First, I want to thank the panel for requesting my presence here in Ottawa to brief these distinguished parliamentary members.
My name is Stuart Wright. I'm attending today as an individual.
I have worked in regulation; energy including oil and gas transmission, distribution, and generation; and audit and information systems in different leadership capacities for many years. I have a degree of expertise and a unique perspective on cybersecurity here in North America.
I'm here today to provide a layman's briefing on the events in the Ukraine and eastern Europe as they relate to cybersecurity. My hope is that this will inform the panel as they assess the appropriate measures and next steps to support our NATO allies and enhance Canada's military capability to respond to a new type of warfare.
This week's cyber-attacks using malware called Bad Rabbit hit Russia and other nations on Tuesday, affecting the Interfax news agency and causing flight delays at Ukraine's Odessa airport. The Bad Rabbit ransomware is a type of virus that locks up infected computers and asks victims to pay a ransom to restore access. While no major outages were reported, several governments have issued warnings on the attack, which followed campaigns in May and June that used similar malware and resulted in what some economists have estimated are billions of dollars in losses. These new rounds of attacks are disturbing because attackers quickly infected critical infrastructure, including transportation operators, indicating it was a well-coordinated attack.
Some cybersecurity firms have indicated that Bad Rabbit appeared to spread through a mechanism similar to June's disruptive NotPetya virus, which took down many Ukrainian government agencies and businesses. It then spread across corporate networks of multinationals with operations or suppliers in eastern Europe. According to early reports on Bad Rabbit, more than half the victims were in Russia, followed by Ukraine, Bulgaria, Turkey, and Japan.
I'd now like to speak to the Ukraine cyber-attack of 2015, as you requested. On December 23, 2015, unknown cyber-forces disrupted energy grid operations for first time, causing large blackouts over 225,000 customers in Ukraine. It affected several regions in the country, which went without power for several hours. This was facilitated by malware called BlackEnergy.
In December 2016, almost exactly one year later, there was another blackout, smaller in scale and lasting only one hour. It hit only one region but was conducted with a more advanced malware, Industroyer, which is suspected to be the cause in this case.
These cyber-incidents impacted operators in the electricity sector, but the tactics used in these attacks could have easily played out against any operators in any sector and in any jurisdiction in any country. The bottom line here is that cyber-threats are no longer the concern of IT network administrators and engineers but must be a central concern in running a safe, efficient, and resilient critical-infrastructure operation.
I'd now like to talk about the global landscape. Global cyber-attacks are now concerted. They're orchestrated efforts to exploit vulnerabilities in people, systems, and processes. They're impactful, long-lasting, and often professional efforts to use an organization's network infrastructure against it in a highly targeted way.
In the traditional understanding of war, critical infrastructure was a sound target of opportunity: hamper the ability of the opponent to utilize it, thus rendering it useless. Public Safety Canada defines critical infrastructure as “processes, systems, facilities, technologies, networks, assets and services essential to the health, safety, security or economic well-being of Canadians and the effective functioning of government.” The disruption of any critical-infrastructure provider could potentially result in catastrophic loss of life, adverse economic effects, and significant harm to public confidence. In other words, critical infrastructure is an ideal and easy target.
Historically, critical infrastructure was easy to defend, as it was available via air-, land-, or sea-based assets of an opponent. The deployment of such capabilities can result in the potential transmitting of movement, and even if the exact target is unknown, can be limited by conventional defensive capabilities. This was particularly relevant in the era of state-versus-state war such as the bombing campaigns we witnessed during the Second World War and the later political-military conflicts of the latter 20th century.
In the modern geopolitical era, however, there is another dimension of assets now operating within the cyber-realm with near global reach and little to no movement of efforts. Effectively, the nature of war and conflict has evolved. These cyber-assets are now deployable quickly and are never physically exposed to the opponent. They are able to target critical infrastructure from within the borders of their state or through third-party proxies, utilizing techniques, tactics, and procedures, TTPs, to carry out effective assaults on their targets.
The Department of National Defence, its partners in NATO, and strategic allies in Europe, Asia, and south of the border need to revisit the military doctrines required to effectively guide cyberwarfare strategies. These include our capabilities and core elements of training, intelligence, and support to ensure security and stability of our allies and regional partners.
The same TTPs separate the average cybercriminal from more sophisticated threat actors, and these advanced persistent threats, APTs, are effectively a set of stealthy and continuously computing hacking processes orchestrated by a person or persons targeting a specific entity.
An APT usually targets either private organizations, states, or both. The targeting of critical infrastructure or state-based assets by APTs may include financial institutions; energy systems; transport automation; water and waste-water management; as we witnessed in the last week, communication and first responder systems; and of course our defence capabilities, networks, and core elements.
The fact is that no industry vertical or sector is immune and we are now witnessing the evolution of a hybrid warfare. To provide the context of the narrative, hybrid warfare might be used informally to describe the ever-changing complexity and dynamics of the battlefield, which include the use of cyberwarfare as a precursor to a larger military action.
I will now discuss the attacks that occurred over the last several years on the power grid of Ukraine in 2015 and 2016, as well as in the Baltics back in 2015.
From a timeline perspective, first we will look at the malware used to provide an understanding of the tools utilized in these attacks. Secondly, the timeline will be explored, outlining how the attacks were carried out. Finally, this discussion will look forward, offering a viewpoint of the future of cyber-defence of critical infrastructure as it relates to irregular or as recently coined “hybrid warfare”, and the opportunities for both the Department of National Defence, NATO, and NORAD to enhance our response to this new type of threat.
