A History of Cyber-Physical Security Incidents

Chapter Summary

Although the concept of a cyber-physical attack is not new, in recent years we have become so dependent on computerized and networked systems that such attacks are now considered a key threat to critical national infrastructures and a realistic threat to private cars, home automation devices, and even pacemakers. Cyber-physical security incidents can be accidents caused by misconfiguration and sheer bad luck or they can be state-sponsored attacks several months in preparation. They can be targeted, they can be opportunistic, and they can even be the result of indiscriminate malware infections. This chapter is not about what they can be but about what they have been. A brief history of incident reports demonstrates a remarkable variety of targets, motives, attack mechanisms, and impacts. We focus in particular on the sectors of energy, water, health, transport, and defense, and briefly discuss landmark real-world incidents that have been publicly reported, as well as some of the most noteworthy staged attacks that have been carried out by researchers.

Key Terms

History; cyber-physical incident; industrial control system; SCADA; malware; normal accident; kinetic cyber

Chapter Outline

Dependable and accurate reports on cyber-physical attacks are rare. As with all types of information security breaches, organizations are reluctant to publicly report them, fearing that they will be seen as easy targets and therefore attract further attacks. Being relatively novel, a cyber attack with a physical impact may also be more newsworthy, even further damaging the reputation of the organization that would report it. As a result, a history of cyber-physical security incidents can only be incomplete. It cannot help us deduce their actual frequency or severity and it cannot show how to best defend against them. What it can do is help illustrate their breadth, chronological evolution, and potential impact.

The incidents discussed in this chapter were publicly reported to have occurred either in the real world or in an experimental laboratory setting. There have been many others but it is not this book’s aim to disclose classified information or to provide an exhaustive list of many similar incident reports. Our focus is on incidents that are notable for their impact or for the new approach that they demonstrated. We have chosen to present this history by sector affected, starting with the one that has seen most of the high-profile incidents: the energy sector. It is primarily the cyber-physical attacks in this sector that have sparked a series of public research programs around the world on the security of critical national infrastructures.1

For convenience in referring back to these incidents throughout the rest of the book, each one is assigned an identifier, starting with E1 as the first one mentioned in the energy sector, W1 in the water sector, and so forth. A graphical timeline is provided at the end of this chapter.

Reported Incidents by Sector Affected

Energy

An oft-repeated story from the Cold War recounts that in June 1982, somewhere in the Siberian wilderness, a natural gas pipeline exploded so spectacularly that it could be seen from space2 (E1). The story contends that, through a Soviet defector a year earlier, the CIA had become aware that the Soviets were trying to steal pipeline control software from a Canadian company. Allegedly, the CIA made the company insert flaws in the code that would cause the pipeline’s valves to misbehave and lead to pressures beyond its limits. The only account of the operation and the explosion comes from a US official’s memoirs of the Cold War and has never been confirmed from other sources. It may or may not be true. What we can confidently consider as true, though, is that the possibility of such cyber-physical sabotage was already known to the US intelligence services. The defector had provided a list of the most important technologies that the Soviets were trying to steal from the West and the CIA would run a large deception operation around them. According to the CIA’s “Farewell Dossier” that was declassified in 1996, “contrived computer chips found their way into Soviet military equipment, flawed turbines were installed on a gas pipeline, and defective plans disrupted the output of chemical plants and a tractor factory.”

Since the wide adoption of supervisory control and data acquisition (SCADA) systems started in the 1980s, production and delivery of energy is controlled remotely and in a largely automated manner. As a result, a flaw in software code can indeed affect power stations and pipelines. (See Box 2.1 for more information on SCADA systems.)

Most of the industrial control...