Keeping Hackers Off the Electrical Grid

Biggest issue.

Keeping Hackers Off the Electrical Grid

By R. Colin Johnson

Commissioned by CACM Staff, June 20, 2023

ORNL researchers showed how to encode grid operating data into a unique color pattern hidden inside a single video frame, which can be transmitted to a grid control center computer using a Fibonacci sequence to encode/decode each sensor reading.

Credit: Oak Ridge National Laboratory

As attacks on grid substations increase—by 70% in 2022 alone, according to the Department of Energy's Oak Ridge National Laboratory (ORNL)—engineers there are anticipating new attack vectors and taking measures to protect from hackers using them.

"As researchers, we try to stay ahead of cyber threats, not just react to them after they occur," said ORNL's Peter Fuhr, who heads its Grid Communications and Security group. Fuhr's group recently demonstrated a new method of using a rotating color wheel to encode grid sensor data subliminally into a video feed, and using a novel Fibonacci sequence decoding key that rotates the color-wheel so each sensor reading uses a unique color code.

"ORNL has invented a compelling method to protect our critical grid infrastructure that builds upon known encryption technology," said Sterling Rooke, chief executive officer (CEO) of Brixon Inc. (Baltimore) , a company that manufactures electrical power monitoring instruments. "With the right application, there will be a need for this novel implementation—a kind of steganography that conceals critical information within the existing live video feeds from the grid substations themselves."

The technique, Fuhr says, translates the encrypted character codes utilities use today to a color-code hidden in video feeds from cameras that already monitor substation activity. EPB (formerly the Electric Power Board, Chattanooga, TN) successfully tested the technique for six months using a virtual local area network (VLAN) link between the central-EPB grid control center and its substations. "We proved the concept in the lab at ORNL, then extended the testing to a nearby substation, and eventually installed the color encoding/decoding equipment at both the EPB substation and its central-control computer," said Fuhr. "It's the real deal—tested and proven."

According to Fuhr, EPB and most industrial process control architectures in the U.S. follow the National Institute of Standards and Technology (NIST) SP800-82 guidelines for all industrial process control (IPC) systems—including factories, manufacturing, and automated testing, as well as the grid. His color encoding/decoding technique will work not only for grid communications from a grid central control computer to its substations, but for any operational technology (OT). In fact, several private companies have already shown interest in licensing his color-coding architecture, according to Fuhr.

Historically, Internet connections have offered an entry point for sophisticated hackers to insert malware into substations, which are almost universally run by SCADA (supervisory control and data acquisition) networks, which date back to the 1950s, when cybersecurity wasn't even a word. Even today, SCADA networks typically do not require any authentication to remotely execute commands on a control device. To solve most vulnerabilities, the NIST guidelines forbid the central control computer—which is typically connected to corporate IT—to extend Internet availability to the SCADA control system. NIST-compliant SCADA architectures are isolated from the Internet by firewalls that instead run a multi-channel virtual local area network (VLAN) to substations connected to its central control computers. Likewise, communicating data from sensors and to actuators run on different channels of the VLAN. Most operations are programmable, but run autonomously at unmanned substations; human operators can also use a graphical user interface (GUI) for high-level configuration and supervision of remote machines and processes.

Over the years as cybersecurity has become an increasingly important issue, many hacker-resilient modifications have been added to SCADA architectures. These security measures, however, have not been universally applied. The result has been numerous attacks dating back to 2000, when a disgruntled former employee took control of the Maroochy Shire sewage OT system in Queensland, Australia, using a single computer and a radio transmitter. Since the commercialization of the Internet, many hackers have attacked process control systems, including utilities, forcing new (and retrofit) SCADA industrial protocols to segment their networks with gateways, routers, one-way-only data-diodes, and white-listing that only passes traffic of a single type down each VLAN channel. In addition, VLAN channels are only bi-directional when they need to be, are segmented so they can only communicate with devices with which they were meant to communicate, and are not allowed to connect to the central corporate network without at least a firewall (for maximum security, with two firewalls on each side of a DMZ (demilitarized zone) server that securely forwards communications).  ... ' 

