Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

CYBER ATTACKS DIRECTED AGAINST POWER GRIDS211Wei et al. divide the major functions of the power grid into three different levels: corporate,control center, and substation. Business management and operations management functionsare performed at the corporate level. Monitoring, forecasting, and other real-time operationsare performed at the control center level. At the substation level, primarily real-time monitoringassociated with normal operations is performed. IT systems are used in various capacitiesat these three levels. At the corporate level, IT systems are relied on in planningthe amount of electricity that must be generated the next day as well as performing assetmanagement—predicting when certain substations may experience maintenance—whichwould lead to a decision to reroute power from that substation. At the control level, automationsystems such as energy management systems (EMS), human-machine interfaces (HMIs),and a Front End Processor (FEP) are primarily used for the purposes of regulating andmonitoring the power transmitted to the substations. Finally, at the substation level, IT isprimarily used for monitoring the power distributed to consumers. Devices such as remoteterminal units (RTUs) and programmable logic controllers (PLCs) can be found at this level.Cyber attacks against power grids can be broadly categorized into three categories: componentwise, protocol wise, and topology wise. Component-wise attacks focus on a specific partof the power-grid IT infrastructure. An example for a component-wise attack described in thischapter is the Aurora Test—where a breaker switch was opened and closed in a manner to puta power generator out of synchronization with the rest of the power grid—causing damage.We describe this attack later in the chapter. Other examples of component-wise attacks include(but are not limited to) the following and their combinations:• Attacks designed to mislead the data presented to an operator (i.e., a violation ofnonrepudiation)• Attacks designed to damage power-grid equipment (i.e., the Aurora Test which we shalldescribe later in this chapter)• Attacks designed to shut-down a piece of power-grid equipmentIn protocol-wise attacks, the perpetrator targets the protocol used to transmit informationabout the power grid. As stated earlier, power-grid control centers and substations oftenuse protocols not typical to normal IT equipment such as Inter Control Center Protocol (ICCP)and DNP (Distributed Network Protocol). However, these protocols are somewhat commonamong electrical power automation equipment. For example, Wei et al. point out that the DNPspecification can be obtained for a nominal fee. The main type of attack accomplishedprotocol-wise is a Man-In-the-Middle attack where the attacker is able to manipulate communicationsbetween two parties. Some potential results of this type of attack could include• Financial loss to power generation companies due to excessive power output• Safety issues (i.e., energizing a line when electrical personnel are attempting to repair it)• Equipment damage resulting from power overloadsOne example of a very rudimentary protocol-wise attack was discussed in the previouschapter—the attack on Maroochy Water Services. In this incident, the attacker was able to leveragea vulnerability common to virtually every unsecured wireless communication schemeto take control of the sewage pumping stations.The third type of attack deals with the topology of the power-grid network. This type ofattack could have multiple goals. For instance, a denial-of-service (DoS) attack against a