Home > Research > Publications & Outputs > Identifying infected energy systems in the wild

Electronic data

  • eenergy19-paper86

    Accepted author manuscript, 469 KB, PDF document

    Available under license: CC BY: Creative Commons Attribution 4.0 International License

Links

Text available via DOI:

View graph of relations

Identifying infected energy systems in the wild

Research output: Contribution in Book/Report/Proceedings - With ISBN/ISSNConference contribution/Paperpeer-review

Published
Publication date25/06/2019
Host publicatione-Energy 2019 - Proceedings of the 10th ACM International Conference on Future Energy Systems
Place of PublicationNew York
PublisherACM
Pages263-267
Number of pages5
ISBN (Electronic)9781450366717
<mark>Original language</mark>English
EventTenth ACM International Conference on Future Energy Systems (ACM e-Energy) - Phoenix, AZ, United States
Duration: 25/06/201928/06/2019
Conference number: 10
https://energy.acm.org/conferences/eenergy/2019/

Conference

ConferenceTenth ACM International Conference on Future Energy Systems (ACM e-Energy)
Abbreviated titleACM e-Energy 2019
Country/TerritoryUnited States
CityPhoenix, AZ
Period25/06/1928/06/19
Internet address

Conference

ConferenceTenth ACM International Conference on Future Energy Systems (ACM e-Energy)
Abbreviated titleACM e-Energy 2019
Country/TerritoryUnited States
CityPhoenix, AZ
Period25/06/1928/06/19
Internet address

Abstract

The 2016 Mirai outbreak established an entirely new mindset in the history of large-scale Internet attacks. A plethora of Mirai-like variants have emerged in the last two years that are capable to infiltrate any type of device. In this paper we provide a 7-month retrospective analysis of Internet-connected energy systems that are infected by Mirai-like malware variants. By utilizing network measurements from several Internet vantage points, we demonstrate that a number of energy systems on a global scale were infected during the period of our observation. While past works have studied vulnerabilities and patching practises of ICS and energy systems, little information has been available on actual exploits of such vulnerabilities. Hence, we provide evidence that energy systems relying on ICS networks are often compromised by vulnerabilities in non-ICS devices (routers, servers and IoT devices) which provide foothold for lateral network attacks. Our work offers a first look in compromised energy systems by malware infections, and offers insights on the lack of proper security practices for systems that are increasingly dependent on internet services and more recently the IoT. In addition, we indicate that such systems were infected for relatively large periods, thus potentially remaining undetected by their corresponding organizational units.