Remote Access Cautions

 Good more balanced view of the recent SCADA threat in infrastructure.  Remote access is a classic potential security weakness.    Have myself been involved in the need to monitor and control industrial systems remotely   The failure was not including several elements in the remote connection.    Fix that now, early warnings are good.  Good points made here: 

Increased uptime? Check. Better access to outside expertise? Check. Improved first-time-fix rate? Check. in Tripwire

These are just some of the benefits of industrial remote access. Yet many customers are reluctant to embrace remote access. Not only that, but incidents such as the breach at the Oldsmar water utility might increase organizations’ reluctance to use remote access.

Using Oldsmar as an Example

The benefits of remote access should not be in dispute. So rather than making remote access the scapegoat, let’s consider the incident at Oldsmar water utility briefly.

It has been established that the nefarious actor was able to access the SCADA system via TeamViewer. The details of how they were able to gain access via TeamViewer is still unknown.

So, based on this information, TeamViewer is the villain, correct?

The answer is not binary. TeamViewer serves a legitimate purpose if used correctly. In this instance, to understand if TeamViewer was the right tool, let’s consider the application more closely.

As a water authority, the Oldsmar plant’s main KPI is to keep the plant operational 24/7 because we all want safe and clean drinking water when we start the tap! This means minimal downtime, timely notifications of any alarms and the ability to diagnose faults promptly. Remote access is an essential tool to achieve this objective. The remote user does not need access to the utility’s IT network to keep the plant operational. And, this is the key – IT and OT’s remote access needs are different .... " 

US Infrastructure Attack

Broadly reported last week.  Was later pointed out that such local systems are universally poorly funded and protected.  And this is unlikely to be improved given the current business models of such systems.

A relatively rare SCADA attack on infrastructure occurs in the US.  By allowed remote access.  

Poor Password Security Led to Recent Water Treatment Facility Hack

By The Hacker News, February 11, 2021

New details emerging about the remote computer intrusion at a Florida water treatment facility last week highlight a lack of adequate security measures to protect critical infrastructure environments.

New details have emerged about the remote computer intrusion at a Florida water treatment facility last Friday, highlighting a lack of adequate security measures needed to bulletproof critical infrastructure environments.

The breach, which occurred last Friday, involved an unsuccessful attempt on the part of an adversary to increase sodium hydroxide dosage in the water supply to dangerous levels by remotely accessing the SCADA system at the water treatment plant. The system's plant operator, who spotted the intrusion, quickly took steps to reverse the command, leading to minimal impact.

Now, according to an advisory published on Wednesday by the state of Massachusetts, unidentified cyber actors accessed the supervisory control and data acquisition (SCADA) system via TeamViewer software installed on one of the plant's several computers that were connected to the control system.

From The Hacker News 

Protecting Industrial Control

Probably one of the most important things we can do well.  When involved in this space in the 80s, things were far less connected, so both the threats and remedies are far more possible.   Here an overview of SCADA.  And add to that the ability to find patterns of much more subtle changes in a system.

Protecting Industrial Control Systems   By Keith Kirkpatrick
Communications of the ACM, October 2019, Vol. 62 No. 10, Pages 14-16    10.1145/3355377

While most commercial and government organizations have a corporate network to handle administrative, sales, and other back- or front-office data, a growing number of organizations also have implemented one or more supervisory control and data acquisition (SCADA) systems. These systems incorporate software and hardware elements that allow industrial organizations, utility companies, and power generators to monitor and control industrial processes and devices, including sensors, valves, pumps, and motors. Today's SCADA systems also allow organizations to harvest data from these devices, and then to analyze and make adjustments to their operational infrastructure to improve efficiency, make smarter decisions, and quickly address system issues to help mitigate downtime.  .... "