Damaging cyber attacks against the U.S. energy infrastructure do not currently pose a significant threat according to an intelligence assessment released by the Department of Homeland Security and Industrial Control Systems Computer Emergency Response Team (ICS-CERT) in January. While cyber actors backed by a number of nation-states are actively “targeting US energy sector enterprise networks,” these activities are focused primarily on supporting cyber espionage activities to acquire and maintain “persistent access to facilitate the introduction of malware” in the event of “hostilities with the United States.”
The restricted DHS assessment titled “Damaging Cyber Attacks Possible but Not Likely Against the US Energy Sector” was obtained by Public Intelligence and reveals that at least seventeen intrusions against the U.S. energy sector were traced back to APT actors in FY 2014. The attacks never resulted in damage or disruption, but were instead focused on “data theft from enterprise networks” and “accessing and maintaining presence on ICS” networks and systems. One example cited in the assessment is a piece of malware called Havex that was “likely developed by Russian state-sponsored cyber actors.” The existence of the malware was first disclosed in a June 2014 blog post by Finnish security firm F-Secure which described how the remote access tool (RAT) was being used as part of an industrial espionage campaign. DHS states that this campaign dates back to 2011 and that while the “main function is to gather information,” Havex can also run “specialized plug-ins for additional capabilities.”
The assessment also mentions an attack on the Ukrainian energy sector in December 2015 that resulted in at least 80,000 customers losing power for up to six hours. At the time the assessment was written, ICS-CERT stated that they were “unable to confirm” the event was triggered by cyber means, but that a sample of the malware provided by the Ukranian Government had the capability to “enable remote access and delete computer content, including system drives.” While DHS does not attribute the attack to any specific cyber actor, the assessment states that the attack is “consistent with our understanding of Moscow’s capability and intent, including observations of cyber operations during regional tensions.”
A month after the DHS assessment was published, ICS-CERT released an alert describing the attack in much greater detail and relaying the findings of a team that included representatives of the U.S. Computer Emergency Readiness Team (US-CERT), Department of Energy, FBI and North American Electric Reliability Corporation. The alert increased the number of those affected by the attack to more than 225,000 customers, noting that the attack was “reportedly synchronized and coordinated, probably following extensive reconnaissance of the victim networks.” The attackers reportedly “acquired legitimate credentials and leveraged valid remote access pathways” to cause 50 regional substations to experience “malicious remote operation of their breakers conducted by multiple external humans.”
ICS-CERT also released a restricted version of the alert marked For Official Use Only that included non-public details and analysis of the vulnerabilities exposed by the attack. An updated version of the restricted alert from March was also obtained by Public Intelligence and states that “critical infrastructure [industrial control system or ICS] networks, across multiple sectors, are vulnerable to similar attacks.” ICS-CERT argues that the “incident highlights the urgent need for critical infrastructure owners and operators across all sectors to implement enhanced cyber measures that reduce risks” that could result from the use of a number of different techniques that were employed by the attackers, including:
• Theft of legitimate user credentials to enable access masquerading as approved users,
• Leveraging legitimate remote access pathways (VPNs),
• The remote operation of human-machine interface (HMI) via company installed remote access software (such as RDP, TeamViewer or rlogin)
• The use of destructive malware such as KillDisk to disable industrial control systems (ICSs) and corporate network systems
• Firmware overwrites that disable/destroy field equipment
• Unauthorized scheduled disconnects of uninterruptable power supplies (UPS) to devices to deny their availability
• The delivery of malware via spear-phishing emails and the use of malicious Microsoft Office attachments
• Use of Telephone Denial of Service (TDoS) to disrupt operations and restoration.
During the attacks, “remote human operators” accessed the workstations of dispatchers at the facilities using legitimately installed tools for remote access. They used this access to trip the breakers, change the passwords for key systems, corrupt firmware of serial-to-ethernet converters used for substation communication and leverage backup battery systems to trigger shutdowns of connected servers and devices. In one instance, the attackers used an uninterruptible power supply (UPS) to target an internal telecommunications server which cut off “all internal communications with regional offices and distribution substations.”
