Original subtitles

BEN: The critical systems that keep society running

are connected.

These systems are more and more connected

to the internet quite openly.

They're just kind of open game.

But it's exposing them to a massive security risk.

If you can access it remotely, so can everybody else.

Cyber attacks are on the rise.

You don't think this is just needless fear-mongering, do you?

I wish it was.

Then I could sleep a lot better.

Malware has infected critical infrastructure everywhere.

We've gotta begin to think about what are the rules of war

if, God forbid, you wind up with a cyberwar.

Will cyber attacks trigger an all-out war?

♪

The industrialized world runs on an infrastructure

that we take for granted.

When things are running well,

they're pretty easy to forget about.

But critical infrastructure

has always been a prime target in war.

Destroying a power grid or water system can paralyze the enemy.

And as more and more of that kind of infrastructure

is connected to digital networks,

experts are finding it's also vulnerable to cyber attacks.

In the control system world, if something fails, it's obvious.

The lights go out, a pipe breaks.

What you don't know is:

did cyber play a role in what happened?

Joe Weiss has been an industrial control systems engineer

for almost 40 years.

Joe took me to a power station in California.

That state's power grid was allegedly hacked by China

in the early 2000s.

ICS stands for Industrial Control Systems.

It's essentially a ubiquitous term

that we're using to cover this range of things

that monitor or control physical processes.

So like what you see over here,

all of this stuff is controlling the electric system.

So someone from China could effectively gain access

to a network that's controlling something in California?

Yes.

I don't think there's any question that there are

nation states that are targeting critical infrastructure.

Electric, water, pipelines, you name it.

We've already had, many years ago, documented

where China did try to meddle with things here, like this.

What did they do?

They hacked into what's called

the California Independent System Operator,

which is in Folsom, California.

Which is what, on an overall basis, controls this.

And if they had, what are the sorts of things we could see?

'Cause that's obviously an attack, right?

That was obviously an attack, correct.

And what would've been a fallout if they...

Again, depending on what they would've done,

they could've affected, you know, power

to hundreds of thousands of customers.

Shut down California, one of the most important states?

Well, they could've certainly played havoc with the grid.

This attack is just one case.

The real turning point was in 2009.

It was a sophisticated computer virus called Stuxnet,

and it infiltrated and destroyed nuclear centrifuges

at a controversial uranium enrichment plant in Iran.

Observers agree the attack was likely

a joint US/Israeli operation.

The critical infrastructure war was on.

But I wanna know how hackers get inside critical infrastructure

in the first place.

Nice to meet you.

- Ben. - A pleasure.

Meredith Patterson is an expert in protocols,

the instructions machines use to communicate with each other.

A control system is just a system that takes some

reference value and then monitors a centrifuge

or a turbine or a fan, any kind of device

that has some property that can be measured.

Temperature, speed, direction, whatever.

Like a power plant, or a nuclear power plant,

or critical infrastructure.

Yeah, a dam, anything like that.

And are these things secure?

Well...

one of the problems with industrial control systems is

that the protocols that are used in them are extremely complex.

So if you have systems from different vendors that are using

different implementations, you can sometimes end up with

crosstalk essentially, because they're speaking

different dialects of the same protocol,

and one ends up introducing a mistake into the other.

So if I'm reading this correctly,

you're saying that at times the software involved with

some of the most critical infrastructure we have,

like nuclear power plants, can break down?

Can the code essentially... like there's an exploit?

There's a vulnerability?

MEREDITH: That's exactly what I'm saying.

Vulnerabilities are driven by the inputs

that people send into systems.

And so if an attacker has any way to control or modify

the input that is being sent to a system,

they could send it false inputs,

they could send it syntactically incorrect inputs.

It is remarkably easy to just mess with

the temperature some place, in a natural gas plant,

and catch the entire plant on fire.

I mean...

- Really? - Oh yeah.

Baytown near Houston just frequently has problems

where a refinery catches,

and the entire river goes up for about a day.

And that's something that could be done

if someone got into the system?

