The Cybersecurity Threat To Railways

The European Union Agency for Cybersecurity (ENISA) has recently published its first cyber threat landscape report on the transport sector, covering the period from January 2021 to October 2022. Ransomware attacks have become an increasingly significant cyber threat facing the transport sector in the European Union, according to a new analysis published on March 21st.

The report identifies prime threats and examines cyber security breaches during this period. It also includes an assessment of threat actors, considers their motivation for launching cyber attacks and identifiers major trends by mode.

It warns that while the majority of ransomware attacks to-date have targeted information technology (IT) systems such as databases, ransomware groups “will likely target and disrupt” operational technology (OT) systems “in the foreseeable future,” potentially causing even more significant effects for victims.

Overall, ENISA says that ransomware is the main threat to the rail sector, accounting for 45% of cyber attacks.

  • Data-related threats accounted for 25%, as did denial of service (DoS), distributed denial of service (DDoS) and ransom denial of service (RDoS) attacks.
  • Hacks that exploited known IT vulnerabilities accounted for 15%, while fraud, impersonation and counterfeit, malware and supply chain attacks each accounted for 5%.

The majority of cyber attacks targeted railway IT systems, including those behind passenger operations ticket systems, mobile phone apps and passenger information systems, causing disruption by making these services unavailable. Examples included ransomware attacks targeting Swedish public transport authority Skånetrafiken in August 2021 and the Italian State Railways in March 2022 when customers were unable to purchase tickets due to infected IT systems.

Enisa says the only cases affecting operational technology (OT) systems involved entire networks, or where safety-critical IT systems were unavailable.

Notable data thefts included cases at Norfolk Southern (NS), shortline operator OmniTrax and the New York Metropolitan Transportation Authority (MTA) in the United States, as well as at passenger operators Merseyrail in Britain and Lokaltog in Denmark. Personnel and medical records were stolen, and Enisa says that OmniTrax is the first publicly-known case of a double-extortion ransomware attack against a US freight rail operator.

The report also highlights the extensive disruption to Danish State Railways (DSB) services in October 2022. DSB ICT service provider Supeo was itself the victim of a cyber attack, with the result that DSB drivers could not access a key safety-critical IT system, disrupting DSB operations for several hours.

ENISA noted a ransomware attack on the Belarusian state-run train company in January 2022 “in a bid to disrupt Russian troop movements” when the attackers “deployed modified ransomware to bring down the railway system and encrypted servers, databases and workstations belonging to the Belarusian railway service.” The report says that the increasing proportion of DDoS attacks in the rail sector is due to the increased hacktivist activity which followed the invasion of Ukraine, undertaken by pro-Russian or anti-Nato groups.

Pro-Russian hacker groups have claimed responsibility for attacks in 2022 on Romanian national operator CFR Calatori in April, on Lithuanian Railways and Latvian operator SJSC in June, and against Estonian Railways in August.

Considering the issue of cyber attacks exploiting known vulnerabilities to IT systems, ENISA says that two cases stand out.

  • In December 2021 Toronto public transport agency Metrolinx temporarily took down its website as a precautionary measure, after being informed by the Canadian government that it was vulnerable to cyber attack.
  • A system vulnerability potentially allowing access to customers’ personal data held by Swiss Federal Railways (SBB) was reported by an anonymous hacker in January 2022.

Breaking down the attacks by target, the report says that 21, or 72%, were aimed at infrastructure managers and operators, seven (3%) at transport authorities and other public bodies, and only one (3%) at an IT service provider.

“Transport is a key sector of our economy that we depend on in both our personal and professional lives,” says ENISA Executive Director, Juhan Lepassaar“Understanding the distribution of cyber threats, motivation, trends and patterns, as well as their potential impact, is crucial if we want to improve the cyber security of the critical infrastructure involved.” Lepassaar added.

ENISA:   ENISA:   ENISA:  Rail Journal:   The Record:       Railway-Cybersecurity:     Railpage

You Might Also Read: 

UK Rail Signals Can Be Hacked To Cause Crashes:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

« The Inevitable Rise Of Artificial Intelligence
Imminent: Cybersecurity Regulations For US Financial Services »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Micro Systemation AB (MSAB)

Micro Systemation AB (MSAB)

MSAB is a leader in the provision of forensically secure tools for the extraction and analysis of data from mobile devices.

TestFort

TestFort

TestFort QA Lab is a specialized software testing company offering independent quality assurance and software testing services.

Intensity Analytics

Intensity Analytics

Intensity Analytics is a software firm that develops next-generation, physical user and entity behavioral authentication ("physical UEBA") security software technology.

Magal Security Systems (Magal S3)

Magal Security Systems (Magal S3)

Magal Security Systems is a leading international provider of integrated solutions and products for physical and cyber security, safety and site management.

Qufaro

Qufaro

Qufaro is a new initiative designed to make it simpler for those with career ambitions in cyber security to access the UK’s cyber-specific education and innovation opportunities.

StormWall

StormWall

StormWall is an Anti-DDoS protection service for websites and networks. We offer 100% protection from all types of DDoS attacks and 24/7 technical support.

VIPRE Security Group

VIPRE Security Group

VIPRE Security Group is an award-winning global cybersecurity, privacy and data protection company.

Mosaic 451

Mosaic 451

Mosaic451 is a bespoke IT managed services provider and consultancy specializing in information security, operations and design.

ICS-CSR

ICS-CSR

ICS-CSR is a research conference bringing together researchers with an interest in the security of industrial control systems.

Digital Magics

Digital Magics

Digital Magics is an incubator for innovative startups which offer content and services with high technological value. Areas of focus include IoT, Enterprise Software, AI, Industry 4.0 and Blockchain.

Qmulos

Qmulos

Qmulos’ real-time continuous monitoring risk management suite, Q-Compliance, provides a massively flexible and scalable solution to optimizing operational security.

Research Institute in Verified Trustworthy Software Systems (VeTSS)

Research Institute in Verified Trustworthy Software Systems (VeTSS)

The main purpose of VeTSS is to support program analysis, testing and verification, to achieve guarantees of software correctness, safety, and security.

FirstWave Cloud Technology

FirstWave Cloud Technology

FirstWave Cloud Technology is a global cyber security company which has been delivering Cybersecurity-as-a-service solutions to the market since 2004.

CITRA - Information Security and Emergency Response

CITRA - Information Security and Emergency Response

CITRA is responsible for overseeing the telecommunications sector, monitoring and protecting the interests of users and service providers, and regulating the services of telecomms networks in Kuwait.

Cyber Security Partners (CSP)

Cyber Security Partners (CSP)

Cyber Security Partners specialise in the provision of Cyber Security Consultancy, Data Protection and Certification and Compliance services.

SideChannel

SideChannel

At SideChannel, we match companies with an expert virtual CISO (vCISO), so your organization can assess cyber risk and ensure cybersecurity compliance.