Stealthy Rootkit Attacks on Cyber-Physical Microgrids

Abstract

Cyber-physical microgrids hold the key to a carbon-neutral power sector since they enable renewable and distributed energy resource integration, can alleviate overloaded distribution systems, and provide economic energy by generating and consuming power locally. The utilization of cyber-physical assets such as controllers, IoT sensors and actuators, and communication devices can enhance the stability and improve the control of microgrids. However, such assets, if maliciously operated, can become attack entry points and jeopardize the grid operation. Blind and uncoordinated cyberattacks can be identified by existing security measures overcoming potential operational disruptions. However, rootkit attacks can stay hidden within cyber-physical systems and leverage system information to mask their presence. Rootkit detection is a strenuous process and requires advanced security methods due to their sophisticated operation. A careful analysis of possible rootkit target locations and their exploitation techniques is necessary to design effective threat detection and mitigation mechanisms. This paper discusses the cyber kill chain of a rootkit which can simultaneously deploy itself at multiple locations in a microgrid in a coordinated and stealthy way in order to maximize the impact on power system operations. The rootkit leverages system measurements to hide its presence and its attack impact from the detection mechanisms. CCS CONCEPTS• Security and privacy → Malware and its mitigation; • Hardware → Smart grid.

Behind Closed Doors: Process-Level Rootkit Attacks in Cyber-Physical Microgrid Systems

“…Rootkit attacks should represent a crucial part of reliability assessment procedures for certification laboratories, tasked with identifying and eliminating vulnerabilities in embedded control devices and designing experimental testbeds for evaluation of cyber-physical power systems [4], [7]. This paper extends our previous work-in-progress on stealthy rootkit attacks [8], and highlights a potential rootkit attack path after the installation of the malware at multiple locations within the MG. After its deployment, the rootkit aggregates system measurements to build an accurate system replica allowing the estimation of the MG states trajectories; in our case, using a neural network-based approach. We demonstrate different approaches that rootkits could utilize to conceal their presence (during the system information aggregation phase) and disguise the attack impact overcoming existing security fortifications exploiting system state estimations.…”

“…In this work, we build on the concept of process level rootkit attacks hiding their presence in cyber-physical MGs [8]. Once the rootkit gains access to various MG elements (e.g., controllers, actuators, etc.…”

Distributed Energy Resources Cybersecurity Outlook: Vulnerabilities, Attacks, Impacts, and Mitigations

“…On the other hand, in the advanced persistence threat (APT) case, threat actors might prioritize system persistence, breach of privacy, and long-term system degradation instead of immediate impact, and opt for more sophisticated and stealthy attacks [98]. For instance, attackers could remain in control of the DER device while stealthily performing minute modifications to system parameters or coordinate attacks in ways that will not affect the net system behavior deceiving detection mechanisms [99], [100]. Such stealthy attacks might cause unsafe, unstable, or uneconomic operation of IBRs.…”

“…), since DER devices might be connected in user-owned home networks. Attackers may also be learning the operational patterns of DERs, that is, aggregating enough system information to identify the temporal and spatial conditions which, if satisfied, can maximize the impact of attacks on the grid [99], [101].…”

Microgrids in mission-critical applications

“…Clearly, trustworthiness of the communication network is of paramount importance for reliable operation of the control framework present in the microgrid system. However, this may not be the case as inadequate security measures in ICT expose the microgrid to additional cyber vulnerabilities, which may be exploited by malicious actors to jeopardize reliability of the control system and disturb working of the overall vehicular body [16]. These vulnerabilities can either be at the sensor, the communication and/or the controller level.…”