Despite the risks demonstrated in the Ukrainian attack, the DHS assessment from January tries to downplay the threat posed by state actors, noting that 63 percent of malicious cyber activity in FY 2014 was “unattributed, low-level activity” related to cybercrime using methods such as ransomware and denial-of-service attacks. The assessment’s authors also include a section criticizing the media’s over-hyping of cyber attacks and cyber warfare as leading to “misperceptions about the cyber threat to the US energy sector.” The term “cyber attack” is often used by the media and private sector to refer to incidents and activities that are not necessarily intended to “cause denial, disruption, destruction, or other negative effects” which would better be described as “cyber espionage, and even low-level, untargeted incidents of cybercrime.” The assessment even speculates that overuse of the term could lead to “alarm fatigue” which could lead to less reporting of incidents and longer response times.
Dhs Office, Dhs Michigan, Dhs Phone Number, Dhs Link, Dhs Live, Dhs Near Me, Dhs To Usd, Dhs Office Locator, Dhs Skokie, Dhs Child Care, Dhs Application, Dhs Adrian Mi, Dhs Assistance, Dhs Authorization, Dhs Application Online, Dhs Address, Dhs Apply Online, Dhs Allegan Mi, Dhs Ann Arbor, Dhs Apply, Dhs Battle Creek Mi, Dhs Bay City Mi, Dhs Billing, Dhs Building, Dhs Bridge Card, Dhs Benefits, Dhs Battle Creek Michigan, Dhs Big Rapids, Dhs Baldwin Mi, Dhs Background Check Michigan, Dhs Child Care, Dhs Clearance, Dhs Champs, Dhs Child Care Provider, Dhs Caseworker Lookup, Dhs Clio Rd, Dhs Caro Mi, Dhs Clio Road, Dhs Customer Service, Dhs Conner, Dhs Detroit, Dhs Daycare, Dhs Dearborn, Dhs Diecast, Dhs Directory, Dhs Department, Dhs Daycare Help, Dhs Disability, Dhs Dental, Dhs Definition, Dhs Emergency, Mdhhs Ems, Dhs Employment Verification Form, Mdhhs Email, Dhs Emergency Services, Dhs Email Address, Mdhhs Employee Directory, Dhs Equipment, Dhs Employment, Dhs Ebt, Dhs Flint Mi, Dhs Food Stamps, Dhs Flint, Dhs Forms, Dhs Fax Number, Dhs Fast, Dhs Food Assistance, Dhs Form 3200, Dhs Flint Michigan Clio Road, Dhs Form 3503, Dhs Greydale, Dhs Grand Rapids, Dhs Grand River Warren, Dhs Genesee County, Dhs Gladwin Mi, Dhs Greenfield, Dhs Gratiot 7 Mile, Dhs Gr Mi, Dhs Greenfield Joy, Dhs Gaylord Mi, Dhs Hours, Dhs Howell Mi, Dhs Holland Mi, Dhs Hillsdale Mi, Dhs Hartford Mi, Dhs Harrison Mi, Dhs Holland, Dhs Hastings Mi, Dhs Hart Mi, Dhs Home Health Care, Dhs Inkster, Dhs Ib Bio, Dhs In Pontiac Mi, Dhs Ibilling, Dhs In Lansing, Dhs In Detroit, Dhs In Redford Mi, Dhs In Michigan, Dhs In Taylor, Dhs Illinois, Dhs Jobs, Dhs Jackson Mi, Dhs Jobs In Michigan, Dhs Joy Road And Greenfield, Dhs Joy Rd, Dhs Joy, Dhs Job Opportunities, Dhs Jobs Mi, Dhs Job Openings, Dhs Jay Ok, Dhs Kalamazoo Mi, Dhs Kent County, Dhs Kalkaska, Dhs Kelly, Dhs Kalamazoo Login, Dhs Key Club, Dhs Klamath Falls Oregon, Dhs Knoxville, Dhs Kansas, Dhs Kentucky, Dhs Login, Dhs Lansing Mi, Dhs Lapeer Mi, Dhs Lansing Michigan, Dhs Locations, Dhs Lappin, Dhs Live, Dhs Logo, Dhs Lappin And Gratiot, Dhs Lansing Fax Number, Dhs Michigan, Dhs Management, Dhs Monroe Mi, Dhs Macomb, Dhs Medicaid, Dhs Muskegon Mi, Dhs Midland Mi, Dhs Main Office, Dhs Mt Clemens, Dhs Monroe Michigan, Dhs Near Me, Dhs Number, Dhs Number Lansing Mi, Dhs Novi Mi, Dhs Number On Lappin, Dhs News, Dhs New Hire Form, Dhs Novi, Dhs Near Me Hours, Dhs Nhs, Dhs Office, Dhs Oakland County, Dhs Office Detroit, Dhs Oregon, Dhs Okc, Dhs Online, Dhs Office Pontiac Mi, Dhs Office On Conners, Dhs Office On Lappin, Dhs Office On Plymouth, Dhs Phone Number, Dhs Pontiac, Dhs Port Huron Mi, Dhs Port Huron Michigan, Dhs