Worried about cyberattacks on US power grid? Stop taking selfies at work
Experts warn that malicious hackers gain valuable insight when companies and employees reveal too much information on the Web 鈥� especially when they work at sensitive facilities.
Reuters
The world鈥檚 governments are on notice that their critical infrastructure is vulnerable after an apparent听cyberattack darkened 80,000 households in three regions of Ukraine last month.
But on the question of safeguarding utilities, operators of power plants, water treatment facilities, and other industrial operations might do well to worry more about Instagram than hackers, according to a cybersecurity firm.
Social media oversharing is wellspring of听information that could be useful to attackers听interested in compromising critical infrastructure, said Sean McBride, senior threat intelligence analyst at听iSight Partners.听Among the valuable information he's found online: workplace selfies on Instagram and Facebook that reveal details of听supervisory control and data acquisition, or SCADA, systems.
"No SCADA selfies!" said Mr. McBride at the S4 Conference in Miami听Thursday. "Don鈥檛 make an adversary鈥檚 job easier."
iSight has found numerous examples of SCADA selfies at sensitive facilities and warns that such photos may unwittingly reveal critical information that operators would prefer to keep secret. The firm's researchers have also discovered panoramic pictures of control room and video walk-throughs of facilities.
In addition to posting videos and photos on the Web, corporate听websites听can听divulge听valuable information to adversaries. For instance,听organization charts or lists of employees with contact information accessible via听the听utility website are valuable听sources of information for would-be attackers, says McBride.
These kinds of easily accessible images have aided critical infrastructure attacks in the past. Photographs published in 2008 by former Iranian President Mahmoud Ahmadinejad's press office provided western nuclear analysts with detailed views of the insides of the Natanz facility and Iran鈥檚 uranium enrichment operation 鈥� what an expert once described as
In 2011, industrial control systems expert Ralph Langner of a SCADA control system monitor in one of the photos to match the configuration of the Natanz centrifuges to configuration information in the Stuxnet malicious software created to hobble the facility.
Today, McBride said that he and fellow听researchers have used open-source information from media, government, and private sources to identify 15 facilities in the US that are critical to the operation of the electric grid.
McBride suggested that critical infrastructure operators think like hackers before posting photos online: "Ask yourself, 'What do my adversaries know about me and the organizations I support.' "
听