Alert: Major cyber attack aimed at natural gas pipeline companies

A major cyber attack is currently under way aimed squarely at computer networks belonging to US natural gas pipeline companies, according to alerts issued to the industry by the US Department of Homeland Security.

At least three confidential "amber" alerts – the second most sensitive next to "red" – were issued by DHS beginning March 29, all warning of a "gas pipeline sector cyber intrusion campaign" against multiple pipeline companies. But the wave of cyber attacks, which apparently began four months ago – and may also affect Canadian natural gas pipeline companies – is continuing.

That fact was reaffirmed late Friday in a public, albeit less detailed, "incident response" report from the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), an arm of DHS based in Idaho Falls, Idaho. It reiterated warnings in the earlier confidential alerts made directly to pipeline companies and some power companies.

The ICS-CERT is charged with helping secure the nation's industrial control systems – computerized systems that open and close valves, switches, and factory processes vital to the chemical, industrial, and power sectors. Their "fly away" teams visit factories, power plants, and pipeline companies to investigate cyber intrusions.

"ICS-CERT has recently identified an active series of cyber intrusions targeting natural gas pipeline sector companies," the confidential April 13 alert warns. "Multiple natural gas pipeline organizations have reported either attempts or intrusions related to this campaign. The campaign appears to have started in late December 2011 and is active today."

Safeguarding industrial control systems from cyber attack is a major point of debate right now in Congress, which has been wrangling over whether to grant the federal government authority to require that vital sectors like the electric utility, oil and gas, and chemical industries meet certain levels of cyber security.

Approximately 200,000 miles of these interstate natural gas transmission pipelines in the US supply 25 percent of the nation's energy. Pipeline safety has been a major issue in recent years, highlighted by the San Bruno, Calif. pipeline explosion that killed eight people and destroyed 38 homes in the Bay Area in September 2010.

In Friday's public warning, ICS-CERT reaffirms that its "analysis of the malware and artifacts associated with these cyber attacks has positively identified this activity as related to a single campaign from a single source." It goes on to broadly describe a sophisticated "spear-phishing" campaign – an approach in which cyber attackers attempt to establish digital beachheads within corporate networks.

Spear-phishing has become one of the attack vectors of choice for cyber spies intent on infiltrating corporate networks. In such an attack, a specific person in the organization is researched, often using social networking sites like Facebook or LinkedIn in order to carefully craft a convincing e-mail that appears to be from a close associate.

But the seemingly benign e-mail typically contains a malicious software attachment or link. Once clicked on or opened, the malware or link creates a back-door for a hacker to then gain entry and begin prowling for valuable data.

Yet there are several intriguing and unusual aspects of the attacks and the US response to them not described in Friday's public notice. One is the greater level of detail in these alerts than in past alerts. Another is the unusual if not unprecedented request to leave the cyber spies alone for a little while.

Each of the three alerts, for instance, includes detailed descriptions of the cyber threat – much more detailed than previous ICS-CERT warnings over the years, say cyber security experts who have seen the alerts. Those private warnings included computer file names, computer IP addresses, and other key information that a company's cyber security experts could use to check to see if their networks have been infiltrated.

"This was far more detail than we've ever received in the past – and the number of alerts in succession was unusual," says one security expert who requested anonymity because he was sharing sensitive material. "It indicated to me this was pretty serious."

Amazingly, he says, companies were also specifically requested in a March 29 alert not to take action to remove the cyber spies if discovered on their networks, but to instead allow them to persist as long as company operations did not appear to be endangered.

"In essence they were saying: 'Do not put in any mitigation or blocks against these active intruders,’ " says the individual who has seen all three confidential alerts. "But if you're telling an investor-owned utility not to do anything, that's pretty unheard of. Step 1 is always block these guys and get them off the system. It's pretty unusual in the commercial world to just let them collect data. Heaven forbid that the intruders gain control. It kind of looks like our intel guys were trying to get more information."

Beyond indicating that multiple companies were targeted and some other systems compromised, neither the alerts nor the public notice indicate just how many companies have been infiltrated. The documents also do not indicate that any companies' pipeline operations – or their vital computerized industrial control systems that run pumps – have yet been affected.

But other cyber security experts familiar with the alerts warn that access to a company's corporate system can eventually allow a hacker to wind through a corporate network and into the vital industrial control processes. Those systems, if infiltrated, could allow hackers to manipulate pressure and other control system settings, potentially reaping explosions or other dangerous conditions.

"There's not enough information available yet to tell exactly what is the target or goal here," says Jonathan Pollet, founder of Red Tiger Security, who specializes in industrial control system security and who has worked extensively in the oil and gas industry. "But it's a concern because if they access the corporate network it's often just a short step to the next level and right into their control system network."

One reason ICS-CERT may have acted, he believes, is because of the large number of companies discovering attackers on their networks. As many as 20 companies have already come forward to tell ICS-CERT of the infiltrations, Mr. Pollet says. That number could not be independently verified. A DHS spokesman was unavailable to comment at press time Saturday.

Even so, there is at least some support for Pollet's assertion.

Sanaz Browarny, chief, intelligence and analysis, of the control systems security program at DHS, told a security conference last month that “on a daily basis, the U.S. is being targeted.” In her presentation, as reported in Homeland Security News Wire, she said that ICS-CERT’s response team had taken 17 trips to private utilities last year, seven of those as a direct result of sophisticated spear-phishing attacks. She did not, however, indicate the attacks were against a specific type of utility.

There are also signs the threat could extend across North America. A Canadian cyber security expert told the Monitor that authorities in his country also are on alert since the US warnings, although it is not clear if any Canadian companies are affected, he said.

 At least one confidential US alert, a portion of which was obtained by the Monitor, urged companies to remain on guard – and send back information.

"ICS-CERT has received additional reports involving targeted and compromised organizations within the gas pipeline sector," according to the April 13 alert. "Analysis from those reports, including the analysis of hard drives and logs, has yielded new indicators of compromise…. Organizations are strongly encouraged to review this report and contact ICS-CERT to report their findings."