Provider Login, Dhs Provider Payment Schedule 2017, Dhs Payment Dates 2017, Dhs Plymouth, Dhs Provider, Dhs Police, Dhs Questions, Dhs Questionnaire, Dhs Quincy Illinois, Dhs Quote, Dhs Questions And Answers, Dhs Qmb Program, Dhs Qhsr, Dhs Questionnaire Pdf, Dhs Quarterly Reports, Dhs Quincy, Dhs Rent Assistance, Dhs Redford, Dhs Royal Oak, Dhs Redetermination Application Michigan, Dhs Rochester Hills Mi, Dhs Ri, Dhs Reed City Mi, Dhs Royal Oak Mi, Dhs Rogers City Mi, Dhs Redetermination Form Medical, Dhs Sign In, Dhs Shampoo, Dhs Sandusky Mi, Dhs Ser, Dhs Saginaw Mi, Dhs Stanton Mi, Dhs Secretary, Dhs Services, Dhs Sterling Heights, Dhs Southfield Mi, Dhs Taylor Mi, Dhs To Usd, Mdhhs Training, Mdhhs Taylor, Dhs Traverse City, Dhs Twitter, Dhs Trip, Mdhhs Tb, Mdhhs Twitter, Mdhhs Third Party Liability, Dhs Union St, Dhs Unemployment, Dhs Unearned Income Notice, Dhs Uscis, Dhs Usa, Dhs Uscis Login, Dhs Uniform, Dhs Utah, Dhs Utility Assistance Michigan, Dhs Uscis Genealogy, Dhs Van Buren, Dhs Verification Of Assets, Dhs Van Dyke, Dhs Verification In Process, Dhs Vinelink, Dhs Verification Of Employment, Dhs Vine, Dhs Voice, Dhs Virginia, Dhs Va 20598, Dhs Website, Dhs Warren, Dhs Washtenaw County, Dhs Wayne County, Dhs Worker, Dhs Warren And Conner, Dhs Warren And Grand River, Dhs Wayne County Mi, Dhs Wayne County Number, Dhs Wic, Dhs X6006, Dhs Xc, Dhs X4002, Dhs X6002, Dhs X3002, Dhs X6007, Dhs X6006 Review, Dhs X Ray, Dhs X3002 Review, Dhs X5002, Dhs Ypsilanti Mi Hours, Dhs Ypsilanti Michigan, Dhs Ypsi, Dhs Ypsilanti, Dhs Ypsilanti Mi, Dhs Ypsilanti Hours, Dhs Yearbook, Dhs Yellville Ar, Dhs Youtube, Dhs Ypsilanti Mi Phone Number, Dhs Zinc Shampoo, Dhs Zinc Shampoo Walgreens, Dhs Zinc, Dhs Zinc Shampoo 16 Oz, Dhs Zinc Shampoo Target, Dhs Zinc Shampoo Cvs, Dhs Zinc Shampoo Review, Dhs Zip Code, Dhs Zambia, Dhs Zinc Body Wash, United States Map, United States Post Office, United States Of America, United States Population, United States Flag, United States Time Zones, United States Constitution, United States Allies, United States Of Tara, United States Air Force, United States Allies, United States Air Force, United States Army, United States Air Force Academy, United States Armed Forces, United States Attorney General, United States Airlines, United States Air Force Museum, United States At War, United States And Capitals, United States Budget, United States Blank Map, United States Botanic Garden, United States Bill Of Rights, United States Birth Rate, United States Border Patrol, United States Bowling Congress, United States Bureau Of Labor Statistics, United States Bankruptcy Court Forms, United States Breaking News, United States Constitution, United States Country Code, United States Census Bureau, United States Code, United States Coast Guard, United States Capitals, United States Capitol, United States Congress, United States Currency, United States Court Of Appeals For The Sixth Circuit, United States Debt, United States District Court, United States Demographics, United States Department Of Labor, United States Department Of Education, United States Department Of Agriculture, United States Department Of State, United States Draft, United States Department Of Justice, United States Department Of Treasury, United States Economy, United States Embassy, United States Environmental Protection Agency, United States Eastern District Court, United States Exports, United States Education, United States Equestrian Federation, United States Enemies, United States Economic System, United States Education Ranking, United States Flag, United States Flag Store, United States Foreign Policy, United States Flag Code, United States