STE WILLIAMS

BLACK HAT USA – Las Vegas – Gaping security holes in wind energy control networks make them vulnerable to cyberattacks for extortion and physical destruction purposes, a researcher showed here today.

Jason Staggs, a security researcher at the University of Tulsa, has spent the past couple of years crisscrossing the US and hacking away at the systems that run the wind turbines that convert wind energy into electrical power. He did so with the blessing of operators of the wind farms, who allowed him to test the security of a single turbine at their sites and with the stipulation he would not disclose the names, locations, or products involved for security reasons.

What he found was a disturbing trend among these renewable power systems: “We were seeing the same vulnerabilities over and over again” in each wind farm and across multiple vendors’ equipment and models, Staggs said in an interview with Dark Reading last week.

If the vulnerabilities he found some familiar, it’s probably because they are typical of traditional ICS/SCADA-type systems: easy-to-guess or default passwords, weak and insecure remote management interfaces, and no authentication or encryption of control messages.

Staggs says an attacker would need control over just one turbine at a wind farm to take over the entire operation. He physically plugged a homegrown Raspberry Pi-based tool onto the control system network, and found that it only took that one turbine to control the entire operation.

“I had to have physical access to [just] one turbine to rule them all,” he says. Staggs, who presented his research here today at Black Hat, says he was able to pull off the hack at multiple wind farms around the country.

He admits that security weaknesses in the wind farms echo those of so many other ICS/SCADA systems also built for high availability operations as the priority. But he was most interested in what an attacker could do once he or she hacked the wind turbine system.

“No one is looking at the implications from an attacker’s motive: how could they leverage this access control system to control the wind turbine, to damage it or hold it for ransom?” he says.

Extortion-type hacks could be lucrative, he says, with downtime for a system costing $10,000 to $30,000 per hour. “If you can hold a 250 megawatt [system] at ransom for one hour” the wind farm operator just might be willing to pay a less expensive ransom fee, he says.

Wind today represents 5.6% of electricity generated in the US, according to the Department of Energy, and by 2030, wind could provide 20% of the nation’s electricity.

“The more devious thing to do would be to gain access [to the wind turbine controller system] and wait for years until we’re more dependent on wind and then do bad things” with the systems, he says.

Wind farm vendors typically set up the systems for the wind farmers, which are typically power companies or their subcontractors  Turbine system vendors school them on how to use and monitor the turbine system. After that, the wind farmer is on its own for the actual operations, he says. So “we’re helping them ask the right [security] questions” of the vendors, he says. “We’re trying to raise awareness of wind farm companies who operate these farms.”

Hack the Wind

The wind-turbine automation controllers Staggs tested were stationed sat the base of the turbine – ome 300 feet off the ground – with only a padlock as physical security. Staggs says there were no security cameras in place, so his only obstacle besides the harrowing height was to crack the hardware lock. “You can pick [the lock] or cut it with bolt cutters, open the door, and have all the access to the ICS network switch,” he says.

Once he plugged his Raspberry Pi tool onto the CAN bus flat network architecture, he was on the network that broadcasts unencrypted communications among the other pieces of equipment, including the turbines themselves.

That would allow an attacker to alter the controls of the turbines, including the motors, gears, and power control. He or she could change the speed values, for instance, which would force the turbines to spin out of control and break, or bring the turbines to to a standstill, halting power generation.

The automation controller – basically the brains of the system – communicates to the programmable logic controllers (PLCs) that run the turbine’s controls. It’s most commonly a Windows embedded, Linux, or Vxworks, system, Staggs found.

“If you know what you’re doing, you can actually mess with the braking system to activate or degrade its [the turbine] integrity,” he says.

WindTools

Staggs built two network attack tools for his wind turbine research, Windshark and Windpoison. Windshark takes advantage of the unencrypted protocols between the human operator and automation controllers inside the turbines. “It can change the operational state of a turbine; turn it on and off,” he says. “Or change the maximum power output.”

Windpoison basically executes man-in-the middle attacks on the network. “We can control commands and what the operator sees,” he says. “We could falsify the current RPMs of the rotor positioning,” for example.

He also built a tool for remotely hacking the turbine systems from afar, without physical access. The so-called Windworm proof-of-concept abuses the telnet and FTP interfaces used for network management of the turbine networks, which often employ default or easy-to-crack passwords.

Staggs hopes to release the tools once the turbine equipment vendors fixed the security flaws he has identified.

To pull off any of these attacks, an attacker would need some knowledge of the systems and vendor equipment, however. “Sometimes the attacks have to be customized for different vendors,” too, he says.

The good news is that there are some things that operators of wind farms can do for now to protect their networks from ransom, sabotage, or other cyberattacks, including segmenting the network and ensuring that wind turbines are isolated from one another on the network to avoid a single point of failure via an attack. Stags also recommends adding an inline firewall between turbines, or adding encrypted VPN tunnels between turbines in the field and the substations that run them.

“So if one turbine is compromised, it can’t compromise the others,” Staggs says.

Related Content:

• Hacking Factory Robot Arms for Sabotage, Fun Profit
• 3,000 Industrial Plants Per Year Infected with Malware
• Ransomware Rising On The Plant Floor

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/hacking-the-wind/d/d-id/1329453?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple