Israel's Electric Grid Targeted By Malware, Energy Minister Says

itwbennett writes: While many are still debating how much risk there is of a catastrophic cyber attack on power grid and other critical infrastructure, Israel's Minister of Infrastructure, Energy and Water, Yuval Steinitz has good reason for warning 'of the sensitivity of infrastructure to cyber-attacks, and the importance of preparing ourselves in order to defend ourselves against such attacks.' On Tuesday Steinitz told attendees at CyberTech 2016 that the country's Public Utility Authority had been targeted by malware just one day earlier, and that some systems were still not working properly. Not long after news of the attack started to spread, Robert M. Lee, the CEO of Dragos Security, published his thoughts on the matter over on the SANS ICS blog.

Since when did we know this was going to happen?

[hyperar]

I mean, we know industrial facilities are extremely vulnerable since the Stuxnet incident, when was that?, 2011?

Re:Since when did we know this was going to happen

[gstoddart]

And, given the widespread belief Israel was involved in Stuxnet ... to suddenly be bit by this seems a little shortsighted,

I mean, if you (allegedly) did this to someone else, why would you be surprised if it happens to you?

Re:

[arth1]

And, given the widespread belief Israel was involved in Stuxnet ... to suddenly be bit by this seems a little shortsighted,

I mean, if you (allegedly) did this to someone else, why would you be surprised if it happens to you?

Live by the sword, die by the sword.

And yes, there is a lot of evidence that Israel is behind much of the cyberwarfare in general, and of malware in particular.
They shouldn't act surprised if what goes around comes around.

Re:

[cavreader]

"what goes around comes around" It certainly does but Israel has a history of retaliatory actions against those who threaten their state. They don't ask for permission, they don't apologize, and they don't believe in "proportional" responses.

Pot meet kettle

[xxxJonBoyxxx]

How do you pronounce "Stuxnet" in the Hebrew language?

Re:

[Anonymous Coward]

Oy Vey?

Re:Pot meet kettle

[AmiMoJo]

That's the problem with introducing a new weapon - if your enemies hadn't already thought of it, they have now, and if they hadn't wanted to escalate to actually using it, they will now.

How long until we see drone strikes in Israel or the mainland US?

Re:

[Number42]

But English started out as a mishmash of various Germanic languages to begin with, so it doesn't have any vocabulary to call its own.

Re:

[Triklyn]

randall munroe you heathen.

Re:

[Sun]

No, not even close.

It is true that modern Hebrew is not the same as Biblical Hebrew. The later no one actually speaks these days (aside from recital during prayer). It is also true that modern Hebrew has many roots in Polish and German grammar (not so much Russian). It is also true that the vocabulary is affected by cultural neighbours, including Arabic and English. All of those, however, do not mean the language is dead. Quite the contrary.

It is a dead language that does not accept influences from other la

I'm amazed it's taken this long

[ErichTheRed]

There are so many vulnerable SCADA systems, device-specific Ethernet adapters and other stuff out there, and it just chugs along for years and years. Especially with public sector stuff, multiple layers of contractors put gear in, barely document it and hand it over to the operating authority. The problem is that since no one permanent knows the ins and outs of the system, it can stay vulnerable for ages. Even if a vendor does release patches, the "don't touch it or 500K customers lose power" mentality around critical infrastructure means they barely ever get applied.

Anything IoT is going to have to be secure by default, as in, hard to get working instead of open and easy. I doubt the "just contract it out" mentality is ever going to go away in the public sector -- I've inherited systems where the only documentation is a statement of work from 5 years back that the contractor cut and pasted from the vendor's manuals.

Re:

[campuscodi]

Check the update at the end of the article.... ransomware does not run on SCADA systems. Now how do you feel about posting that rant? You've just wasted 10 minutes of your life writing that :))))

Re:

[Mr D from 63]

It seems that they actually were in a position to quickly identify and respond to the threat. That doesn't happen by accident. And without knowing details of the attack, many here will simply make unfounded assumptions about what was done wrong.

Re:

[Fire_Wraith]

I wouldn't blame the news organizations entirely. The Israeli Energy Minister was serving up a nice heaping scoop of FUD and political spin, trying to portray what looks now to just be a garden variety ransomware infection (probably some employee surfing for porn on a work computer) as a big dangerous targeted nation state attack. Certainly, the news folks ate it up, and didn't bother to ask the questions that should arise when you hear wild initial reports like that.

Re:

[gstoddart]

Have you not being paying attention lately?

In a lot of countries someone could have a loud fart and the threat alert would ratchet up ... the world is jumping at shadows these days.

Israel has just been doing it longer.

Re:

[lhowaf]

Present company excepted.

Re:

[Triklyn]

... you're not being paranoid if everyone really is out to get you.

if anybody is perfectly justified at jumping at shadows, i'd say it's the jews.

they've been holocausted once, repelled 2-3 unprovoked acts of aggression by EVERYONE within the first 30 years of founding a nation... and probably have a pretty healthy and pretty warranted genetic fear of religious persecution due to something like a couple millenia of jew-baiting.

Israel targeted by electric malware ..

[tetraverse]

No guesses as to what operating System this electric malware runs on.

UPDATED: Not an attack on infrastructure after all

[markzip]

From TFA SANS ICS cited [sans.org] at the end of the Slashdot summary:

*Update* A cyber analyst in Israel (Eyal Sela) messaged me to add that the media reporting so far is misleading with regards to the context around the incident. The "Israel Electric Authority" the Minister mentioned is in no way related to the networks of the Israeli electric companies, transmission, or distribution sites. The Israeli Electric Authority is a regulatory body of roughly 30 individuals and this "cyber attack" is only referencing their

Re:

[Bobert13]

so, there's yet another politician who doesn't understand the technology he's supposed to be in charge of and a whole lot of news agencies who completely failed to check their facts. So basically, it's Thursday.