Facts, United States Forest Service, United States Fire Insurance Company, United States Federal Government, United States Federal Court, United States Flower, United States Gdp, United States Government, United States Gdp Per Capita, United States Government Democracy In Action, United States Grand Prix, United States Gdp 2016, United States Government Type, United States Geological Survey, United States Gross Domestic Product, United States Geography, United States Holocaust Memorial Museum, United States History, United States House Of Representatives, United States History Beginnings To 1914, United States Holidays, United States Healthcare System, United States History Reconstruction To The Present, United States History Book, United States History Textbook, United States Holidays 2017, United States In Spanish, United States Immigration, United States In French, United States Institute Of Peace, United States Infant Mortality Rate, United States Inflation Rate, United States International Code, United States Independence, United States Imperialism, United States Immigration Policy, United States Justice Department, United States Jobs, United States Justice System, United States Judicial Branch, United States Judicial System, United States Justice Foundation, United States Japan, United States Jaycees, United States Jet Stream, United States Judo Association, United States Korea, United States Korean War, United States Kyoto Protocol, United States Korean War Memorial Coin, United States King, United States Kansas, United States Kingdom, United States Krav Maga Association, United States Karate Academy, United States Karate Alliance, United States Literacy Rate, United States List, United States Life Expectancy, United States Liberty Coins, United States Laws, United States Language, United States Landmarks, United States Liability Insurance Group, United States Literacy Rate 2016, United States License Plates, United States Map, United States Marine Corps, United States Military, United States Mint, United States Map Quiz, United States Military Academy, United States Money Reserve, United States Merchant Marine Academy, United States Minor Outlying Islands, United States Map Blank, United States Navy, United States Naval Academy, United States News, United States North Korea, United States National Parks, United States National Anthem, United States National Debt, United States National, United States Net Worth, United States National Flower, United States Of America, United States Of Tara, United States Of America Map, United States Of Detroit, United States Outline, United States Official Language, United States Of Whatever, United States Office Of Personnel Management, United States Of Mexico, United States Of Smash, United States Post Office, United States Population, United States Presidents, United States Passport, United States Post Office Jobs, United States Postal Service Tracking, United States Patent And Trademark Office, United States Post Office Change Of Address, United States Plastic Corp, United States Population 2016, United States Quiz, United States Quarters, United States Quotes, United States Quarter Map, United States Questions, United States Quidditch, United States Quizlet, United States Quality Of Life, United States Quiz Map, United States Quilt, United States Radar, United States Regions, United States Road Map, United States Russia, United States Religion, United States Regions Map, United States Representative, United States Rivers, United States Race Demographics, United States Reports, United States Steel, United States Supreme Court, United States Senate, United States States, United