First, in terms of the malware used in the attacks, typically when a prominent cyber-attack is discussed, there's usually a cursory description of the malware accompanied by a picture. You've all seen it. It's like the Matrix, the green screen superimposed on a black background, or a sinister-looking individual with their face covered asking you to send bitcoins. Things have now evolved.
You see in the news media reports for the technical descriptions to present a catchy narrative or story to keep the readers interested. However, it does not necessarily provide a full understanding of how the attack occurred. Conversely, taking a technical approach to understanding these attacks while providing a robust understanding of the attacks, often limits the audience. This in turn, however, restricts the ability of the work to explore the attacks in the larger picture or global landscape. As such, I hope to provide the committee with a balanced, middle-ground approach to explaining why and how the malware is functioning, without becoming overly technical. The last thing we all need to do is get bored with technical details.
The malware, dubbed BlackEnergy, which was reportedly used in the Ukraine attacks, is a Trojan, a program effectively hiding its malicious intent. It enters the system through a file distribution, through an email spear-phishing campaign. We've all received these types of emails, formerly referred to as a Nigerian email scam, asking us to wire money to specific African nations to secure the release of millions of dollars predicated on immediate action.
In the corporate and government realms, C-levels are constantly being targeted with requests to approve and authorize internal transfers of financials from their operation team, whether it's in general finance or procurement, to facilitate large money transfers to Asian banks, generally when they're about to go on vacation or head to the cottage. These types of campaigns are targeted. We call them whale-phishing campaigns. They appear as normal correspondence that the victims would experience in their day-to-day jobs, rather than a more generic one typical of a phishing campaign, which is treated almost like a numbers game.
Once that malware has been downloaded, it enables the attacker to launch a distributed-denial-of-service attack, as well as download custom spam and information theft plug-ins. In other words, once BlackEnergy had infected the systems in Ukraine, it was able to act as the gateway for the next stage of the attack, bringing in additional malware to allow for intelligence gathering and to facilitate those future attacks.
I wish to convey to this committee that there are multiple variants of these infections. These include BlackEnergy 2, which is a more precise tool used to go through specific systems, and BlackEnergy 3, which is focused on searching a network for specific or enticing systems, including those in government, military, and in overseas infrastructure. They seek to provide network reconnaissance and a mechanism to spread that infection.
The threat is present. This BlackEnergy malware then delivers a KillDisk into the system following the initial infection. This component of the attack made the systems within the infrastructure inoperable and gave the threat actor the potential to remove a central component of the infected systems, thus impeding restoration efforts. Once KillDisk is run, it wipes or overwrites all the key essential systems, including the master boot records, which brings down the systems and prevents a system reboot. This further hides the activity of the attacker within the system and disguises the effective nature and origin of the threat actor.
That's critical when you're determining who your threat actor is and basically, when you're doing your forensics, who you want to chase down if you're going to take a response and recovery measure.
Both BlackEnergy and KillDisk have been seen operating in conjunction with each other, and most notably in the Ukraine power grid attack in 2015. Current and future adversaries are likely to rely more on a blend of conventional and irregular approaches to conflicts, which has been referred to, as I mentioned, as hybrid warfare, and these may be a precursor to kinetic attacks.
In addition, another variant, the Industroyer, has been alleged as the malware behind the 2016 Ukrainian power grid attack. It's highly customizable with malware, and researchers believe it is targeting industrial control systems. If you look at the reports in recent weeks, effectively it's becoming more pervasive. It is a malicious tool in the hands of a dedicated, well-funded, and persistent attacker. This is not something that a script kiddie could take off the dark web and just implement.
The malware is able to persist in compromised networks and directly interferes with the critical working processes in those facilities. The malware is extremely dangerous. Its potential damage depends on the configuration of that particular facility, and can vary, for example, from one substation to another and can be anything from a simple local blackout through a cascading failure to potentially even greater damage to the hardware. The relatively low impacts of recent blackouts stand in great contrast to the technical detail, level, and sophistication of the suspected malware behind Industroyer. These threat-based actors are institutional at a government level.
A possible explanation for this, which is the opinion of many security researchers, is that this was a large-scale test. They're testing our perimeter defences, pushing the envelope, and observing our response and recovery methods. This is a calculated, strategic approach to hybrid warfare.
The security community in North America has compared Industroyer to the Stuxnet cyber-weapon, having formerly worked for Siemens, which was used to target the Iranian nuclear program.
I'm going to skip ahead of the time on the attack. I see the chair....
I will now provide a quick comment on how the power grid attacks unfolded, and the context of each attack.
Three attacks were examined: Ukraine, Baltics, and Ukraine. Before going into the individual attacks, it's important to note the attribution of these attacks.
First the available information only attributes the Ukraine attack to advance persistent threat Sandworm, which was believed to be a hacker group with the Russian government. In the 2015 Baltic attack, researchers claimed they saw evidence of Sandworm, but were unwilling to provide such evidence for operational reasons. This is part of the challenge that we're faced with in the industry in the response and recovery methods. The trust factor is key to a successful response. However, in many cases it takes months or even years to determine all the facts.
Finally, in the Ukraine attack the use of Industroyer had not yet been officially attributed to any country actor. Therefore, for the purposes of this section, the attack has been accepted by experts in the private sector as being launched by the Russians. Again only time and further due diligence will confirm this assessment.
I'm going to skip ahead from the attacks, because I think we've touched on it critically, and I'd like to focus on the prevailing attitudes.