This is something that happens by accident already, right?

So if... if somebody were to get into the system,

then yes, you could totally set the river on fire.

That threat is real,

and the highest levels of government know it.

Michael Chertoff was the Secretary of Homeland Security

under George W. Bush.

He now runs a cybersecurity consulting firm.

What's the biggest threat to America's

critical infrastructure?

What's the thing that scares you the most?

Well, you know, if you're talking about what would cause

the greatest consequence, I would say anything that affects

transportation, energy or finance, or healthcare

would potentially have a very, very big impact

on the United States.

But here's the dangerous thing.

We're now moving into what they call the Internet of Things,

where everything is gonna get, quote, "smart".

So as we build out all these, you know, widgets that have

connectivity and wireless, we've gotta think to ourselves

what happens if somebody enters using that wireless and begins

to affect the actual physical operation of the system?

There's also a lot of debate about what the laws of war

would be if we did have a cyber conflict.

And again, that's not about stealing information.

That's literally about using cyber tools to blow up something

like a power plant, or to kill people

by causing an airliner to crash.

And so we've got to begin to think about how do we...

what are the rules of war if, God forbid,

you wind up with a cyberwar.

Critical infrastructure is clearly a target,

and attacks against them aren't a pipe dream,

they're actually happening.

BEN: I go to meet someone who knows about

hacking critical infrastructure and works to prevent it.

Chris Kubecka is an independent security consultant.

She says she first got into hacking as a kid.

What'd you hack into?

The FBI and the Department of Justice.

And how old were you?

- I was 10. - What?!

And I had no idea I was really doing much of anything

'cause it was really easy.

Back in August of 2012, malware dubbed Shamoon infected

the network of Saudi Arabia's national oil and gas company,

Saudi Aramco.

Kubecka was hired to assess the damage.

Why don't you tell me what Shamoon is.

Shamoon was a piece of malware that began to randomly wipe

over 35,000 Windows-based computers in Saudi Aramco.

When it was discovered what was going on,

individuals inside Saudi physically pulled plugs

to keep it from getting further.

And what was the damage?

The damage was about 85% of their IT systems

were knocked out, and when I say IT systems,

it wasn't just your desktop computer.

It was the servers they connected to, payroll systems,

databases, any sort of data that held research and development,

all the way up to the voice of our IP phones.

Did that target any...

let's say critical infrastructure, oil production?

Yes.

It appeared that the attack was meant to target

the production systems to take them down.

So it was actually a critical infrastructure attack?

Yes, absolutely, it was targeting it, yes.

Who did it?

According to Saudi Aramco, they think that the Iranians did it.

And would you agree with that?

It seemed like it was an extremely political attack

done in a way that was extremely damaging

to Saudi business culture.

It seemed like either it had to do with a group

related to the Saudi Arab Spring or Bahrainian Spring,

which was going on at the same time,

or perhaps it was Iranian.

Have critical infrastructure attacks increased

since Stuxnet and Shamoon?

Yes, they have, absolutely.

More and more people are aware of them.

So now curiosity is peaking.

And if you went from just writing code

to writing code and being able to move things...

attacks are gonna get more and more as curiosity peaks.

And also, these systems are more and more connected

to the internet quite openly.

They're just kind of open game.

The Shamoon virus was probably the most destructive attack

that the private sector has seen to date.

After Shamoon, US Defense Secretary Leon Panetta

sounded the alarm.

The collective result of these kinds of attacks

could be a cyber Pearl Harbor.

How would cyber attackers find their targets?

I learned, in fact, that there's a search engine called Shodan

dedicated to scanning devices connected to the internet.

John Matherly is its architect.

So what am I looking at here?

Shodan is a search engine that unlike Google,

which just looks at the web, Shodan looks at the internet,

which can include much more than just the web.

All these device are becoming connected,

and Shodan finds them.

It can be buildings, water treatment facilities,

factories, webcams, offices,

everything that you can possibly imagine.

If it can have a computer inside it, Shodan's found it.

So this is a 3D globe where the red dots represent

publicly accessible control systems.

