Researcher spots spike in traditional financial malware hitting ICS/SCADA networks -- posing as popular GE, Siemens, and Advantech HMI products.
A renowned ICS/SCADA security researcher has discovered a surprising twist in cyberattacks hitting plant floor networks: traditional banking Trojan malware posing as legitimate ICS software updates and files rather than the dreaded nation-state custom malware in the wake of Stuxnet.
Kyle Wilhoit, senior threat researcher with Trend Micro, recently found 13 different types of crimeware versions disguised as human machine interface (HMI) products Siemens Simatic WinCC, GE Cimplicity, and Advantech device drivers and other files. The attacks appear to be coming from traditional cybercriminals rather than nation-state attackers, and are not using cyber espionage-type malware.
"It's an interesting trend -- traditional banking Trojans, not targeted attacks," Wilhoit says.
The ICS/SCADA community has been understandably on alert for the next Stuxnet-type attack, and recent discoveries of malware such as Havex and BlackEnergy, both of which have been detected targeting that environment, have put these types of nation-state, targeted attacks in focus.
But Wilhoit says his findings show that traditional cybercriminals are looking for targets in the ICS/SCADA world, and likely for money-making rather than spying or sabotage purposes. "So to succeed in attacking SCADA, you don't have to necessarily be targeted in nature... The ultimate end goal here is probably not industrialized espionage, but to get banking credentials" or other financially lucrative information, he says.
There's a reason that power companies are attacking rooftop solar across the nation: They see those silicon panels as nothing short of an existential threat. As the cost of solar continues to fall, and more people opt for the distributed power offered by solar, there will be less demand for big power plants and the utilities that operate them. And one major investment giant has now released three separate reports arguing that Tesla Motors is going to help kill power companies off altogether.
Earlier this year, Morgan Stanley stirred up controversy when it released a report that suggested that the increasing viability of consumer solar, paired with better battery technology—that allows people to generate, and store, their own electricity—could send the decades-old utility industry into a death spiral. Then, the firm released another one, further emphasizing the points made in the first. Now, it's tripling down on the idea with yet another report that spells out how Tesla and home solar will "disrupt" utilities.
“There may be a 'tipping point' that causes customers to seek an off-grid approach," the March report argued. "The more customers move to solar, the [more the] remaining utility customers' bills will rise, creating even further 'headroom' for Tesla’s off-grid approach.”
Yes, Tesla Motors, everyone's favorite electric car company. And that's where the controversy comes in. Morgan Stanley breathlessly pegged Tesla as “the most important auto company in the world" in part because its electric car business was pushing it to develop better energy storage technology, and then mass manufacture said batteries. That's exactly what Tesla CEO Elon Musk and company will be doing at its forthcoming Gigafactory, which it is building in the Southwest with Panasonic.
With the new manufacturing facility, Morgan Stanley reasons, Tesla stands to double its business (adding another $2 billion in revenue) by selling the lithium ion batteries it typically ships under the hood of a Model S to homeowners with solar panels, too. If consumers can store energy the panels generate during the day for use at night, it would ostensibly render the need for utilities to pipe in faraway power—and their electric bills—obsolete.
At the end of his first year in office, President Obama made a bold promise: the United States would cut its greenhouse gas emissions substantially by 2020.
Unfortunately it was a risky pledge that hinged on Congress. After President Obama was unable to get his major climate change proposal through Congress in his first term, it seemed as though his pledge to the rest of the World and planet Earth might disintegrate into thin air.
But today, President Obama announced plans to bypass Congress entirely. By using his executive authority under the Clean Air Act, he proposed an Environmental Protection Agency regulation to cut carbon pollution from the nation’s power plants 30 percent from 2005 levels by 2030. It’s one of the strongest actions ever taken by the United States government to fight climate change.
“The shift to a cleaner-energy economy won’t happen overnight, and it will require tough choices along the way,” President Obama said Saturday in his weekly radio and Internet address, previewing Monday’s announcement. “But a low-carbon, clean-energy economy can be an engine of growth for decades to come. America will build that engine. America will build the future, a future that’s cleaner, more prosperous and full of good jobs.”
Ralph Langner is one of the foremost experts on the security of critical infrastructure that we have. So, generally, when Ralph says something – whether its about Stuxnet, or cyberwar or the security of nuclear power plants – folks listen.
And these days, Ralph is wondering, out loud, whether our reliance on digital systems to manage critical infrastructure has gone too far. The answer, he suggests, may be to go “back to the future,” as it were: reintroducing analog systems into the control process chain as a backstop for cyber attacks.
Case in point: the Department of Homeland Security’s ICS-CERT warned on Friday that firmware for Siemens SIMATIC S7-1500 CPUs (Central Processing Units) contain nine vulnerabilities that could enable attacks such as cross site request forgery, cross site scripting and URL redirection. (Siemens has issued a firmware update that patches the holes.)
Langner is among the world’s foremost experts on control systems security, notes that the critical infrastructure sector. He was among the first to suggest (publicly) that the Stuxnet worm was a targeted, nation-backed attack on Iran’s nuclear enrichment program.
Writing on Saturday, he said that the critical infrastructure sector is in a headlong rush to replace aging, analog control system infrastructure with modern, digital systems. Software based control infrastructure, he notes, offers many advantages – flexibility, the possibility of remote operation and management and access to a much larger pool of talent and expertise. Engineers who understand and can manage analog systems are, after all, a dying breed – literally.
Back in 2011, President Obama set the ambitious goal of having 1 million electric vehicles on US roads by 2015. Whether automakers will hit this target is the subject of much debate. But the possibility of the widespread adoption of electric vehicles raises an interesting problem.
It’s easy to imagine the number of electric cars increasing but it’s much harder to see the electricity generating capacity increasing the same rate at the same time. Generating capacity will eventually catch up with this extra demand. But in the meantime, how can all these cars be charged?
Having a friendly chat with a group of Tesla owners in Norway, brand CEO Elon Musk intimated that more-powerful batteries could be on the way for the Model S. The most potent battery pack currently offered in the Model S holds 85 kWh of juice, or enough for 265 miles of driving.
