Tag Archives: CyberWar

Hacking EirGrid: NCSC MiA, GCHQ Inertia, US Data Centres, & Creating Backdoors to UK/EU Grid

This post was first published by me on Peerlyst on 7th August 2017.

This hack took place last April (2017) but the details are only emerging now. Hackers compromised EirGrid’s routers at Vodafone’s Direct Internet Access (DIA) service at Shotton, Wales. The MITM “virtual wire tap” then intercepted unencrypted messages between EirGrid and SONI (EirGrid NI). Firmware and files were copied from the compromised router devices but there is no estimate as to the scale of the breach or the magnitude of the data that was stolen.

The Role of NCSC & GCHQ

An informed source has confirmed to AirGap Anonymity Collective that this hack was going on for some time before it was “detected” and before EirGrid were informed – that was already reported.

However, the same source is also of the opinion that the UK’s National Cyber Security Centre – part of GCHQ – instructed Vodafone not to tell EirGrid of the breach – while they tried to ascertain who the perpetrators were (understandable) but that this was for an unreasonably extended period of time.

The source is not clear on what portion of the estimated nine weeks of the hack overlapped with GCHQ’s attempts to identify the hackers.

Where was Ireland’s National Cyber Security Centre while all of this was going on?

The Irish National Cyber Security Centre (NCSC) & Computer Security Incident Response Team (CSIRT)

Formally established in 2015. Together with the (CSIRT), they have responsibility for Ireland’s national cyber security defences. They say:

“The global cybersecurity threat landscape continues to pose an immense challenge. As part of wider efforts to address these security threats, the Directive on Security of Network and Information Systems (NIS Directive) was approved in July 2016. Member States have until May 2018 to implement the NIS Directive, with both the NCSC and CSIRT playing a critical role in this regard.”

Seán Kyne – Minister of State for Community Development, Natural Resources & Digital Development – discussed the NCSC’s objectives, and offered his thoughts on the nature of the digital security threat to the public and private sector alike in a press conference last month.

INCSC

EirGrid & UK Energy Policy

The UK has become increasingly reliant on off-shore wind farms and it’s power needs are augmented by the purchase of power generated in the Irish Midlands. Irish supplied power is key to the UK meeting its projected 2020 energy needs. The Irish supply is seeking to generate circa 3GW for the UK market.

The Irish national grid is managed by a company called EirGrid. They took over the Irish national grid in 2006 from ESB (the Electricity Supply Board). They own all of the physical electricity transmission assets in the country (about 7000kms of cable (fact check)).

As such, they run a monopoly and nearly all of the large independent generators (Airtricity, Synergen (70% EirGrid) Viridian and others) connect to the transmission system and utilise it to transport their power to all regions and abroad. They also operate the wholesale power market and operate (and own) the 500 MW East–West Interconnector, linking the Irish power system to Great Britain’s grid.

Last month the operator was awarded over €20 million by the EU to fund research into the deployment of renewable energy. Ireland’s own target, set out by the European Union, is to secure 40% of its electricity from renewable sources by 2020.

“We won’t have enough renewable energy left over to export to the UK without completing some specific projects, such as the proposed Midlands development,” according to Fintan Slye (EirGrid CEO). “There are sufficient renewable projects in train to meet the 2020 targets, but it’ll still be challenging. There are 2,000MW connected across the island – we need to get that to over 4,000MW by 2020.”

The EU is also funding a France-Ireland power link (that bypasses the UK) via an undersea cable as an “obvious solution” to Ireland’s energy reliance on a post-Brexit United Kingdom.

Motives – All Those Data Centres in Ireland & A BackDoor to the EU/UK Grids 

IE DCs

Extract from EirGrid Group All-Island Generation Capacity Statement 2016-2025:

“2.2(d) Data Centres in IrelandA key driver for electricity demand in Ireland for the next number of years is the connection of large data centres.Whether connecting directly to the transmission system or to the distribution network, there is presently about 250 MVA of installed data centres in Ireland. Furthermore, there are connection offers in place (or in the connection process) for approximately a further 600 MVA. At present, there are enquires for another 1,100 MVA. This possibility of an additional 1700 MVA of demand is significant in the context of a system with a peak demand in 2014/15 of about 4700 MW (where it would add 35%). In forecasting future demand, we need to appreciate that data centres normally have a flat demand profile.”

Culprits

Lots but the most likely candidate for this hack is Russia – why? Because I cast lots, sacrificed a chicken, and got my Tarot cards read. And also …

Irish energy networks being targeted by hackers – Hackers have targeted Irish energy networks amid warnings over the potential impact of intensifying cyber attacks on crucial infrastructure. Senior engineers at the Electricity Supply Board (ESB), which supplies both Northern Ireland and the Republic, were sent personalised emails containing malicious software by a group linked to Russia’s GRU intelligence agency, reported.
Inside the Cunning, Unprecedented Hack of Ukraine’s Power Grid – It was 3:30 p.m. last December 23, and residents of the Ivano-Frankivsk region of Western Ukraine were preparing to end their workday and head home through the cold winter streets. Inside the Prykarpattyaoblenergo control center, which distributes power to the region’s residents, operators too were nearing the end of their shift.
Ukraine power cut ‘was cyber-attack’ – BBC News – A power cut that hit part of the Ukrainian capital, Kiev, in December has been judged a cyber-attack by researchers investigating the incident. The blackout lasted just over an hour and started just before midnight on 17 December. The cyber-security company Information Systems Security Partners (ISSP) has linked the incident to a hack and blackout in 2015 that affected 225,000.
Hackers targeting UK energy grid, GCHQ warns – Hackers may have compromised Britain’s energy grid, GCHQ has said as it warned that cyber criminals are targeting the country’s energy sector. The security agency said industrial control systems may have already been the victim of attacks by nation state hackers.

