Newsletters
News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
APC Free White Paper
Optimize your network investment &
Enter to win a Samsung Galaxy Note

www.apc.com
World Wide Web
Real-time info services with Neustar
Average Rating:
Rate this article:  
Malware Discovered at Two U.S. Power Plants
Malware Discovered at Two U.S. Power Plants

By Jennifer LeClaire
January 16, 2013 2:15PM

    Bookmark and Share
Initial reports from ICS-CERT on the infections at two U.S. power plants indicate they were likely to be widely available pieces of malware not specifically designed to target supervisory control and data acquisition (SCADA) environments, said security researcher Dave Pack. That said, he added, the malware was still disruptive.
 



There has long been talk of fears of cyber criminals attacking the power grid. Well, those fears came a little closer to reality this week.

The U.S. Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) reports malware infected two U.S. power stations in the fourth quarter of 2012.

According to ICS-CERT, the malware was discovered when an employee asked company IT staff to inspect his USB drive after experiencing intermittent issues with the drive's operation. The employee routinely used this USB drive for backing up control systems configurations within the control environment.

The Tainted USB Drive

"When the IT employee inserted the drive into a computer with up-to-date antivirus software, the antivirus software produced three positive hits," the ICS-CERT said in a report. "Initial analysis caused particular concern when one sample was linked to known sophisticated malware."

The conclusion: a handful of machines likely had contact with the tainted USB drive. ICS-CERT immediately examined the machines. Drive images were taken for in-depth analysis. ICS-CERT said it also performed preliminary on-site analysis of those machines and discovered signs of the sophisticated malware on two engineering workstations, both critical to the operation of the control environment.

ICS-CERT blamed one of the infections on a third-party contractor who unknowingly infected systems at a power generation facility after plugging in a USB drive that was infected. That unleashed a crime-ware virus into a turbine control system that spread to about 10 other networked machines.

Stuxnet-Like Attacks?

Dave Pack, director of Labs for the security firm LogRhythm, told us it was too early to tell whether these were targeted Stuxnet-like attacks. Initial reports, he said, indicate they are more likely to be widely available pieces of malware not specifically designed to target supervisory control and data acquisition (SCADA) environments. That said, he added, the malware was still disruptive, in one case delaying a plant restart by approximately three weeks.

"USB drives and removable media continue to be an excellent attack vector for malware," Pack said. "In cases like this, where an ICS/SCADA-like infrastructure is air gapped and removable media must be frequently used to support operations, it's important that organizations include security into their processes and procedures to ensure nothing malicious is inadvertently being introduced into the environment."

In his opinion, removable media used in operations like this should be frequently scanned for malware. What's more, he offered, strict policies should be put in place and enforced to control how the media is stored and used.

"Even with the best policies, procedures and preventive technologies in place, breaches will occur," Pack said. "Having continuous monitoring in place designed to detect anomalous activity indicating that a system or credentials have been compromised can mean the difference between rapid containment and remediation, or catastrophe."
 

Tell Us What You Think
Comment:

Name:

NTObjectives:

Posted: 2013-01-25 @ 10:59am PT
Wow, Mr. Pack really summed it up in that last line. Especially at this level, continuous monitoring of web application security is imperative.

Gautie:

Posted: 2013-01-17 @ 6:10am PT
Hmm... they should've an antivirus present on their systems... or perhaps the third-party technician had to immunize their USB. There are some good antivirus reviews & security advice on http://anti-virus-reviews.net/, should anyone be interested to tighten their security and prevent something like this to happen.



Neustar, Inc. (NYSE: NSR) is a trusted, neutral provider of real-time information and analysis to the Internet, telecommunications, information services, financial services, retail, media and advertising sectors. Neustar applies its advanced, secure technologies in location, identification, and evaluation to help its customers promote and protect their businesses. More information is available at www.neustar.biz.


 World Wide Web
1.   New Technology Defeats Privacy Efforts
2.   Verizon Launches Rewards Program
3.   Social Media Feeds Rare Syndrome
4.   NY Proposes Virtual Currency Rules
5.   Visa Intros Online Payment Service


advertisement
Radical.FM's Freemium Biz Model
Online radio startup asks for donations.
Average Rating:
Facebook Social Experiment Irks Us
Secretive test was legal, but ethical?
Average Rating:
New Technology Defeats Privacy Efforts
Study identifies 3 browser techniques.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
34 European Banks Hit by Android-Skirting Malware
Criminals have been finding gaping holes in Android-based two-factor authentication systems that banks around the world are using. The result: 34 banks in four European countries have been hit.
 
New Web Tracking Technologies Defeat Privacy Protections
Recently developed Web tracking tools are able to circumvent even the best privacy defenses, according to a new study by researchers at Princeton and the University of Leuven in Belgium.
 
Juniper DDoS Solution Aims at High-IQ Networks
In the face of more complex attacks, Juniper Networks is boosting its DDoS Secure solution to help companies mitigate the threats with more effective security intelligence throughout the network fabric.
 

Enterprise Hardware Spotlight
Contrary to Report, Lenovo's Staying in Small Windows Tablets
Device maker Lenovo has clarified a report that indicated it is getting out of the small Windows tablet business -- as in the ThinkPad 8 and the 8-inch Miix 2. But the firm said it is not exiting that market.
 
Seagate Unveils Networked Drives for Small Businesses
Seagate is out with five new networked attached storage products aimed at small businesses. The drives are for companies with up to 50 workers, and range in capacity from two to 20 terabytes.
 
Another Day, Another Internet of Things Consortium Is Born
In the emerging Internet of Things, zillions of devices will be talking to each other. Samsung, Intel and Dell just formed a consortium to ensure each thing can understand what others are saying.
 

Mobile Technology Spotlight
Apple Patent for Smart Watch Comes to Light
Does a new smart watch patent issued to Apple provide a preview of the expected wearable from the tech giant? Some Apple-watchers are parsing the patent for signs of the coming product.
 
Will iPhone 6 Cannibalize Apple's Tablet Sales?
Could Apple’s iPhone 6 -- it’s so-called super-size phone due to hit store shelves this fall -- come back to haunt the smartphone maker? Some observers say yes; others say preposterous.
 
Axed Nokia X Phones Suffered from Lack of Identity
So long, Nokia X, we hardly knew you. The Nokia X phones Microsoft discontinued blend two rival operating systems, but leave out the best of each. As a result, the devices didn't become a runaway hit.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | Small Business | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.