No big deal... Kremlin hackers 'jumped air-gapped networks' to pwn US power utilities
The US Department of Homeland Security is once again accusing Russian government hackers of penetrating America's critical infrastructure.
Uncle Sam's finest reckon Moscow's agents managed to infiltrate computers networks within US electric utilities – to the point where the miscreants could have virtually pressed the off switch in control rooms, yanked the plug on the Yanks, and plunged America into darkness.
The hackers, dubbed Dragonfly and Energetic Bear, struck in the spring of 2016, and continued throughout 2017 and into 2018, even invading air-gapped networks, it is claimed.
This seemingly Hollywood screenplay emerged on Monday in the pages of the Wall Street Journal (paywalled) which spoke to Homeland Security officials on the record.
The Energetic Bear aka Dragonfly crew – fingered in 2014 by Crowdstrike and Symantec – was inside “hundreds” of power grid control rooms by last year, it is claimed. Indeed, since 2014, power companies have been warned by Homeland Security to be on the look out for state-backed snoops – with technical details on intrusions published here.
The Russians hacked into the utilities' equipment vendors and suppliers by spear-phishing staff for their login credentials or installing malware on their machines via boobytrapped webpages, it is alleged.
The miscreants then leveraged their position within these vendors to infiltrate the utilities and squeeze into the isolated air-gapped networks in control rooms, it is further alleged. The hacker crew also swiped confidential internal information and blueprints to learn how American power plants and the grid system work.
We're told, and can well believe, that the equipment makers and suppliers have special access into the utilities' networks in order to provide remote around-the-clock support and patch deployment – access that, it seems, turned into a handy conduit for Kremlin spies.
The attacks are believed to be ongoing, and some utilities may not yet be aware they've been pwned, we were warned. It is feared the stolen information, as well as these early intrusions, could be part of a much larger looming assault.
“They got to the point where they could have thrown switches,” Jonathan Homer, chief of industrial control system analysis for Homeland Security, told the paper.
The Register will watch developments, however, caution is probably a useful prescription at this stage.
After all, an attack on the American grid reported in late 2016 turned out to be far less than was first feared: it was one infected laptop in a relatively small operator, Burlington Electric, and the attack didn't reach control systems.
Infrastructure security expert Robert Lee has a level-headed thread, here, on Twitter. "In short, please take cyber threats to industrial infrastructure serious," he said. "They are getting far more aggressive and numerous. But let’s not use word choices that mislead and hype up the issue. It’s bad enough without added fear."
While the Kremlin has seemingly developed a keen interest in America's computer systems, it has denied any wrongdoing.
- Technical Pre Sales Consultant
- Greater London
- £65,000 Base + Bonus + Package
A Technical Pre Sales Consultant, with a focus on cybersecurity, is needed to join a specialist security services business in the Greater London area. This is a perfect opportunity for anyone looking to retain their technical hands-on skills and step into a presales position. CURRENT hands-on experience is essential as this role will be split between professional services and presales. The Technical Pre Sales Consultant must have current experience working within the cybersecurity industry and have experience engaging with clients face to face. Any experience with scoping, high-level design, proof of concept (hands-on), RFI, RFQ etc is highly desirable Must be commutable to West London. Current technology experience with any of the following vendors such as Check Point, Palo Alto, Varonis, Fortinet, F5, Bluecoat etc. Apply today for more information, all details kept in the strictest of confidence. Key skills: Presales, Pre Sales, Security Presales, Network Security, Managed Security Services Ref CH7538
- Data Centre Presales Engineer
- Up to £47,000 Base + Bonus
A Data Centre Presales Engineer is needed to join a leading Data Centre business in London. The Data Centre Presales Engineer will be responsible for; Sales Support, Stakeholder engagement (presentations etc.), RFI / RFQ, High-level technical architecture & support etc. This role is client-facing so expect some travel but only across London. Requirements Current presales experience within an IT managed services role. Current experience with Data Centre technology would be extremely beneficial but other experience in industries such as; telecommunications, cloud, unified communications etc. is required. MUST be commutable to London. Ref PG7543
- Senior Identity and Access Management Architect
- Up to €85,000 Base + Package
Senior Identity and Access Management Architect (IDAM) subject matter expert is needed to lead and drive technical and or business transformation projects in a client-facing position for a prestigious consultancy in Frankfurt, Germany. Broad technical knowledge across Identity and access management is essential. Technical hands-on experience with one or more of the following core areas; Privileged Access Management (PAM, CyberArk, Beyondtrust, Thycotic) Identity Governance Administration (IGA, Sailpoint, Omada, RSA) Customer Identity & Access Management (CIAM, Forgerock PSD2) Fluent German is a MUST (Written & Speaking) A successful individual will be client-facing and MUST have strong exposure in previous positions designing and implementing Identity and Access Management solutions, this will be a hands-on position, working directly with the functional consultant and support teams If you are passionate about your industry and specialise in the IDAM space and are looking for a new challenge to step up, apply today and speak with the Security team. Candidate must be Germany or EU based (must want to relocate to Germany) Ref: TC7153
- Functional Identity & Access Management Consultant
- Up to €100,000 Base + Package
My Client, a leading international consultancy firm are currently in the process of expanding their Identity & Access management practice across each of their 3 sectors. Working with Large FTSE 500 companies on interesting technical / Business Transformation projects. The Identity & Access Management Consultant will be the key head in deriving and understanding business cases, consulting with the client to truly understand the needs of the business and suggest a solution of best fit. A deep understanding of business protocols, risks, as well as a strong understanding of Identity & Access management is essential to be successful in this position. Working in one of the following three IAM practices, The Identity & Access Management Consultant will need to have strong knowledge in at least one of the following; Privileged Access Management (PAM, CyberArk, Beyondtrust, Thycotic) Identity Governance Administration (IGA, Sailpoint, Omada, RSA) Customer Identity & Access Management (CIAM, Forgerock PSD2) Fluent German (Speaking & Writing) Current experience within a client-facing role, working with Identity & Access Management solutions is essential, my client are one of the leading partners in the space, hence why I am looking to speak with the best of the best. If you are passionate about your industry and specialise in the IDAM space and are looking for a new challenge to step up, apply today and speak with the Security team. Candidate must be Germany or EU based (must want to relocate to Germany) Ref TC7542