Quantitatively Assessing and Visualising Industrial System Attack Surfaces

CHAPTER 1. INTRODUCTION 13
This particular case is interesting because it shows that such compromises are possible
even for a hacker without knowledge of SCADA systems, and for reasons unexpected to
your average control system engineer. The motivation of a directed compromise might
simply be the use of your computational resources, not money or terror. Additionally, all
the old challenges of computer security arise such as tracking and prosecuting someone in
another national jurisdiction.
Maroochyshire
Between February 9th and April 23rd 2000, multiple malicious interventions in sewage
pumping stations occurred in Maroochyshire, Australia. Hundreds of gallons of raw
sewage were released into rivers and parks.
Since then, a former employee of an IT consultancy employed by the council has been
convicted of these attacks. The incident report notes that the former employee (Vitek
Boden) used stolen equipment and his insider knowledge of the system, which allowed him
to alter radio messages sent to pumping stations or to falsify them altogether. Addition-
ally, he was able to remove ‘alarms’ from the pumping stations to make his changes and
simultaneously remain undetected. The alarms in this case are not the physical alarms,
but rather urgent messages passed (via SMS or email) to control engineers when a de-
vice exceeds some operational limit or parameter, or has its configuration altered. By
disabling these alarms he exacerbated the damage caused by his malicious actions, since
it increased the time until alterations were noticed.
The key points in this case are that he was motivated by revenge, and highly knowledge-
able of the systems and protocols he exploited. He was able to evade detection for months,
and in the initial stages the control system engineers blamed installation errors rather than
detecting malicious actions. It took weeks for the office culture to shift towards proving
the existence of, and detecting, a malicious actor.
Lastly, the sabotage perpetrated by Vitek Boden is a mixture of remote and local. While
he issued his malicious commands remotely and wirelessly, he was in close proximity to
the stations he exploited. So during a period that he was parked near a pumping station,
he was picked up by local police officers. This highlights the value of control system
engineers, computer security professionals, and police forces having an understanding of
each other’s roles and responsibilities during such an event.
According to the Repository of Industrial Security Incidents (RISI) analysis done by Byres
and Lowe [5], insider attacks happen less frequently than remote attacks, but they are
much more costly.