States Savings Bonds, United States Secretary Of State, United States Secret Service, United States Square Miles, United States Sports Academy, United States Service Dog Registry, United States Time Zones, United States Treasury, United States Territories, United States Treasury Check, United States Tax Brackets, United States Tax Court, United States Treasury Address, United States Treasury Check Verification, United States Tennis Association, United States Time, United States Unemployment Rate, United States University, United States Uniformed Services, United States Unclaimed Property, United States Unemployment, United States University Rankings, United States Unemployment Rate 2017, United States Uniformed Services Id, United States U20, United States Un Ambassador, United States V Nixon, United States V Lopez, United States Virgin Islands, United States V Windsor, United States V Virginia, United States Vice President, United States V Leon, United States Vs North Korea, United States V Jones, United States V Morrison, United States Weather Radar, United States Weather Map, United States War, United States Wiki, United States Ww2, United States World Baseball Classic, United States Ww1, United States War Crimes, United States World Cup, United States World Map, United States Xenophobia, United States X, United States X Factor Winners, United States Xtreme Wrestling, United States X Factor, United States X-country Snowmobile Racing, United States.xylem Applied Water, United States Country Code, United States Xbox Store, United States Zip Codes, United States Yahoo Mail Login, United States Youth Soccer, United States Youtube, United States Youth Conservation Corps, United States Youngest President, United States Youth Unemployment Rate, United States Yemen, United States Yearly Income, United States Youth Futsal, United States Yield Curve, United States Zip Code, United States Zip Code Map, United States Zip Code Finder, United States Zones, United States Zone Map, United States Zoos, United States Zika, United States Zip Code Lookup, United States Zip Codes List, United States Zika Map, Energy Definition, Energy Pyramid, Energy Balls, Energy Drinks, Energy Lights, Energy Ogre, Energy Star, Energy Transfer Partners, Energy Suspension, Energy Bites, Energy Assistance Program, Energy Audit, Energy Advisor, Energy Assistance Michigan, Energy And Environmental Science, Energy And Commerce Committee, Energy Advantage, Energy Auditor, Energy And Wavelength, Energy Absorption, Energy Balls, Energy Bites, Energy Boost, Energy Bridge, Energy Bars, Energy Boosters, Energy Balance, Energy Bus, Energy Ball Recipe, Energy Balance Equation, Energy Conservation, Energy Coop, Energy Crisis, Energy Conversion, Energy Cannot Be Created Nor Destroyed, Energy Companies, Energy Calculator, Energy Company That Went Bankrupt In 2001, Energy Companies In Michigan, Energy Consumption, Energy Definition, Energy Drinks, Energy Dance Competition, Energy Diagram, Energy Drake, Energy Density, Energy Definition Physics, Energy Definition Chemistry, Energy Design Service Systems, Energy Definition Science, Energy Efficiency, Energy Equation, Energy Efficient Windows, Energy Efficient Light Bulbs, Energy Efficiency Definition, Energy Efficient Homes, Energy Etf, Energy Efficient Construction, Energy Efficient Furnace, Energy Examples, Energy Foods, Energy Formula, Energy For Life, Energy Flow, Energy Flow In Ecosystems, Energy From The Sun, Energy Facts, Energy Forms, Energy Future Holdings, Energy For Kids, Energy Gel, Energy Group, Energy Gum, Energy Gummies, Energy Gif, Energy Games, Energy Grid, Energy Guide, Energy Graph, Energy Gem Kingdom