Hackers targeting internet-connected systems to steal oil, expert warns

The high price of oil, and an increasingly software-reliant network of sensors and monitoring tools are making the oil trade a high target for hackers

 In a proof-of-concept attack, a security researcher and his team showed how they could empty an oil tank remotely exploiting weakness in common business software. Photograph: Morteza Nikoubazl/Reuters

Olivia Solon in San Francisco

Friday 4 March 2016 22.08 GMTLast modified on Saturday 5 March 201610.09 GMT

• Share on Pinterest
• Share on LinkedIn
• Share on Google+

Shares

118

Comments

10

 Save for later

Oil and gas companies should be extremely concerned about the threat of hackers targeting critical infrastructure as they attempt to steal commodities or cause explosions, a security expert has warned.

Alexander Polyakov of the software company ERPScan said the threat is particularly acute now that oil prices are so low, putting the industry under increasing pressure to cut costs.

“Oil and gas is a critical industry, with so many different critical processes,” he told the RSA security conference in San Francisco.

NSA accused of spying on Brazilian oil company Petrobras

Read more

From the oil rig to the petrol station, there are many pieces of software within the oil business that can be targeted. Every point in this supply chain is increasingly reliant on sensors that monitor and measure pressure, fuel levels, pipeline flows, quantities of oil, temperature and whether equipment is working properly. All of this information is managed by business applications created by companies such as SAP and Oracle, he said.

By targeting these pieces of internet-connected software, says Polyakov, it is possible to carry out deadly assaults remotely.

Polyakov showed how he and his colleagues were able to create a proof-of-concept attack to empty an oil tank without detection using the oil company’s monitoring software – in this case a system created by SAP.

Just as tanks can be emptied without detection, it’s also possible to put oil back into the system without detection – a strategy that might be appealing to terrorist organisations looking to launder the oil from Iraqi production facilities it controls.

“We did it with three guys who spend a few months finding vulnerabilities. They have much more power,” Polyakov told the Guardian.

He also explained how attackers can also target a safety feature called a Burner Management System (BMS) used to safely startup and shut down furnaces used at various stages of gas-oil separation. This system is “easy to manipulate” to create a malfunction that could lead to an explosion, Polyakov said.

Oil companies should be “very worried” about these potential exploits, he said.

Some 43% of global mining, oil and gas companies were hacked in 2014, according a study by cybersecurity firm Symantec. In a separate study by Trend Micro some 47% of energy firms reported attacks - the higher than any other corporate sector, and eclipsed only by governments.

Oil companies targeted by hacking attack

Read more

Meanwhile there have been several high profile cyber-attacks on energy companies including one in December 2015 that targeted a Ukrainian power grid. The incident, which has been attributed to state-sponsored Russian hackers, caused a blackout in a large part of western Ukraine.

In 2012, Saudi oil company Aramco was hit by malware that partially wiped or destroyed 30,000 computers. A group calling itself the Cutting Sword of Justice claimed responsibility for the strike, citing the company’s support of Saudi Arabia’s royal family.

Former NSA chief Keith Alexander described the Aramco incident as a “wake-up call for everybody”.

Back at the RSA Conference, one US government cybersecurity researcher, who didn’t want to be named, told the Guardian: “This is a stunningly active threat facing the critical infrastructure in the US right now, and if it’s not being taken seriously you’re being seriously naive. It’s time to address these issues.”