 

ENDS

Quick Reference Resource Introduction: WikiLeaks CIA Vault 7 Leaks

This series covers links to and analysis of each of the WikiLeaks CIA Vault 7 leaks including:

  1. The WikiLeaks pages;
  2. The associated CIA documents – Specification Documents, Systems Requirements, Installation Guides, User Guides, User Manuals, Test Plans, Tactics Documents, Slides and so on;
  3. Links to external references and sources including The Hacker News (Twitter @TheHackersNews), HackRead (Twitter @HackRead), and Pierluigi Paganini at “Security Affairs”; 
  4. Analysis by other third party publications of each leak;
  5. General comments, notes, and links added by AirGap Anonymity Collective as each leak and its previous deployment is more clearly understood;
  6. How these posts will evolve over time:
    1. The first post will be a generic description of each leak including 1-3 above; 
    2. Content will be added over time and date-stamped to include:
      1. Articles, external resources, and commentary that augment the knowledge base with respect to the basic content of each leak; 
      2. Advice on counter-measures / new research; 
      3. Analysis and examples of the subsequent deployment (in the original form or altered) of these hacking tools by cyber criminals, cyber terrorists, state actors, hackers, and others;
      4. Other information that does not emanate from generic or main stream media sources; 

These documents are marked with various security classifications. To understand what these classifications mean see Understanding NSA / INR Security Classifications on Intelligence Assessments;

Posts in this series to date:

Quick Reference Resource: WikiLeaks CIA Vault7 Leak #14 – OutlawCountry;

Quick Reference Resource: WikiLeaks CIA Vault7 Leak #15 – BothanSpy & Gyrfalcon;

Quick Reference Resource: WikiLeaks CIA Vault7 Leak #16 – HighRise;

Quick Reference Resource: WikiLeaks CIA Vault7 Leak #17 – Imperial: Achilles, SeaPea, & Aeris

Quick Reference Resource: WikiLeaks CIA Vault7 Leak #18 – UCL / Raytheon

Quick Reference Resource: WikiLeaks CIA Vault7 Leak #19 – Dumbo

Quick Reference Resource: WikiLeaks CIA Vault7 Leak #20 – CouchPotato

All third party content is explicitly acknowledged and content or imagery that has been altered or amended for ease of use is clearly marked.  

ENDS

The “FVEY” SIGINT Espionage Alliance

The French, Belgian, Egyptian and Yemeni authorities have all in the last 12 months failed to connect the dots on available data that might have prevented or lessened the Hebdo, Bataclan, Zaventem & Maalbeek atrocities.

Some of their foreign counterparts however are part of an exclusive alliance that shares intelligence that does in many cases provide insights that the individual portions do not.

The Five Eyes intelligence alliance is led by the USA. Often abbreviated as “FVEY” the alliance comprises Australia, Canada, New Zealand, the United Kingdom, and the United States. They are bound by the multilateral UKUSA Agreement, a treaty for joint cooperation in signals intelligence.

STASI - FIVE EYES

FVEY’s origins can be traced back to the Atlantic Charter issued by the Allies to lay out their goals for a post-war world in 1945. During the Cold War, the ECHELON surveillance system was initially developed by the FVEY to monitor the communications of the former Soviet Union and the Eastern Bloc. Later, it was alleged that it was also used to monitor billions of private communications worldwide.

ECHELON’s existence was disclosed in the late 1990’s and it triggered a major debate in the European Parliament. As part of efforts in the so called War on Terror the FVEY further expanded their surveillance capabilities, with much emphasis placed on monitoring internet communications.

Snowden describes the Five Eyes as a “supra-national intelligence organisation that doesn’t answer to the known laws of its own countries”. Documents leaked by Snowden in 2013 revealed that the FVEY have been spying on one another’s citizens and sharing the collected information with each other in order to circumvent restrictive domestic regulations on surveillance of citizens.

The leaked documents also revealed the existence of numerous surveillance programs jointly operated by the Five Eyes including:

  • PRISM – Operated by the NSA together with the GCHQ and the ASD;
  • XKeyscore – Operated by the NSA with contributions from the ASD and the GCSB;
  • Tempora – Operated by the GCHQ with contributions from the NSA;
  • MUSCULAR – Operated by the GCHQ and the NSA;
  • STATEROOM – Operated by the ASD, CIA, CSEC, GCHQ, and NSA.

Despite the disclosures no amount of outrage will affect the Five Eyes which remains the most extensive known espionage alliance in history.

END.