A recent cyber attack on a data processing system used by many US pipelines could be a prelude to more severe disruptions, cyber security experts said.
At least four companies that own interstate natural gas pipelines advised customers to temporarily switch to other systems because of the 29 March attack on Latitude Technologies' EDI system — a third party service used for pipeline scheduling and nominations.
The cyber attack did not disrupt physical pipeline operations. But the hackers may have been seeking sensitive information like account numbers, transaction details, and email addresses from gas producers and their utility customers, said Phil Neray, vice president of industrial cybersecurity at Boston-based critical infrastructure cybersecurity firm CyberX. That information could be used for destructive purposes, such as ransomware attacks that would hold pipelines hostage for millions of dollars per day.
That information could also be used to "spoof" transactions, creating false purchases that cause delays in shipments, leading to possible natural gas shortages in certain regions. For example, a slowdown in natural gas flows to power plants during peak summer demand hours could lead to outages that create health and safety concerns, Neray said.
Or it could be used to access systems to physically control pipeline equipment. A report by iDefense, the cyberthreat intelligence division of Accenture, said a hacker group may be trying to gain access to organizations' industrial control systems in the the energy, nuclear and manufacturing industries.
That could be achieved seeking email addresses of key pipeline operations personnel that can later be used in "phishing" attacks — where a digital intruder maquerades as a trustworthy source in an attempt to get sensitive information such as user names, passwords or other data.
Scheduling system targeted
Pipeline operators began informing customers of the attack in early April, saying that a cyber attack on Latitude — a subsidiary of Energy Services Group — knocked the EDI system offline.
On 2 April Energy Transfer Partners advised customers moving natural gas on its Panhandle Eastern Pipe Line that the EDI system was down and it moved all scheduling to its own in-house systems. Oneok temporarily disabled service with EDI which is used by some of its customers and advised them to use alternate methods of communications for gas scheduling. Oneok did not disclose what pipelines were affected. The company's interstate natural gas pipelines include Midwestern Gas Transmission, Viking Gas Transmission, ANR pipeline and the OkTex pipeline.
Eastern Shore Natural Gas also used alternate channels to send and receive information from customers during the EDI outage, as did Boardwalk Pipeline Partners for operations on three of its natural gas interstate pipelines — Texas Gas Transmission, Gulf South, and Gulf Crossing.
Warnings about the US energy infrastructure's exposure to cyber attack have been sounding for several years and are regularly updated.
A February 2017 study sponsored by engineering group Siemens found that the deployment of cybersecurity measures in the US oil and gas industry is not keeping pace with the growth of digitization in operations. The study included a survey of oil and gas information technology workers that found that 68pc reported at least one security compromise in the previous year, resulting in the loss of confidential information or disruption in operational technology.
Accenture Security, the security division of the consulting giant, said a sophisticated hacker group known as Black Ghost Knifefish has been targeting the energy, nuclear and manufacturing industries in North America and Europe since March 2017 with cyber attacks including phishing and "watering holes" — accessing websites an organization uses often and infecting them with malware.
The US government warned of an increase in phishing attacks just two weeks before the Latitude incident. On 15 March the Federal Bureau of Investigation and the Department of Homeland Security issued a joint alert warning of "a multi-stage intrusion campaign" by Russian government cyber actors. The Russian's allegedly targeted small commercial facilities' networks where they staged malware, conducted phishing, and gained remote access into energy sector networks, according to the alert.
The growing threat prompted the US Transportation Security Administration last month to issue new security guidelines for energy infrastructure operators, while the Department of Energy this week offered a $25mn grant for research into improving cybersecurity for the nation's oil and gas industry and the power grid.
The cyber threat is a moving target which requires constant vigilance, said the agency's deputy secretary Dan Brouillette at a 19 April event at Columbia University in New York. "It is every single day we see a new state actor, or every single minute of every day, we see a new threat that comes," he said.
The Latitude attack shows that US physical and digital infrastructures are intimately linked to each other, CyberX's Neray said. "Cyber attacks can now lead to destruction of energy facilities and environmental damage, as well as threat to human safety."
