Original URL: https://www.theregister.com/2012/09/28/telvent_hack/

World's power-grid cyber breach traced to notorious Chinese crew

Telvent pulls plug on networks after shock raid

By John Leyden

Posted in Security, 28th September 2012 16:28 GMT

An espionage attack on Telvent - the maker of power-grid control systems and smart meters - has been linked to a prolific Chinese hacking crew.

Telvent, a division of Schneider Electric, has admitted hackers breached its corporate network, implanted malicious software and lifted sensitive project files. The raid spanned Telvent systems in the US, Canada and Spain according to a letter sent to the company's customers this month.

Criminals can now study the documents for vulnerabilities in the systems, and potentially devise attacks to sabotage nations' electricity distribution networks.

Telvent boasts that it has "built a customer base second to none in the energy industry", adding: "Our systems now manage over 60 percent of the total hydrocarbon movements in North and Latin America and control transmission and distribution of over 140,000 GWh through worldwide electrical grids."

Investigative reporter Brian Krebs, who first revealed the breach, said the blueprints described Telvent's OASyS SCADA [supervisory control and data acquisition] product, a technology that offers power companies a means to bridge legacy systems to next-generation "smart grids".

Clues such as references to particular domain names and malware left behind by the spies match the digital fingerprints of a Chinese hacking crew called the Comment Group, which is linked to previous cyber-espionage campaigns, according to researchers at Dell SecureWorks.

Telvent has cut data links between at-risk portions of its internal network and clients' systems as a precaution while it probes the breach. Police have been called in to investigate the attack, according to this statement supplied to Sophos:

Telvent is aware of a security breach of its corporate network that has affected some customer files. Customers have been informed and are taking recommended actions, with the support of Telvent teams. Telvent is actively working with law enforcement, security specialists and its affected customers to ensure the breach has been contained.

Dale Peterson, founder and chief of industrial control security specialist Digital Bond, spelled out the kinds of information present in the lifted documents.

"Some project files contain the 'recipe' for the operations of a customer, describing calculations and frequencies at which systems run or when they should be turned on or off," he told WiReD.

"If you're going to do a sophisticated attack, you get the project file and study it and decide how you want to modify the pieces of the operation. Then you modify the project file and load it [onto a company's control system], and they're not running what they think they're running." ®