POWER May 2016 - 47

INSTRUMENTATION & CONTROL
Why Power Generators Can't
Ignore the Ukraine Cyberattack
Although the December attack on Ukraine's power infrastructure mostly affected
the distribution grid, generators are just as vulnerable to cyberattack,
in part because they tend to rely more on outside contractors working
remotely. Here's the latest on the attackers' path and methods, areas in
generation that are potentially vulnerable, and recommendations to address
the vulnerabilities.
Michael Toecker, PE
D
ecember 23, 2015: Kyivoblenergo
Control Room, Kiev Region,
Ukraine. It's late afternoon, and a
grid operator is sitting at his workstation,
monitoring the flow of power in the local
distribution grid of the Kiev Oblast (Ukrainian
province). Around 3:30, the operator
notices the mouse cursor is moving. Grabbing
the mouse, he tries to move it out of
the way, but the cursor continues to move
on its own. The cursor's destination is a set
of 35kV and 100kV substations that provide
power to almost 80,000 customers
(Figure 1).
With deliberate action, a remote individual
had taken control of the operator workstation
and was systematically opening breakers
at 30 substations. Opening breakers doesn't
take much time; it was all over in 5 minutes.
For the people disconnected, and the utility
personnel deployed, recovery would take
considerably longer.
Kyivoblenergo wasn't the only utility
hacked remotely; two more control centers
suffered similar compromises, blacking out a
total of 225,000 customers for over 6 hours in
cold weather. Prior to opening the breakers,
attackers reconfigured battery backup systems,
disabling the automatic transfer functionality.
Once the breakers opened, those
backups failed to keep systems online, and
placed operators in the same darkness. And
while some details differ, a software component
called KillDisk was also used to fully
wipe the hard drives of corporate and control
systems, requiring time-consuming reinstallation
of the operating system and other important
software.
Operators discovered vital devices at
the individual substations had been reprogrammed
with invalid firmware, denying
remote control capability. The Ukrainian distribution
control centers had been completely
May 2016 | POWER
www.powermag.com
47
blinded and were relying on voice radio and
cellphones for communication, using pen
and paper to manage their local distribution
grids.
The Ukrainians, according to trustworthy
reports, had a reasonable security infrastructure
in place. They had a perimeter, limited
access for both data and personnel, and good
logging of ingress and egress from the control
system. However, their remote access
infrastructure used only a single means of
authentication: a password.
The root cause teams concluded the original
infection was via malicious Microsoft
Word and Excel documents sent to employees
of the utility via public email. When opened
on corporate systems, the Office documents
would install malware that would spy on users
and report that activity to attackers on the
Internet. That malware captured usernames
and passwords from the corporate desktops
of remote personnel, and attackers then used
these stolen credentials to access the control
system. Once on the control system, the attacker
had full access-and used that access
to great effect.
Power Generators Have Similar
Vulnerabilities
The Ukraine cyberattack co-opted the authorized
remote access already in place for
remote maintenance and used this access
to operate substation breakers using the
human-machine interface. The utilities hit
by the attackers used reasonable perimeter
controls, but the attackers spent enough time
compromising the corporate infrastructure to
effectively gain access with the usernames
and passwords of authorized control system
personnel. The basic process followed by the
attackers is shown in Figure 2.
This attack was similar to monitoring the
service entrance of an important building and
watching employees enter their passcode for
access to the building. Eventually, the attacker
will see the PIN code and will be able to
enter the building.
Generation personnel have become familiar
with remote access to the plant via the
Internet, because many generation facilities
are very reliant on having remote personnel
service and troubleshoot issues. In an era of
increasingly small profit margins for many
1. Notice of hack. This web-translated announcement from Kyivoblenergo announces
its control system was hacked, but the post was deleted a few days later. Courtesy: Chris
Sistrunk
http://www.powermag.com
POWER May 2016

Table of Contents for the Digital Edition of POWER May 2016
