Cyber nightmares: For the sake of nine million
By Shayne T Wright
Copyright 2012 Shayne T Wright
Version 2.0
Major south east Australian gas pipelines.
Iona gas storage facility, surface operations plant.
0930 AEST / 2330 GMT
Computer Emergency Response Team,
Canberra,
Australian Capital Territory
Chris Whiteman punched the power button on his laptop docking station as he reclined back in his office chair, well not so much reclined as fought against the hard, inflexible plastic frame, lined with minimal foam padding and covered with a classic stain absorbent fabric. The hard fabric seat had seen better days, much like the occupant, not to mention the stale instant muddy water which was supposed to pass for coffee. Over the past few years with the Australian Computer Emergency Response Team (CERT), Chris's optimism had slowly faded and the chairs ability to mould with his bodies movement reflected the departments typical approach – the chair probably thought it was doing a good job of propping up his expanding frame but in reality it just couldn't do more than keep him in an uncomfortable yet upright position.
He mused that what he was experiencing was probably typical of most things within the wider government cyber defence community, a focus on functionality and conformity over individuality and effectiveness, however he felt no ill will. Sure, his frustrations did boil to the fore every now and then when bureaucratic process ham strung his teams’ effectiveness but his ability to still think outside the box had shone through more than once this year. The one thing he desired more than a decent chair, was the one thing he had no control over but the great unseen enemy had in spades – agility.
Chris rolled his eyes over to the wall clock, noting his usual Monday morning boot up time was creeping past ten minutes.
0945 AEST / 2345 GMT
Iona gas plant – main gate,
near Port Campbell,
Victoria
Mark Bowden, a security guard with over 20 years behind the wire, was flicking through the national news on his iPad as he noted an unscheduled delivery truck rolling up to the Iona gas plants' main gate. Mark gently placed his cup of freshly brewed coffee down next to the iPad and lurching forwards, he gained the necessary momentum to rise and subsequently strolled out to meet the driver.
“Morning buddy. I wasn't expecting anything till ten.”, Mark queried.
“Yeah, well...I suppose the bloody computers got their wires crossed. Our system is always on the blink. You should have got an email about me, a delivery for warehousing.” The mystery driver offered.
“Give me a minute to check the system”
Mark ducked back into the guards’ office to flick through the iPad apps, looking for expected deliveries. Upon punching the refresh icon, an update came through detailing an early morning shipment of parts destined for maintenance.
Stepping back outside to the waiting driver, Mark spoke up over the bone chilling wind that was blowing in from the Bass Straight.
“She's good mate. The system just had some lag in it.”, Mark moved into the lee of the medium rigid truck, seeking relief from the wind. “I'll remotely open the gate and then you can head on through to the warehouse.”
1000 AEST / 0000 GMT
Iona gas plant – operations office,
near Port Campbell,
Victoria
Leon de Mann, the Iona plant general manager for the past two and a half years, reviewed his pre-winter storage status in preparation for his first quarter report to the executive leadership team.
Storage was on track with the North Parratte and Iona fields having passed 98% capacity. The Wallaby field was sitting at 96% however this was expected to surge over the next week with the South Australian Moomba gas facility sub-contracting an extra 2% to enable on time delivery of capacity for the coming winter.
Leon’s iPhone vibrated in his suit breast pocket. As he pulled it out, the display indicated that it was his opposite number in Melbourne, Peter McDougal.
“Hello Peter, what do I owe this honour?” ventured Leon, his broad Afrikaans accent still as thick as the day he arrived in Australia.
“Leon, do you guys have a maintenance problem right now? What is going on with the South West pipeline?” Peter blurted out bluntly.
“Peter, what are you on about? You have had too many Lygon street espresso specials this morning, slow down.”, quipped Leon as he bought up the live plant status on the internal system, “My dashboard indicates flow rates are normal for your 350 Tera-Joules of LNG today.”
“Well you better check it by hand because we have pressure dropping fast down here in Melbourne. Within the hour we are going to have to shut down the non-essentials if you don’t get it back up. Plus I can’t raise you or your office on the VOIP lines.”
“Peter, you had better be pulling my leg or something mate.” Leon responded, a tremor seeping into his normally steady tone.
“No I am not yanking your chain. The bloody board does not correlate with the flow. I think the IT guys haven’t fixed our problem and now the shit is going to hit the fan”.
And like a prophecy, Peter’s warning came home to roost as the Iona site evacuation alarm sung out across the site.
1015 AEST / 0015 GMT
Computer Emergency Response Team,
Canberra,
Australian Capital Territory
As Chris’s eyes noted the office wall clock was just turning over 11:30 and his mind drifted towards lunch, the desk phone flashed. Pre-emptying the annoying ring tone, his left hand shot across the built up desk clutter as the caller ID flashed up, “Watch Dog”.
“Chris speaking”, he queried.
“Chris, this is Watch Dog operations. We have a problem. Briefing room in five minutes.”, the voice stated.
“On it!”, Chris exclaimed, slamming the handset home as his adrenaline levels surged.
1045 AEST / 0045 GMT
Computer Emergency Response Team – Melbourne facilities,
Melbourne,
Victoria
Michael Cadmore, TruEnergy CEO, was lead into CERT’s Melbourne secure teleconference facility. As he sat down, habitually placing his iPhone onto the table just within his peripheral vision, the teleconference monitor came to life. The wall monitor showed a mirror image of the room Michael was occupying however the other room held two other parties whom were physically located at the CERT facilities in Canberra..
“Mr Cadmore, I am agent Chris Whiteman and this is my colleague Tom Sandford.”, Chris introduced himself and Tom with an acknowledging wave of his hand. “We have been apprised of your situation however, given the circumstances, we need you to confirm the fundamentals”.
Taking his que, the CEO launched into a description of the pathway that had lead his company to the ruinous ravine edge that they now faced. A scant 18 months prior, the entire board had been embroiled in the social engineering fiasco that had arisen out of China, termed ‘Night Dragon’. This had resulted in the compromise of key company secrets including highly sensitive personnel information. Subsequently, the company had failed to win a number of key contracts which culminated in the loss of critical LNG deals. The resignation of several experienced senior personnel followed swiftly. Publicly it was due to alternative opportunities but behind closed doors it was due to the justifiably valid concern of dirty laundry being aired as the blackmailers became increasingly personal in nature with key board members. A strengthening of IT corporate security, combined with an increased cyber-awareness program, was supposed to mitigate the ongoing threat, according
to the CIO. Emphasis on ‘supposed to’, as only a few months later the control system intrusions and blackmailing began in earnest.
It began with what appeared to be random uncommanded activities across the PLC system at the Iona plant combined with fluctuations in the off-shore pressure regulators. After five weeks, the first demand arrived. The initial correspondence had been directed solely to the CEO via his personal iPhone. USD$500k per month to ensure production remains under TruEnergy control accompanied with very explicit terms and conditions that all bore the same basic consequence, catastrophic loss of control of the Iona gas plant system and associated infrastructure.
The CIO had investigated the demands and had managed to piece together that the threat was credible. The results of the investigation had identified a number of intrusion fingerprints over the past weeks but what was of most concern, was the unseen trails. Instances of delayed PLC control adjustments were the most numerous and concerning. The time difference between command and