So these are control systems

that are exposing their raw protocols.

There's no authentication on any of these.

You just connect, and you have full access.

BEN: America is just a big red blob.

That's not good.

Most connected country in the world.

It's not that surprising, I guess.

Very, very connected.

What was one thing you saw where you said to yourself,

like, "How the hell did this get up online?"

There are a lot of things like that.

(Laughing)

A big one was one in France.

It's the hydro electric dam,

churning like a few megawatts of power.

It was pretty big.

And actually, I can show it.

And this one actually had a web interface,

which is unusual, that showed a real-time view

of how much power was being generated.

And it also had all sorts of other stuff exposed.

That's actually a common theme with ICS devices.

They will give you serial numbers,

they're gonna give you firmware versions,

because it was meant for engineers to maintain remotely.

And if you're a remote engineer,

you wanna know what you're working with.

And then you look at the history of it,

and there's a history of flooding.

Like there are known flooding instances of this dam.

And it took 2 years of poking and prodding

for these guys to secure it.

Do you think something this vulnerable and this shitty

is lying around in the US somewhere?

Most likely, yes.

A lot of the guys operating these things don't understand

that if you can access it remotely without logging in

over the internet, so can everybody else.

Shodan proves that critical infrastructure is in danger

all over the world, but who else has figured that out,

and what are they doing with it?

BEN: Everyone was telling me that

critical infrastructure control systems

were not only outdated, but ripe for an attack.

If accessing them could be as simple as finding them

on the internet, how hard could it be to trigger

the nightmarish damage everyone was warning about?

I went to meet Stuart McClure,

the founder and owner of a security firm called Cylance.

He shows me a device called a Programmable Logic Controller,

or PLC.

PLCs have been around since the 1960s, but in the digital age,

they're the weak link for hackers to exploit.

First off, why don't you explain to me what a PLC is.

Yeah, a PLC is a Programmable Logic Controller.

Basically it controls the physical world

by programming, or computers.

So you typically find these though

in a lot of critical infrastructure, right?

Absolutely.

Any kind of oil and gas or industrial control systems.

Anything that tries to control, like I said,

the physical world or physical elements

for power or oil and gas, transportation, you name it,

they all require the use of PLCs in some form or fashion

to make them work every day.

As I understand it, PLCs are quite buggy and easy to exploit,

are they not?

Well yeah, they're built on 30, 40 years of code that has

really never been audited for security, or very rarely.

So they often have a lot of vulnerabilities and exploits

that have yet to be discovered.

And of course, hackers love that.

So you know how to hack a PLC?

Yes.

And you're gonna show us?

Yes, absolutely.

Let's get to it, let's try it out.

So what this is is a rig that we built

to represent the physical world out there that usually has

very large versions of these things.

This PLC is hooked up to this air pump and compressor,

which is going to allow us to over-pressurize a bottle

and make it explode.

So...

BEN: And are you gonna run any code on it?

STUART: I am.

I'm actually running code that we have in Python right now.

First we set our variable to the IP address of the PLC.

Then override our memory address here, MX0.0, which is

the area in ladder logic which allows us to control

the safety disable, and override that, which allows us

to control the PLC itself and do anything we want with it.

So would you like to do the honours?

Alright.

Just hit enter.

(Loud buzzing)

(Explosion)

Woo!

STUART: Judas Priest!

That actually sounded like a bomb.

Yeah, now I won't hear for a while, but that was good.

Why is it so easy to control a PLC?

Well, it's so easy because

the way that these things have been designed,

they never really considered security from the ground up.

So when they designed them, they designed them just to work.

Now what's happening is more and more of them

are getting hacked up, which is requiring manufacturers

to go back and redesign them.

And you don't think this is just needless fear-mongering, do you?

I wish it was.

Then I could sleep a lot better.

You can make it more difficult,

you can make it more challenging, but

at the end of the day it's built so foundationally insecure that

it makes it incredibly easy for attackers to gain access.

All the experts I've spoken say our critical infrastructure

is vulnerable, and I wonder what Washington is doing about it.