Hearts 2.5, Energy Healing, Energy Harvesting, Energy Healing Therapy, Energy Healers Michigan, Energy Healing Methods, Energy Hog, Energy Healer Near Me, Energy Head, Energy Hub, Energy Herbs, Energy Information Administration, Energy International, Energy Institute Umich, Energy Is Released From Atp When, Energy In Spanish, Energy Is Measured In, Energy Independence, Energy Industry, Energy Is, Energy Is The Ability To, Energy Jobs, Energy Journal, Energy Jobs In Michigan, Energy Jelly Beans, Energy Juice, Energy Jokes, Energy Joules, Energy Jewelry, Energy Justice, Energy Jobline, Energy Kids, Energy Knight Air Conditioner, Energy Killing Foods, Energy Kinetics, Energy Kidz, Energy Kitchen, Energy Keeper Carbink, Energy Keri Hilson, Energy Kinesiology, Energy Kit, Energy Lights, Energy Lyrics, Energy Light Shoes, Energy Level, Energy Level Diagram, Energy Level Definition, Energy Law, Energy Logo, Energy Labs, Energy Levels Of An Atom, Energy Muse, Energy Medicine, Energy Management, Energy Manipulation, Energy Metabolism, Energy Meaning, Energy Management Systems, Energy Meme, Energy Music, Energy Michigan, Energy Nightclub, Energy News, Energy Nook, Energy National Dance, Energy Northwest, Energy Network, Energy Never Dies, Energy Necklace, Energy Number, Energy News Today, Energy Of Motion, Energy Of A Photon, Energy Ogre, Energy Of Activation, Energy Of A Wave, Energy Of Moving Things, Energy Optimization, Energy Of Light, Energy Of An Object Due To Its Motion, Energy Of An Electron, Energy Pyramid, Energy Products, Energy Pills, Energy Physics, Energy Power Systems, Energy Products Inc, Energy Policy Act, Energy Policy, Energy Psychology, Energy Physics Definition, Energy Quotes, Energy Quest, Energy Quizlet, Energy Quiz, Energy Questions, Energy Quiz Answers, Energy Quanta, Energy Questions And Answers, Energy Quality, Energy Quality Definition, Energy Resources, Energy Recovery Ventilator, Energy Reaction Coordinate Diagram, Energy Relationships And Life 1, Energy Recovery, Energy Rocks, Energy Reduction Coalition, Energy Rebates, Energy Reaction Diagram, Energy Return On Investment, Energy Star, Energy Stored In Chemical Bonds Of Molecules, Energy Suspension, Energy Synonym, Energy Sources, Energy Stocks, Energy Sword, Energy Solutions, Energy Smoothie, Energy Skate Park, Energy Transfer Partners, Energy Transformation, Energy Types, Energy Transfer Definition, Energy Take Classic 5.1, Energy Transfer In Living Organisms, Energy Transfer In Living Organisms Pogil Answers, Energy Transfer Partners K-1, Energy Tea, Energy Transformation Worksheet, Energy Units, Energy U, Energy Use, Energy Usage Calculator, Energy Usage, Energy Use Intensity, Energy Use Calculator, Energy Unit Conversion, Energy Upgrade California, Energy Use In The Us, Energy Vampires, Energy Vitamins, Energy Vortex, Energy Vs Power, Energy Video, Energy Vocabulary, Energy Vortex Michigan, Energy Ventures, Energy Vape, Energy Vibrations, Energy Work, Energy Word Whizzle, Energy Weapons, Energy Water, Energy Waves, Energy Webquest, Energy Worksheet, Energy Words, Energy Word Search, Energy Wavelength, Energy Xxi, Energy Xl-s8, Energy Xxi Stock, Energy Xl, Energyxt, Energy X Plus 2, Energy Xxi News, Energy X Plus, Energy X, Energy Xxi Ceo, Energy Yielding Nutrients, Energy Yoga, Energy Yield, Energy Youtube, Energy Young Living, Energy Yielding Definition, Energy Yield Of Aerobic Respiration, Energy Yoga Poses, Energy Yielding Nutrients Include, Energy Yield Ratio, Energy Zone, Energy Zone Oxford, Energy Zone Xenoverse 2, Energy Zone Leggings, Energy Zone Pants, Energy Zappers, Energy Zero, Energy Zest, Energy Zone Size Chart, Energy Zone Yoga Bra