Major cyber attack aimed at natural gas pipeline companies
Excerpted from Christian Science Monitor:
A major cyber attack is currently underway aimed at computer networks belonging to US natural gas pipeline companies, according to alerts issued by the US Department of Homeland Security.
At least three confidential “amber” alerts – the second most sensitive next to “red” – were issued by DHS beginning March 29, all warning of a “gas pipeline sector cyber intrusion campaign” against multiple pipeline companies. But the wave of cyber attacks, which apparently began four months ago – and may also affect Canadian natural gas pipeline companies – is continuing.
That fact was reaffirmed late Friday in a public, albeit less detailed, “incident response” report from the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), an arm of DHS based in Idaho Falls. It reiterated warnings in the earlier confidential alerts made directly to pipeline companies and some power companies.
The ICS-CERT is charged with helping secure the nation’s industrial control systems – computerized systems that open and close valves, switches and factory processes vital to the chemical, industrial, and power sectors. Their “fly away” teams visit factories, power plants, and pipeline companies to investigate cyber intrusions.
“ICS-CERT has recently identified an active series of cyber intrusions targeting natural gas pipeline sector companies,” the confidential April 13 alert warns. “Multiple natural gas pipeline organizations have reported either attempts or intrusions related to this campaign. The campaign appears to have started in late December 2011 and is active today.”
Approximately 200,000 miles of these interstate natural gas transmission pipelines in the US supply 25 percent of the nation’s energy. Pipeline safety has been a major issue in recent years, highlighted by the San Bruno, Calif. pipeline explosion that killed eight people and destroyed 38 homes in the Bay Area in September 2010.
In yesterday’s public warning, ICS-CERT re-affirms that its “analysis of the malware and artifacts associated with these cyber attacks has positively identified this activity as related to a single campaign from a single source. It goes on to broadly describe a sophisticated “spear-phishing” campaign – an approach in which cyber attackers attempt to establish digital beachheads within corporate networks.
See more of the story here