Ukraine Blackout – The Future Of War

For a look at how cyber will play into armed conflict, look at the Dec. 23 attack on the Ukrainian energy sector. This was no simple hack involving celebrity emails or embarrassing personal information, but a highly coordinated and complex cyber-physical assault that knocked out power to more than 225,000 people, in a war-torn country, in the dead of winter.

Recently, the head of Southern Company, one of America’s larger regional electricity producers, said that the United States was well protected against a similar attack. But that doesn’t mean that a repeat, or a similar event, couldn’t trigger a larger conflict even if it doesn’t shut off the lights.

Cyber security researchers have pointed the finger at pro-Russian hacktivist groups. US-based iSight Partners specifically accused the Moscow-based Sandworm. But a wide variety of pro-Russian groups are working against Ukraine and Western forces; one is Cyberberkut, which has taken credit for attacks on German media and NATO sites.

So how do these groups operate? History suggests: with stealth and subtlety.  Remember 2014, when masked gunmen, not officially affiliated with any larger nation-state, began waging war in Eastern Ukraine? The so-called “green men” completed their invasion before anyone was able to figure out that they were, in fact, invading.

The specific culprit in the Ukraine blackout is almost less important than the broader trend: the rise of cyber militias that work on behalf of state interests but whose veneer of independence gives governments plausible deniability.

Tom Kellermann, the CEO of Strategic Cyber Ventures, put it this way at the recent Suits and Spooks conference in Washington, DC. “There’s a cult of personality, particularly in the East. The greatest hackers in the world, the Russian-speaking blackhat community in the former Soviet bloc, are beholden to that cult of personality. They’re beholden to that cult of personality for a number of reasons. They’ve been allowed to act with impunity when hacking the US financial sector for more than 17 years in exchange for paying tribute or homage to the regime. The examples are Estonia, South Ossetia, and now Ukraine.”

But to read the way US outlets covered the Ukrainian outage, you might think that the cyber attack and the blackout occurred almost randomly. In fact, utilities and central services have emerged as a new front in the war in the Eastern part of the country. Less than a month before the Ukrainian energy outage, one occurred on the disputed Crimea peninsula. Ukrainian police blamed saboteurs.

Russian President Vladimir Putin reportedly reacted by promising to construct power lines into the region; Russian newspapers have reported that German company Siemens has a contract with the Russian government to build gas turbine powered-plants in the Crimean cities of Sevastopol and Simferopol. Siemens reportedly refuted the claims, as building the plants would be a violation of international sanctions). Not long after that denial, Siemens became one of the key targets in the Ukraine blackout.  

The primary piece of software implicated in the attack was called BlackEnergy, according to DHS’s recently released report on the incident. It’s less of a weapon than a vehicle carrying a weapon.

The BlackEnergy malware was reportedly delivered via spear phishing emails with malicious Microsoft Office attachments. It is suspected that BlackEnergy may have been used as an initial access vector to acquire legitimate credentials, the report said.

BlackEnergy is still around in 2016 because it has a modular architecture, allowing people to write different plug-ins. By itself, it’s not the sort of software that could take down a power station. Rather, it would work in concert with an add-on, a very specifically designed package; in this case, one designed to attack the control equipment of the targeted Siemens power plants.

Still, recent attacks against US power entities are even more sophisticated than the one against Ukraine. Fanning pointed to a March 2015 attack on a Pacific Gas and Electric substation. The assailants broke into the station physically and then disabled the supervisory control and data acquisition, or SCADA system, before trying to damage other things.

The use of a self-destruct booby trap is the difference between an act of espionage—something that virtually every nation engages in—and an act of serious consequence, possibly requiring international sanctions or a response from US Cyber Command.

Think back to the Sony hack: the attackers not only took data but also destroyed it. “This is why I think many of us worry about Sony, the destructive nature of it. It wasn’t just the fun and games of, you know, what rich Hollywood executives were saying about rich Hollywood starlets, right?” Mike Rogers, the Michigan Republican who used to chair the House Intelligence Committee, said last year. “…That is equally possible in our electric grid.”

If lawmakers decide that the use of software like KillDisk is tantamount to an act of war that could put the military in a difficult position. Adm. Michael Rogers, the head of Cyber Command has said that offensive cyber weapons would be used proportionally and in line with the rules of conflict.

DefenseOne:      The Conversation

« Now Surveillance 'aggressive-invasive': Snowden
Google's AI Wins Final Go Challenge »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

ON-DEMAND WEBINAR: Navigating cloud security: The importance of posture management tools

ON-DEMAND WEBINAR: Navigating cloud security: The importance of posture management tools

Watch this webinar to see how cloud security posture management (CSPM) tools can fit into your cloud security strategy.

Actiphy

Actiphy

Actiphy provides a tried and proven backup and disaster recovery software solution to ensure business continuity at all times.

MedCrypt

MedCrypt

MedCrypt are a team of medical device experts focused on bringing modern cybersecurity features to the next generation of healthcare technology.

Rippleshot

Rippleshot

Rippleshot is a fraud analytics firm that detects mass card compromises faster, allowing issuers to execute more proactive fraud detection strategies.

National Forensic Sciences University (NFSU)

National Forensic Sciences University (NFSU)

National Forensic Sciences University is the world’s first and only University dedicated to Digital Forensic and allied Sciences.

Zeguro

Zeguro

Zeguro provides complete cybersecurity risk assessment, mitigation and insurance, allowing you to easily manage your cyber risk.

ES2

ES2

ES2 is a consulting organisation specialising in Enterprise Security and Solutions Services.

Newberry Group

Newberry Group

The Newberry Group provides comprehensive IT services and solutions that optimize operations, minimize risk and deliver measurable business value.

State Service of Special Communications & Information Protection of Ukraine (SSSCIP)

State Service of Special Communications & Information Protection of Ukraine (SSSCIP)

State Service of Special Communications and Information Protection is the technical security and intelligence service of Ukraine, under the control of the President of Ukraine.

MazeBolt Technologies

MazeBolt Technologies

Israel-based MazeBolt is an innovation leader in cybersecurity, with over two decades of experience in pioneering DDoS protection solutions.

OSIbeyond

OSIbeyond

OSIbeyond provides comprehensive Managed IT Services to organizations in the Washington D.C., MD, and VA area including IT Help Desk Support, Cloud Solutions, Cybersecurity, and Technology Strategy.

Quantexa

Quantexa

Quantexa automates millions of operational decisions, at scale, across multiple business units, including Anti-Money Laundering, Know-Your-Customer, Fraud, Credit Risk and Customer Intelligence.

Auvik Networks

Auvik Networks

Auvik is easy-to-use cloud-based networking management and monitoring software - true network visibility and control without the hassle.

FourNet

FourNet

FourNet is an award-winning provider of cloud and managed services; we work closely with our clients to enable digital transformation across their organisation.

Open Source Security Foundation (OpenSSF)

Open Source Security Foundation (OpenSSF)

OpenSSF is committed to collaboration and working both upstream and with existing communities to advance open source security for all.

SIGLA Group

SIGLA Group

SIGLA Group specialize in the design and development of IT and OT solutions, from analysis to design, from implementation to commissioning, as well as consultancy, training and assistance.

XONA

XONA

XONA is The Zero Trust user access platform for the OT enterprise. Secure operational access to critical systems - from anywhere.