Securing the cities of tomorrow: Three takeaways from Black Hat 2019

Max Heinemeyer, Director of Threat Hunting | Tuesday August 13, 2019

As thousands of hackers descended upon the desert for Las Vegas’ annual Black Hat conference, it quickly became clear that nothing was immune to cyber-attack. From hotel smart locks to ATM machines to emergency call centers, hackers and security experts alike showed how cyber-criminals can infiltrate a plethora of supposedly airtight systems. And when it comes to the latest exploit, what happens in Vegas won’t stay there for long.

Yet this state of perpetual vulnerability is, of course, unacceptable for online defenders — particularly for cities whose primary responsibility is the safety of their citizens. Whereas smart city technology like IoT traffic sensors, driverless vehicles, and connected energy grids promise to unlock new heights of efficiency, such innovations are replete with uncharted security flaws that put the world’s most critical infrastructure at risk. Ultimately, Black Hat demonstrated why, to safeguard the cities of tomorrow, we must go beyond looking for yesterday’s threats.

If it’s smart, it’s vulnerable

This phrase was a consistent theme for the researchers who discussed threats facing the Internet of Things — perhaps the defining feature of smart cities around the globe. Coinciding with an explosion in the number of connected devices, 2018 witnessed a 100% year-over-year increase in IoT attacks, and it seems criminals have been ramping up their efforts in 2019. Meanwhile, conventional cyber defenses, designed to protect standard IT from known threats, are often incompatible with these nontraditional machines.

More fundamentally, the race to produce even more IoT devices prevents experts from anticipating their weaknesses. Such was the case when two German hackers compromised high-end smart locks at a European hotel — whose name was not disclosed because the locks were still in use. Known as “mobile keys” due to their reliance on mobile phones rather than on access cards, the locks leveraged Bluetooth low energy (BLE), a technology that many IoT devices employ. The researchers explained how they easily intercepted the BLE traffic in order to develop their exploit, which could have been used for malicious ends to break into private rooms or even to shut down the hotel elevator.

A cautious host

Hosting a conference for hackers can be a nail-biting experience to say the least — one only exacerbated for local governments with highly bespoke smart infrastructure. Thus, among the entities that garnered the most attention at Black Hat was none other than the City of Las Vegas itself.

A town made famous by bold wagers and grand ambitions, Las Vegas is betting big that it knows what the city of tomorrow looks like. As riders glide down the Strip aboard the first completely autonomous shuttle ever deployed on a public roadway, they can rest assured that a network of IoT sensors are helping officials anticipate gridlock at busy intersections, while AI-powered surveillance cameras monitor for litter on the sidewalks around them. In the near future, everything from The Venetian to Mandalay Bay may well be integrated into a single vast, municipal network — a digital labyrinth far too complex for traditional security tools to make sense of, much less defend.

“For all the benefit the IoT brings, it also brings with it that side of security,” Michael Sherwood, Las Vegas’ Director of IT and Innovation and a Darktrace customer, told Reuters. “These things are carrying people across the street, they’re controlling our traffic signals, [so] a lot could go wrong if someone could get into that system.”

Breaching the ballot

In addition to threats imperiling physical infrastructure, the cities of tomorrow cannot disregard trust-eroding attacks against a more abstract target: the democratic process. The subject of election hacking in particular received top billing at the conference, in light of the blind spots posed by not only voting machines themselves, but also voter registration databases and the distribution process. Many experts feared that all three areas remained susceptible to compromise ahead of the 2020 US elections.

These revelations are not without precedent. Until 2015, Virginia used the infamous WINVote machine, which lacked any security controls whatsoever. And although future digital voting technologies may have better safeguards, cyber-criminals have proven undeterred by even the most impressive perimeter defenses. With the conflict surrounding Russian interference in the last national election and worries that similar attacks on the American election systems will happen again, researchers emphasized the need to rethink our approach to election security altogether.

The takeaways from Black Hat all share a common theme: the legacy approach to cyber security is no longer keeping pace with an ever-evolving threat landscape. As a result, for smart cities like Las Vegas, the path forward looks little like the road already traveled. Innovative, AI-powered security platforms have become an imperative to catch novel threats against novel devices — before the black hats’ work is done.

Max Heinemeyer

Max is a cyber security expert with over nine years’ experience in the field, specializing in network monitoring and offensive security. At Darktrace, Max works with strategic customers to help them investigate and respond to threats, as well as overseeing the cyber security analyst team in the Cambridge UK headquarters. Prior to his current role, Max led the Threat and Vulnerability Management department for Hewlett-Packard in Central Europe. In this role he worked as a white hat hacker, leading penetration tests and red team engagements. He was also part of the German Chaos Computer Club when he was still living in Germany. Max holds a MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.

Digitizing the Dark: Cyber-attacks against power grids threaten modernity itself

Andrew Tsonchev, Director of Technology | Wednesday July 31, 2019

Among all historical discoveries, none has transformed civilization quite like electricity. From the alarm clock that wakes you up in the morning to the lights you flip off before falling asleep, the modern world has largely been made possible by electric power — a fact we tend only to reflect on with annoyance when our phones run out of battery.

