systems. Many of these were designed to work in obscurity on closed networks, so have only lightweight security defences. But utilities and other companies have been hooking them up to the web in order to improve efficiency. This has made them visible to search engines such as SHODAN, which trawls the internet looking for devices that have been connected to it. SHODAN was designed for security researchers, but a malicious hacker could use it to find a target.

The worry is that a terrorist may break into a control system and use it to bring down a power grid or damage an oil pipeline. This is much harder to do than it sounds, which explains why so far America has seen no power outages triggered by a cyber-attack. Squirrels and fallen branches have done more damage.

Nevertheless, the case of Stuxnet shows what is possible. In 2010 the malicious code was used to attack the system that controlled centrifuges for enriching uranium at Iran’s nuclear facility in Natanz, causing them to spin out of control. To pull this off, however, the masterminds behind Stuxnet had to find a way to smuggle the code into the facility, possibly on a USB stick, because the system had been kept isolated from the internet.

As more control systems are connected to the web, more vulnerabilities will inevitably appear. Already security researchers are discovering flaws in things such as communications protocols that govern the flow of data between utilities’ SCADA systems and the remote substations they control. Hence talk about defence-in-depth strategies, which ensure that vital areas are covered by a number of back-up systems. Multiple bulwarks greatly increase the cost of security, but that may be a price the companies have to pay.

http://www.economist.com/