Experts: Infrastructure hacks pose threat
Attacks on utility companies on the rise
By: Will Carless
and Michael Loria
USA Today
..... A wicked storm knocks out the largest gasoline pipeline in the country, stretching from Texas to New York.
.....
Nearly 17,000 gas stations go dry, turning pit stops into parking lots as panicked Americans try to fuel up before attendant tape off yet another empty pump.
..... It's a familiar tale of infrastructure bucking under extreme weather.
..... But this storm blew in from the east without a drop of water or a gust of wind when Russian hackers crippled the Colonial Gas Pipeline.
..... And the 2021 colonial attack, which effected nearly half of all fuel consumed on the East Coast, was just a taste of things to come, experts say, as foreign governments and gangs under their protection tap into the nervous system of the American economy, ready to shut it down in the event of a conflict.
..... "It's a free-for-all,: said Colin P. Clarke, director of research at the Soufan Group, a global intelligence consultancy.
.....
"It's a constant barrage and casualty of various types of hacking attempts, offensive cyberoperations and others that are trying to go after the public sector, the private sector and everything in between."
..... Adversaries have created a sprawling network of hackers and software that have infiltrated America's infrastructure to be activated in the case of significant geopolitical conflict.
..... "It's just another threat, that's the way I look at it," Clarke said.
..... "There;s air, land, sea, space and cyber."
..... "It's no secret foreign adversaries - like communist China -seek to undermine our people and nation through the sue of sophisticated and dangerous cyberatttcks," said Representative Latta, R-Ohio, Chair of the House Subcommittee on Communications and Technology.
.....
As conflicts boil over in the Middle East and Ukraine, there has been a jump in cyber attacks on critical infrastructure, said Courtney Adante, president of security risk advisory at Teneo.
..... "The reality is that a potential attack against water systems, dams, bridges, energy, is a real threat, it;s a real risk," Adante said.
..... "My concern is that the public just isn't paying enough attention."
..... A campaign by a group of Chinese hackers nicknamed "Salt Typhoon" that infiltrated major U.S. telecoms companies has roiled Capitol Hill since it was disclosed this month. [10/2024]
The hack, first reported by the Wall Street Journal, allegedly targeted Verizon, AT&T and other companies.
..... U,S. officials told The Washington Post they suspected state-sponsored actors were probing how law enforcement and the telecoms companies partner to wiretap and tack foreign - namely chine see agents.
..... "It is vital that cybersecurity protocols are enhance to better protect American's data against increasing sophisticated attacks," leaders of the House energy and Commerce Committee wrote in response to Verizon, AT&T and Lumen Technologies.
..... The Department of Homeland Security declined to comment.
.... Like other recent attacks, the Salt Typhoon campaign appears to have been thwarted without major disruption to consumers.
..... But experts and officials warn that immediate chaos is often not the plan, the goal of most cyberwarfare is instead probing an adversary's systems to cause a disruption when it;s needed, said Craig Shue, who chairs the computer science department at Worcester Polytechnic Institute.
.....
Probing attacks, of which there are thousands every year, are spying missions, searching for weaknesses to exploit, Shue said.
..... The end goal, Clarke said, is not simply disrupting life for Americans, but to play a more serious role in possible future conflicts.
..... Cyberwarefare between the U.S. and tis adversaries has reached a state akin to the "Mutually Assured Destruction" doctrine between the U.S. and the Soviet Union in the 1980s over nuclear weapons, experts told USA Today.
..... Each side can say to the other," 'Hey, we can make things pre3tty uncomfortable for your population if you go through with this,' " Clarke said.
..... U.S. hackers and security agencies have not been idle, said Jim Lewis, director of the Strategic Technologies Program at the Center for strategic and international Studies.
..... "It's fair to say that the Chinese, the Russians, believe we're doing it," Lewis said. "Whether we're doing it or not doesn't matter, because they think we;re doing it."
.....
Last year, [2023] more than a decade after Edward Snowden accused the National Security Agency of hacking into the servers of the Chinese telcom firm Huawei, Beijing officially acknowledged the breach.
..... Chinese hacking attacks have been more openly aggressive, but because these attacks take place in cyberspace, they're not consider overt acts of war, Lewis said.
..... That line is increasingly blurry.
..... "IF I went to the port in San Francisco and I put sea mines there, it;s not like they're exploding - it's not an attack - but everyone would regard that as a hostile act," Lewis said.
..... "Hits is kind of the cyber equivalent of putting a mine in your opponent;s harbor."
.....
Attacks on utilities are the most recent examples of a significant uptick.
..... Hackers hit American Water in early October, [2024] according to a Securities and Exchange Commission filing.
..... The utility had to pause billing for millions of customers, drawing a warning from the Environmental Protection Agency.
.....
Water delivery systems were not affected.
..... "Cyberattacks represent one of the most significant threats to our nation's water and wastewater utilities and to the communities, business, hospitals, and other critical infrastructure sectors." EPA spokesperson Dominique Joseph said after the American Water breach.
..... Authorities haven't identified who was behind the American Water breach, which came as foreign hackers increasingly go after private, rather than government, targets. An estimated 89% of critical infrastructure in the U.S. is controlled by private companies, said Adante, the security risk consultant. And an EPA review this year [2024] found 70% of U.S. water companies were vulnerable to attack.
..... "I worry about the critical infrastructure event, where there's an attack on power grids, water systems - where human lives are at stake," Adante said.