However, the days of taking for granted our greatest discovery may well be nearing an end. As international conflict migrates to the digital domain, state-sponsored cyber-criminals are increasingly targeting energy grids, with the intention of causing outages that could bring victimized regions to a screeching halt. And ironically, the more advanced our illuminated world of electronics becomes, the more proficient these cyber-attacks will be at sending society back to the Dark Ages.

The light bulb goes off

On December 23, 2015, at the Prykarpattyaoblenergo power plant in Western Ukraine, a worker noticed his computer cursor quietly flitting across the screen of its own accord.

Unbeknownst to all but a select few criminals, the worker was, in fact, witnessing the dawn of a new era of cyber warfare. For the next several minutes, the cursor systematically clicked open one circuit breaker after another, leaving more than 230,000 Ukrainians without power. The worker could only watch as the cursor then logged him out of the control panel, changed his password, and shut down the backup generator at the plant itself.

As the first documented outage precipitated by a cyber-attack, the incident provoked speculation from the global intelligence community that nation-state actors had been involved, particularly given the sophisticated tactics in question. Indeed, blackouts that plunge entire cities — or even entire countries — in darkness are a devastating tactic in the geopolitical chess game. Unlike direct acts of war, online onslaughts are difficult to trace, shielding those responsible from the international backlash that accompanies military aggression. And with rival economies racing to invent the next transformative application of electricity, it stands to reason that adversaries would attempt to win that race by literally turning off the other’s lights.

Since the watershed Ukraine attack, the possibility of a similar strike has been a top-of-mind concern for governments around the globe. In March 2018, both American and European utilities were hit by a large-scale attack that could have “shut power plants off at will” if so desired, but which seemed intended instead for surveillance and intimidation purposes. While such attacks may originate in cyberspace, any escalation beyond mere warning shots would have dramatic consequences in the real world.

Smart meters, smarter criminals

Power distribution grids are sprawling, complex environments, controlled by digital systems, and composed of a vast array of substations, relays, control rooms, and smart meters. Between legacy equipment running decades-old software and new IIoT devices designed without rudimentary security controls, these bespoke networks are ripe with zero-day vulnerabilities. Moreover, because conventional cyber defenses are designed only to spot known threats facing traditional IT, they are blind to novel attacks that target such unique machines.

Among all of these machines, smart meters — which communicate electricity consumption back to the supplier — are notoriously easy to hack. And although most grids are designed to avoid this possibility, the rapid adoption of such smart meters presents a possible gateway for threat-actors seeking to access a power grid’s control system. In fact, disabling individual smart meters could be sufficient to sabotage the entire grid, even without hijacking that control system itself. Just a 1% change in electricity demand could prompt a grid to shut down in order to avoid damage, meaning that it might not take many compromised meters to reach the breaking point.

More alarming still, a large and sudden enough change in electricity demand could create a surge that inflicts serious physical damage and produces enduring blackouts. Smart energy expert Nick Hunn asserts that, in this case, “the task of repairing the grid and restoring reliable, universal supply can take years.”

Empowering the power plant

Catching suspicious activity on an energy grid requires a nuanced and evolving understanding of how the grid typically functions. Only this understanding of normalcy for each particular environment — comprised of millions of ever-changing online connections — can reveal the subtle anomalies that accompany all cyber-attacks, whether or not they’ve been seen before.

The first step is visibility: knowing what’s happening across these highly distributed networks in real time. The most effective way to do this is to monitor the network traffic generated by the control systems, as OT machines themselves rarely support security agent software. Fortunately, in most power grid architectures, these machines communicate with a central SCADA server, which can therefore provide visibility over much of the grid. However, traffic from the control system is not sufficient to see the total picture, since remote substations can be directly compromised by physical access or serve as termination points for a web of smart meters. To achieve total oversight, dedicated monitoring probes can be deployed into key remote locations.

Once you get down to this level — monitoring the bespoke and often antiquated systems inside substations — you have firmly left the world of commodity IT behind. Rather than dealing with standard Windows systems and protocols, you are now facing a jungle of custom systems and proprietary protocols, an environment that off-the-shelf security solutions are not designed to handle.

The only way to make sense of these environments is to avoid predefining what they look like, instead using artificial intelligence that self-learns to differentiate between normal and abnormal behavior for each power grid while ‘on the job’. Vendor- and protocol-agnostic, such self-learning tools are singularly capable of detecting threats against both outdated machines and new IIoT devices. And with power plants and energy grids fast becoming the next theater of cyber warfare, the switch to AI security cannot come soon enough.

To learn more about how self-learning AI tools defend power grids and critical infrastructure, check out our white paper: Cyber Security for Industrial Control Systems: A New Approach.

Andrew Tsonchev

Andrew is a technical expert on cyber security and advises Darktrace’s strategic customers on advanced threat defense, AI and autonomous response. He has a background in threat analysis and research, and holds a first-class degree in physics from Oxford University and a first-class degree in philosophy from King’s College London. His comments on cyber security and the threat to critical national infrastructure have been reported in international media, including CNBC and the BBC World.