The best guy to ask that question is Michael Daniel.

He advises President Obama on cybersecurity issues.

So what's the attack that keeps you up at night?

I would say it's one that is focused on our

critical infrastructure that has some unintended consequences.

That's the one that really I think worries me,

because we don't really actually understand how these incredibly

complex systems actually interact with each other.

So you fear that another superpower might infiltrate

critical infrastructure and set off an unneeded conflict?

So that is certainly a concern, although I would actually say

that I'm less worried about that than I am other actors

that have less interest in the overall sort of

international current, you know, status quo.

Who are these adversaries?

So you know, the Director of National Intelligence

has talked about them in his testimony.

So Iran and North Korea certainly top the list.

Although we are not unconcerned about terrorists

and other actors who don't bill themselves so much

as terrorists, but certainly cyber hacktivists and others.

Everything's crackable.

You cannot prevent all cyber intrusions.

That's just impossible.

You'll never be able to prevent all of them.

Everything is penetrable eventually.

Everyone's told me that no critical infrastructure system

is bulletproof, and one US government agency

is trying to keep track of the cyber attacks

happening across the country.

I'm about to meet with Martin Edwards,

who's the guy tasked by Homeland Security

at ICS-CERT to protect US critical infrastructure

against a cyber attack.

BEN: Edwards is somebody who knows the cyber attacks

being lobbed at America's critical infrastructure.

This sort of looks a lot like Enemy of the State or something.

So what you're in is you're in the National Cybersecurity

and Communications Integration Center,

which is more or less the DHS Operations Center for Cyber.

These are where all the different analysts

from ICS-CERT, US-CERT are actively defending

the country's networks.

In 2015 alone, the Department of Homeland Security

spent $1.25 billion on cybersecurity.

You know, we've cleaned up the place a little bit

for you to come in, but it's definitely

a very highly active environment all the time.

Edwards has declassified the control room,

so we won't see any real-time threats, but it still gives us

a rare look into their nation-wide monitoring system.

And how does ICS-CERT protect the United States?

Yeah, it's tough, it's tough.

It's a big problem.

If there is an incident, either criminal or nation state level,

we'll send an instant response team to those companies to work

hand-in-hand with them to clean up, mitigate the event.

Do you see an awful lot of nation state actors going after

critical infrastructure?

I would say we see the whole spectrum.

They all look different, and we save the word "attack"

for something that is purposeful and intentional

with an intentional consequence.

A lot of what we see is sort of reconnaissance, and then

of course yes, we do see the nation state level actors

either in the espionage business

or prepping the battlefield type of perspective, right?

So you're trying to understand the infrastructure

for some future unknown use.

So if most threats Homeland Security see are about

espionage, at what point does a cyber attack cross the line?

At what point does the administration consider

a critical infrastructure attack an act of war?

So that is not something that is well defined.

Fortunately we haven't seen one of those events here

in the United States in a way that would, you know,

probably cross that threshold.

And so therefore I think that we focus on, you know,

really raising the level of cybersecurity

in our critical infrastructure.

It's one of the areas that we've worked very hard on

over the course of this administration.

Even as the US tries to shore up its cyber defenses,

there's little incentive not to attack.

You know, mutually assured destruction

is another way of describing deterrence.

If you attack me, I will fight back, and therefore

it's not in your interest to attack me in the first place.

And that's where the difficulty of proving

who actually launched an attack becomes a major issue,

because it's very rare for a nation state or a criminal group

to go directly from the server it controls at the target.

They will often launch from around the world.

They may hop multiple points.

They may enlist computers that they've hijacked

as being the spears basically that they throw at the target.

I mean, you're painting a pretty dark picture then.

When you get attacked, even if it's major infrastructure,

the first question is: how sure am I that I know the country

that either caused it or allowed it to happen?

And that ambiguity and that uncertainty is one of

the obstacles to having a very clear deterrent policy.

Experts and hackers agree that a new war

on critical infrastructure has not only begun,

it's well underway.

♪