Feeds

World's power-grid cyber breach traced to notorious Chinese crew

Telvent pulls plug on networks after shock raid

Combat fraud and increase customer satisfaction

An espionage attack on Telvent - the maker of power-grid control systems and smart meters - has been linked to a prolific Chinese hacking crew.

Telvent, a division of Schneider Electric, has admitted hackers breached its corporate network, implanted malicious software and lifted sensitive project files. The raid spanned Telvent systems in the US, Canada and Spain according to a letter sent to the company's customers this month.

Criminals can now study the documents for vulnerabilities in the systems, and potentially devise attacks to sabotage nations' electricity distribution networks.

Telvent boasts that it has "built a customer base second to none in the energy industry", adding: "Our systems now manage over 60 percent of the total hydrocarbon movements in North and Latin America and control transmission and distribution of over 140,000 GWh through worldwide electrical grids."

Investigative reporter Brian Krebs, who first revealed the breach, said the blueprints described Telvent's OASyS SCADA [supervisory control and data acquisition] product, a technology that offers power companies a means to bridge legacy systems to next-generation "smart grids".

Clues such as references to particular domain names and malware left behind by the spies match the digital fingerprints of a Chinese hacking crew called the Comment Group, which is linked to previous cyber-espionage campaigns, according to researchers at Dell SecureWorks.

Telvent has cut data links between at-risk portions of its internal network and clients' systems as a precaution while it probes the breach. Police have been called in to investigate the attack, according to this statement supplied to Sophos:

Telvent is aware of a security breach of its corporate network that has affected some customer files. Customers have been informed and are taking recommended actions, with the support of Telvent teams. Telvent is actively working with law enforcement, security specialists and its affected customers to ensure the breach has been contained.

Dale Peterson, founder and chief of industrial control security specialist Digital Bond, spelled out the kinds of information present in the lifted documents.

"Some project files contain the 'recipe' for the operations of a customer, describing calculations and frequencies at which systems run or when they should be turned on or off," he told WiReD.

"If you're going to do a sophisticated attack, you get the project file and study it and decide how you want to modify the pieces of the operation. Then you modify the project file and load it [onto a company's control system], and they're not running what they think they're running." ®

SANS - Survey on application security programs

Whitepapers

Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.