No big deal... Kremlin hackers 'jumped air-gapped networks' to pwn US power utilities
The US Department of Homeland Security is once again accusing Russian government hackers of penetrating America's critical infrastructure.
Uncle Sam's finest reckon Moscow's agents managed to infiltrate computers networks within US electric utilities – to the point where the miscreants could have virtually pressed the off switch in control rooms, yanked the plug on the Yanks, and plunged America into darkness.
The hackers, dubbed Dragonfly and Energetic Bear, struck in the spring of 2016, and continued throughout 2017 and into 2018, even invading air-gapped networks, it is claimed.
This seemingly Hollywood screenplay emerged on Monday in the pages of the Wall Street Journal (paywalled) which spoke to Homeland Security officials on the record.
The Energetic Bear aka Dragonfly crew – fingered in 2014 by Crowdstrike and Symantec – was inside “hundreds” of power grid control rooms by last year, it is claimed. Indeed, since 2014, power companies have been warned by Homeland Security to be on the look out for state-backed snoops – with technical details on intrusions published here.
The Russians hacked into the utilities' equipment vendors and suppliers by spear-phishing staff for their login credentials or installing malware on their machines via boobytrapped webpages, it is alleged.
The miscreants then leveraged their position within these vendors to infiltrate the utilities and squeeze into the isolated air-gapped networks in control rooms, it is further alleged. The hacker crew also swiped confidential internal information and blueprints to learn how American power plants and the grid system work.
We're told, and can well believe, that the equipment makers and suppliers have special access into the utilities' networks in order to provide remote around-the-clock support and patch deployment – access that, it seems, turned into a handy conduit for Kremlin spies.
The attacks are believed to be ongoing, and some utilities may not yet be aware they've been pwned, we were warned. It is feared the stolen information, as well as these early intrusions, could be part of a much larger looming assault.
“They got to the point where they could have thrown switches,” Jonathan Homer, chief of industrial control system analysis for Homeland Security, told the paper.
The Register will watch developments, however, caution is probably a useful prescription at this stage.
After all, an attack on the American grid reported in late 2016 turned out to be far less than was first feared: it was one infected laptop in a relatively small operator, Burlington Electric, and the attack didn't reach control systems.
Infrastructure security expert Robert Lee has a level-headed thread, here, on Twitter. "In short, please take cyber threats to industrial infrastructure serious," he said. "They are getting far more aggressive and numerous. But let’s not use word choices that mislead and hype up the issue. It’s bad enough without added fear."
While the Kremlin has seemingly developed a keen interest in America's computer systems, it has denied any wrongdoing.
- Application Security Analyst
- Up to £85,000 Base
An Application Security Analyst is needed for an innovative commercial organisation in London. The Application Security Analyst will be working closely with the development team and should possess a blend of application security, development languages and Information Security skills. Application Security Analyst MUST have strong interpersonal skills. The Application Security Analyst role will include, but in no way be limited to; designing solutions to maintain security, whilst incorporating design solutions in Development, DevOps and Architectural best practices. Conduct application-level penetration testing and review security architecture of Product suite. Executing projects to implement a Security strategy. Knowledge / Experience should include; penetration testing consultancy, source code reviews, vulnerability management and security assessments. Experience with the following is desirable: Agile Development, Fortify 360 SCA, IBM Rational AppScan and exposure to security industry standards - ISO27001 and PCI-DSS. The ideal candidate will have 3 years’ experience in a similar Information Security role and have relevant security qualifications - CISM / CISSP or CISA etc. This is a client facing opportunity where you will be expected to travel to customer sites. Reference Number: OG7484 (Application Security, Penetration Testing, Information Security)
- Cloud Network Engineer
- Up to £35,000 Base + Bonus + Possible Share Options
One of our clients, an exciting UK based start-up is on the lookout for a Cloud Network Engineer in Yorkshire. The Cloud Network Engineer will need current CCNA / CCNP level networking experience (Cisco, BGP, IP etc.), cloud networking understanding (Azure, AWS etc.) and current experience ideally within a client facing / consultancy role. (Cloud Engineer, Network Engineer, Azure, AWS, Amazon Web Services) Reference Number: PG7477
- Senior Service Desk Analyst
- Up to £32,000 Base + £6,400 Shift Allowance
We are currently working on behalf of an IT Service Provider based in Wiltshire who are on the lookout for a Senior Service Desk Analyst. The Senior Service Desk Analyst will be responsible for logging, managing and escalating internal & external incidents and requests. This is an excellent opportunity to join a business recognised for what they do and work with a number of top UK businesses. You’ll be able to manage your career development and gain additional training e.g. certifications etc. This role will include a shift (4 days on then 4 days off) which covers 24/7 12 hour shifts The ideal candidate will be currently working in a IT service desk / IT support role ideally in an IT Services business. Reference Number: PG7476 (Service Desk Administrator, Analyst, Support, Service Desk Support, shift work, traning, Information Technology, Customer service, Customer support)
- Data Centre Service Delivery Manager
- Up to £50,000 + Package
A Data Centre Service Delivery Manager is needed to join a specialist connectivity provider in Hertfordshire. The company is going through a huge growth programme and this is an excellent opening for someone to join a business who are working with globally recognised organisations. You’ll be responsible for: Supporting the Commercial Director with management of existing and potential customers being the main point of contact. Maintaining and improving the company’s current and new services Customer relationship management Attending customer meetings in order to provide guidance to customers Keeping up a high quality level of service Updating appropriate documentation such as policy and procedures and making sure these are in place and followed Change and Incident management Service Level Agreements Experience required Must have current experience working in a Data centre environment in a Service Delivery role. An understanding of Data Centre technology and terminology. Experience of dealing with people of all levels within a business (Engineers to Board level) In return you'll have the ability to work in a cutting edge environment and work with a variety of well known international clients REF: PG7475