Later On

A blog written for those whose interests more or less match mine.

An Indian nuclear power plant suffered a cyberattack

leave a comment »

Debak Das reports in the Washington Post about a cyberattack that portends the future:

The Nuclear Power Corporation of India Limited (NPCIL) has now confirmed that there was a cyberattack on the Kudankulam Nuclear Power Plant (KKNPP) in Tamil Nadu, India, in September. The nuclear power plant’s administrative network was breached in the attack but did not cause any critical damage. KKNPP plant officials had initially denied suffering an attack and officially stated that KKNPP “and other Indian Nuclear Power Plants Control Systems are stand alone and not connected to outside cyber network and Internet. Any Cyber attack on the Nuclear Power Plant Control System is not possible.”

So what really happened at Kudankulam? Here’s what you need to know.

1. The nuclear power plant and the cyberattack

The KKNPP is the biggest nuclear power plant in India, equipped with two Russian-designed and supplied VVER pressurized water reactors with a capacity of 1,000 megawatts each. Both reactor units feed India’s southern power grid. The plant is adding four more reactor units of the same capacity, making the Kudankulam Nuclear Power Plant one of the largest collaborations between India and Russia.

According to the NPCIL statement, the malware attack on KKNPP was noticed Sept. 4 by the CERT-In (Indian Computer Emergency Response Team), which is the national agency for responding to cybersecurity incidents. An investigation by India’s Department of Atomic Energy revealed that a user had connected a malware-infected personal computer to the plant’s administrative network. While the plant’s operational network and systems are separate from and not connected to the administrative network, one newspaper reported that there may have been a second “more serious” target.

VirusTotal, a virus scanning website owned by Google’s parent company, Alphabet, has indicated that a large amount of data from the KKNPP’s administrative network has been stolen. If this is true, subsequent attacks on the nuclear power plant could target its critical systems more effectively. Cyberattacks on nuclear power plants could have physical effects, especially if the network that runs the machines and software controlling the nuclear reactor are compromised. This can be used to facilitate sabotage, theft of nuclear materials, or — in the worst-case scenario — a reactor meltdown. In a densely populated country like India, any radiation release from a nuclear facility would be a major disaster.

China’s and India’s leaders met again this month. Here’s what you need to know about Sino-Indian relations.

2. Isolating the computer network from the Internet won’t protect against a targeted attack

In its initial denial, the NPCIL stated, “Any cyberattack on the Nuclear Power Plant Control System is not possible.” The KKNPP site director went on record stating that “the totally isolated network of KKNPP could not be accessed by any outside network from any part of the globe. Hence there was no question of it being hacked.” Even the second NPCIL statement emphasizes that “the critical internal network” was isolated from the administrative one, and by implication, the Internet.

This physical isolation of a computer or a local network from the Internet to prevent any outside breach is called an “air gap.” However, this security strategy can leave a nuclear plant quite vulnerable. The NPCIL’s statement, thus, reflects either a complacency about the cybersecurity of Indian nuclear power plants or ignorance of its network’s vulnerabilities.

Air-gapped nuclear facilities can be attacked. Air gaps can be effective against unsophisticated and untargeted cyberthreats — but not against targeted attacks. As the Nuclear Threat Initiative states in its 2016 report on cyberthreats to nuclear facilities, targeted attacks go beyond network connections and generally leverage “witting or unwitting humans, or a long and difficult-to-defend supply chain, to deliver the attack.” Another report by the Fissile Materials Working Group (a coalition of global civil society organizations) highlights that in practice, “organizations must transfer data into and out of their operational networks for a variety of reasons.” For instance, new data has to enter an air-gapped operational network to update the software and hardware in the network. That exposes the critical internal network in a nuclear power plant to a host of vulnerabilities. Most famously, the Stuxnet attack penetrated Iran’s air-gapped Natanz uranium enrichment facility.

The Iran nuclear deal isn’t so great — for Iran

3. Did North Korea launch the attack?

Some researchers suggest that the KKNPP attack was caused by a variant of the DTRACK virus, developed by the North Korea-linked Lazarus group. The NPCIL has not challenged these claims. India maintains good diplomatic and economic relations with North Korea, so if Pyongyang did sponsor the attack, expect a diplomatic fallout.

However, tracing a cyberattack to North Korea won’t be easy. Studies indicate that most state-sponsored North Korean cyberoperations are perpetrated from abroad. Nearly one-fifth are launched from India, where North Korea nationals have a considerable presence. North Korean students are present in India’s universities and other centers of higher education. The Indian Technical and Economic Cooperation program trains many North Korean students in India across several technical fields. This means that a cyberattack from North Korea could even originate from Indian territory.

In the past, North Korean cyberactivity has targeted the Indian Space Research Organization’s Institute’s National Remote Sensing Center and the Indian National Metallurgical Laboratory, and conducted network reconnaissance on laboratories and research centers. The use of humans, rather than network connections, to bypass an air gap in Indian critical infrastructure by North Koreans or their associates, hence cannot be ruled out. The malware that attacked the KKNPP system was reportedly custom-built for the nuclear power plant’s IT systems. That suggests that such a breach by an insider to the nuclear power plant may have happened already.

4. Could such attacks lead to military escalation? . . .

Continue reading.

Written by LeisureGuy

4 November 2019 at 8:10 pm

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.