Pay up - or else [ransomware attacks on industrial infrastructure

Abstract

New information about the capabilities of Stuxnet revealed in the recent documentary film 'Zero Days' has revived concerns about the potential impacts of cyber attacks on critical infrastructure such as power stations, chemical plants and fuel refineries. The movie explains with chilling resonance how, in 2010, the state-sponsored Stuxnet worm managed to gain destructive control of the programmable logic controllers (PLCs), which automated electromechanical processes inside gas centrifuges used for isotopic separation of uranium at Iran's Natanz nuclear facility. While such attacks have caused their share of problems to power stations and utility assets around the world, the newer effects of ransomware has yet to openly turn its disruptive powers on the computerised systems that monitor or manage the physical state of an industrial or infrastructural control system - physical devices such as pumps and valves. This is set to change, warn industry experts, as cyber criminals figure out how to repurpose their dark arts into a profitable model for targets in operational technology (OT) environments.