IEEE Power & Energy Magazine - September/October 2016 - 53

breach unprotected electric equipment connected to an electric grid. It should now be clear that the Aurora risk is public
information that provides a formula for potential execution.
In fact, the December 2015 Ukrainian cyberattack was carried out using an approach very similar to Aurora.

Ukraine Cyberattack (2015)
On 23 December 2015, unknown attackers staged a wellcoordinated attack concurrently across three Ukrainian
regional energy distribution companies, a large Ukrainian
mining company, and a large Ukrainian rail company. The
attacks against the three electric distribution utilities commenced within 30 min of one another and impacted approximately 225,000 customers. The preparation for these attacks
initiated with phishing e-mails containing BlackEnergy 3
malware, which utilizes randomly generated bots, or web
robots, to support distributed denial of service attacks.
BlackEnergy was implanted to steal legitimate user virtual
private network (VPN) credentials. The attackers then used
the stolen VPN credentials to connect to the ICS/SCADA
network and remote access tools to control the SCADA
human-machine interfaces (HMIs).
Once inside these systems, the attackers had complete
access and ability to remotely control (open/close) the substation breakers. The attackers then installed their own custom
firmware on serial-to-Ethernet converters on devices at substations to disable them and reportedly executed KillDisk, a
software utility used erase and securely destroy all data on
storage devices, erase master boot records, and delete selected
logs. In at least one instance, Windows-based HMIs embedded in remote terminal units were also overwritten with KillDisk. The perpetrators also reportedly scheduled disconnects
for server uninterruptable power supplies (UPS) via the UPS
remote management interfaces; this was likely done to interfere
with restoration efforts. A denial-of-service attack was also
executed on the power companies' telephone systems, creating
further confusion for customers calling in to report an outage.
This attack reflects how deeply the electric utility industry has evolved into a new interconnected, cyber-dependent
set of operating systems that very few people, and perhaps
fewer utility industry leaders, fully and holistically understand. What is apparent is the challenge and effort by utilities to completely secure and defend these systems may be
even more difficult than the efforts by aggressors needed to
infiltrate and cause serious damage. It is important to note
that the methods utilized by the hackers were not necessarily
sophisticated but were well coordinated and demonstrated
the susceptibility of electric systems. Translation: the hackers made it look very easy.
This scenario can be considered a "benign" version of
the Aurora attack, as relays were remotely opened only.
As there was no equipment damage, engineers were able
to operate the system manually. Had the perpetrators chosen to close the circuit breakers out of phase, causing the
Aurora condition, the results could have been much worse,
september/october 2016

including equipment destruction. In this case, recovery might
have spanned at least several months and may have required
millions of dollars to replace damaged generation and transmission equipment.
The U.S. DHS issued an alert in 25 February 2006 that
emphasized that power companies should isolate ICS networks from any untrusted networks, especially the Internet.
This directive was easy to suggest, yet proved very difficult
to actually implement. The leaders of most companies surely
understand conceptually that action is required, but without
specificity these directives are not seen as practically implementable. In fact, according to a DHS ICS CERT Monitor
newsletter, many affected parties have struggled with such
advice, and the DHS now believes this is a prime factor in
how BlackEnergy has entered U.S. electric grids.
As previously highlighted, the Energy Policy Act of
2005 was the main impetus for FERC to designate NERC
as the electric reliability organization in 2007. Upon FERC's
approval, NERC's reliability standards became mandatory
within the United States. These mandatory standards include
CIP standards along with a number of additional requirements that are intended to address the security of cyberassets within the bulk electric system. These standards are the
only mandatory cybersecurity standards in place across the
U.S. electric grid infrastructure. Compliance with the standards does not protect an entity from all dangers. The initial
standards simply could not possibly cover every conceivable
risk. Considering all we know today, a vigilant utility must
go much further than nominal NERC CIP compliance.

What Does the Industry Need?
Given all the risks highlighted, what are the implications to
U.S. power companies, electric utilities, and independent system operators/regional transmission organizations all working to comply with NERC CIP requirements? (See Figure 2
for current NERC CIP standards.) Simply put, it means they
have more work to do to protect their operations. While compliance with the standards has been a good starting point for
utilities, the fact is that only certain equipment is covered
(equipment deemed critical) while other important devices
are not included under the standards' provisions. For instance,
SCADA and substations for subtransmission and distribution
facilities are not captured under the standards. Serial communication devices, such as serial-to-Ethernet convertors, are not
specified under the standards. Nor are embedded web browsers, such as in the UPS, included as a compliance requirement. These three examples reflect just a few of the categories
of unguarded equipment susceptible as entry points of attack.
Another concern experts have highlighted is the lack of
a requirement to take action to remove malware when it is
identified. The standards require only that the presence of
malware needs to be reported and accounted for. As the DHS
has stated, BlackEnergy currently resides in systems connected to the U.S. electrical grids; yet even for those inflicted,
the standards do not specifically require that malware such
ieee power & energy magazine

Table of Contents for the Digital Edition of IEEE Power & Energy Magazine - September/October 2016