Threat Analysis of BlackEnergy Malware for Synchrophasor based Real-time Control and Monitoring in Smart Grid

Abstract

The BlackEnergy malware targeting critical infrastructures has a long history. It evolved over time from a simple DDoS platform to a quite sophisticated plug-in based malware. The plug-in architecture has a persistent malware core with easily installable attack specific modules for DDoS, spamming, info-stealing, remote access, boot-sector formatting etc. BlackEnergy has been involved in several high profile cyber physical attacks including the recent Ukraine power grid attack in December 2015. This paper investigates the evolution of BlackEnergy and its cyber attack capabilities. It presents a basic cyber attack model used by BlackEnergy for targeting industrial control systems. In particular, the paper analyzes cyber threats of BlackEnergy for synchrophasor based systems which are used for real-time control and monitoring functionalities in smart grid. Several BlackEnergy based attack scenarios have been investigated by exploiting the vulnerabilities in two widely used synchrophasor communication standards: (i) IEEE C37.118 and (ii) IEC 61850-90-5. Specifically, the paper addresses reconnaissance, DDoS, man-in-the-middle and replay/reflection attacks on IEEE C37.118 and IEC 61850-90-5. Further, the paper also investigates protection strategies for detection and prevention of BlackEnergy based cyber physical attacks.

Smart Grid Metering Networks: A Survey on Security, Privacy and Open Research Issues

“…Back office compromise mitigations: Recently, back office has been compromised using the potential malware, e.g., BlackEnergy, as shown in [55], [98]. Such attack could affect the end-user data and normal back office operations in SG metering networks, e.g., billing, credit rating, and so on [131].…”

“…In order to mitigate back office threats in SG, Khan et al [98] suggested protection strategies against the back office compromise attacks with a particular focus on the BlackEnergy malware, as follows. (i) Black and white listing connections: In this, the external Internet Protocol (IP) addresses can be listed as a black-list (i.e., untrusted source) and white-list (i.e., trusted source).…”

“…Summary: In Table VIII, we summarize all the proposed countermeasures for the radio takeover [128] [96], credential compromise [130] [97], and back office compromise [98] in the terms of applications, communication mode (i.e., wireless/wired), involved entities, test-bed/simulation, security and privacy goals, and descriptions with pros and cons.…”

“…Back office compromise mitigations -Khan et al suggested many ways to mitigate back office compromise attacks for real-time controlling and monitoring in SG [98]. Few of the mitigation mechanisms are: black and white listing, and inbound/outbound monitoring.…”

Will Systems‐of‐systems Models Support Cost Recovery for Critical Infrastructure Resiliency?

“…Concerns about vulnerabilities of other electric grids resulted. (Khan et al 2016). FERC ordered additional cyber protections for control centers duties (Order 822 2016) and future protection of cyber supply chains (Order 829 2016).…”