Slashdot Mirror
Ukraine Power Station Outage -- Enabled By Malware, But Not Caused By Malware (sans.org)
itwbennett writes: A new study of a recent cyberattack against Ukrainian power companies suggests malware didn't directly cause the outages that affected at least 80,000 customers. While malware was used to gain access to networks, the attackers then opened circuit breakers that cut power, according to information published Saturday by the SANS Industrial Control Systems (ICS) team. The attackers used direct intervention to try to mask their actions to the power systems operators and also conducted denial-of-service attacks on the utilities' phone systems to block complaints from affected customers, SANS said.
The malware didn't cause the outages, the circuit breakers that the malware allowed the hackers to open caused it. To me, that's a distinction without a difference.
Yes your honor, I stabbed the victim a hundred times. But it wasn't me - it was the knife that did the cutting.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Ukraine is weak
About all this says over what we previously knew is that apparently the attackers picked the time of the outage and then had multiple attack points to prevent the operator from being able to effectively disrupt what the attackers where doing. This is different from some virus infection that just so happed to disrupt the operation of the equipment.
But this all matters to me why? Ukraine isn't known for it's security, physical or network. Ukraine isn't known for using the best of technology in their power generation equipment given the worst nuclear accident in history took place here. This attack had an incredibly small affected area and only involved 80,000 customers. This is roughly equal to vandalizing a subway train with spray paint in front of a sleeping transit cop. Yea, it looks bad, but it only happened because somebody was asleep on the job in an ex-soviet country awash in Vodka and violence...
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
The attackers used direct intervention to try to mask their actions to the power systems operators and also conducted denial-of-service attacks on the utilities' phone systems to block complaints from affected customers
Ok, this has gone far enough. Time to get James Bond involved.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Even Putin isn't indiscriminately using force in any of the conflicts in the Ukraine. Even if no one believes that "it's really just the separatists, not Russian troops pretending to be separatists" bit, it's an important fig leaf of plausible deniability. Putin still seems to feel it's important to be able to pretend to be doing this stuff.
And it would be the same with this. Assuming the Russians were behind it, they'd likely be using this method in part because it obscures their connection to the point that, despite everyone thinking they did it, no one can prove it beyond a reasonable doubt. Which, if you think about it, is sort of the best of both worlds. You get the intimidation factor that comes with people not wanting to mess with you, but also without the consequences of having gotten caught doing it.
It's *full* of moronic CEOs who want Everything Internet Enabled!!!.. and some not only do not have air gaps between the grid controls and the 'Net, but don't even know what the words "air gap" means.
mark
Given the coordinated efforts it really sounds like the attack had to be state sponsored.
Now who would want to mess with Ukraine?
-PinkyGiggleBrian (too lazy to log in at the moment)
I haven't read it yet myself.