Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

216 12. CYBER ATTACKS AGAINST POWER GRID INFRASTRUCTURE2. Compromising the communication channel: In this scenario, the attacker is able to sendcommands through whichever medium is used to communicate with the breaker.The breaker receives commands to open and close as per the attacker’s instructions.3. Direct hack into the protection relay: The hacker connects directly to a port on the protectionrelay, thus bypassing any network security measures that would prevent him fromcompromising the communications channel. The protection algorithm which ensures thatthe voltage, frequency, and phase rotation parameters match before connecting thegenerator to the grid could be outright eliminated in this scenario. The attacker could alsocontrol the breaker using the same method.4. Embedded program in the protection relay: In what appears to be the most advanced type ofattacks, the hacker uploads new software or firmware into the relay (note that here theattacker would also likely have to leverage attack strategy 2 or 3 above). By directlyembedding code in the logic or operating system of the relay, the intruder can directlymanipulate time or power levels—possibly in coordination with other attacks. If the hackeris successful in planting such a program, bypassing most security measures is easy,providing the opportunity to render false reports (violating nonrepudiation) stating thatthe relay is functioning normally.In addition to the above four attack schemes, several other factors should be consideredwhen planning countermeasures for an Aurora-style attack. For instance, some generatorsmay include a “synchronization check” that only allows breakers to be opened or closed whenthe voltage and frequency of the generator and grid match. In the Aurora Test, this featurewas disabled on the generator. 12 However, there are also some breakers that are not directlyattached to the generator. If an Aurora-style attack is initiated on a breaker at a tie-in pointseparately from the generator, the synchronization check would not take place 13 (provided,of course, that there is no synchronization check on the tie-in breaker).Salmon et al. review the security measures that an attacker must overcome in order to conductan Aurora-style attack. 14 They identify three categories of such obstacles to the attacker,all of which address the cyber security of the system. In regard to general cyber security, theattacker must have an understanding of the computer network on which the generatoroperates and has to overcome normal cyber issues such as authentication, encrypted communications,etc. Protecting the breakers of power generators is crucial (as is evident from theAurora Test) as an aggressor might attempt to disrupt the synchronization of the power generatorand the grid—either by opening and closing the relay or by accessing the protectivedispatch. If the breaker is to be opened and closed, the intruder must be able to manipulatethe device in such a way as to avoid the protective relay to disconnect the power generator(either by precise timing or by sabotaging the protective relay). Finally, the attacker must haveaccurate knowledge of the target system. For instance, if manipulating the breaker in order tocause system failure, the assailant needs to be aware of the fact that the breaker must be capableof multiple recloses and/or sequences of open/close events before actual damage isimplemented.Preventing an Aurora-Style Attack. Several methods to prevent an Aurora-style attack havebeen proposed. 15 Here, we discuss a few such measures that can be taken:• Time Delay on Breaker Closing: This technique enforces an extra time interval before thebreaker is closed. The idea is to eliminate the time window an attacker has for conducting