CHAPTER 1
Grace Hopper Cyber Security Studies Center United States Naval Academy, Annapolis, Maryland One year later
“Thirty-six million people—including this institution—without power for nearly twelve hours. Forty-six traffic fatalities, twelve people dead in hospitals with inadequate backup power systems, and three men dead in an explosion at ground zero of the hack: Allegheny Power and Light.”
Don Riley paused, allowing his gaze to roam over the dozen uniformed midshipmen in his seminar class. He always included this incident in the syllabus, since they’d all lived through it or at least knew someone who had.
Nearly all the midshipmen were seniors—first-classmen, in Naval Academy parlance—except for two. Midshipman Second Class Andrea Ramirez’s dark eyes followed him like a hawk as he spoke. She seemed to be committing to memory not just his words but every move he made. Next to her sat a fourth-class midshipman—a freshman, or plebe as the upperclassmen called them.
To have a plebe in an advanced seminar broke every rule of Naval Academy etiquette, but Don had insisted. Midshipman Fourth Class Michael Goodwin was no ordinary plebe. He was Don’s special project.
The Academy, like every other institution of higher learning in America, had a well-established recruiting program for athletics. No one thought twice about spending money and resources to track down and lure the best possible athletic candidates to the academy. Don just applied the same recruiting logic to the Cyber Security Studies program. After all, that was why US Cyber Command lent him to the Academy as a guest lecturer: to get first crack at the new talent like Goodwin.
By any measure of intellect, Michael Goodwin was a prodigy. By any measure of societal norms, the fact that he was sitting in this classroom was a miracle.
Goodwin’s face was still as he watched Don, his dark skin smooth, his jaw relaxed, his eyes vacant as if he were daydreaming. Don had seen this look before on Goodwin. He wasn’t daydreaming, he was seeking inputs.
Don cleared his throat and continued. “The attack originated via an email to a midlevel employee in the admin department of Allegheny Power. The user clicked on a link which downloaded malware onto his computer. The malware used a security flaw in a print driver to infect any computer that was connected to that printer.”
There was a snort of disbelief from the back row. “Problem, Midshipman Powers?” Don asked a tall, whip-thin brunette sporting the rank of a company commander on her collar.
“It’s just amazing how stupid people can be, sir. I mean, who clicks on random links?”
Don pursed his lips. “Would it change your mind if I told you that this email was supposedly from the individual’s mother? Also, the subject line indicated that it was about his father, who happened to be in the hospital receiving treatment for advanced pancreatic cancer. Would that change your attitude, Ms. Powers?”
The midshipman dropped her gaze to her desk.
“Given this new information, what can we surmise about this attack, people?”
“That the employee was targeted,” said a voice.
“Exactly!” Don’s gaze sought the person who’d answered. A stocky young woman with dirty-blond hair. “Midshipman Everett, please elaborate.”
“Well, the fact that it was from his mother and regarding his father indicates the attacker knew his subject. He probably hacked the mother’s email account to avoid the spam filters and wrote a subject line that would increase his chances of getting a click.”
“That’s exactly correct,” Don said. “This was not some random internet virus you pick up when you visit porn sites—which I know midshipmen never do.” He got a few laughs out of that line. “This was a very sophisticated spear-phishing operation, a targeted attack on a single individual. This person was surveilled, and his weaknesses exploited.
“But there’s another reason we study this cyberattack. The actual code itself was a masterpiece. A virus within a virus within a virus. The first layer exploited the security flaw in the printer driver to gain access to as many workstations as possible. Then it waited for someone to access the power plant SCADA system.” He paused. “By way of review, what does SCADA stand for, Mr. Nelson?” He called on a first-class midshipman in the second row who was nodding off. The young man’s head snapped up.
“Supervisory control and data acquisition system, sir,” the midshipman said in a near shout.
“Thank you for your enthusiasm, Mr. Nelson,” Don replied, smiling along with the laughter of the class. “If you’re feeling sleepy, perhaps you’d care to stand?”
The midshipman hoisted himself out of his seat, and Don continued. “The third layer of the virus was again targeted and clever. Instead of trying to crash the system, it changed just one parameter: the numbering system for the generators. When a technician tried to change an operating parameter on a generator using the SCADA system, he was actually sending the command to a different machine. When the control room thought they were bringing a spinning generator online, they were actually connecting a nonoperational unit to the power grid. What happens when you try to make a rotor go from zero to thirty-six hundred RPMs in a split second, Mr. Nelson?”
“Boom, sir?”
“Boom.” Don stopped pacing and faced the room. “In addition to killing three men, the resulting explosion destroyed most of the Allegheny P&L generating capability. But our little piece of malware had one final mission.
“The term national power grid is often tossed around as if it’s one monolithic entity. It’s not. It’s a patchwork of fiefdoms and legacy operating systems from the last hundred years. There’s a reason the hackers chose to attack Allegheny P&L. Their plant is colocated with Midwest Power’s distribution operation. This site is the link between the East Coast and the Midwest transmission networks. These are two separate companies, operating two separate software systems with two separate levels of cybersecurity.
“The malware jumped the fence from Allegheny to Midwest and proceeded to take down every distribution node on that network. The only way they were able to contain it was to take their entire operation offline for eight hours and bring the system back online one network at a time.”
Don let the information sink in.
“All that damage, all those lives lost, all from one email. It does no good to complain about the guy who clicked on a link in an email from his mom. People are people; they will do things you don’t want them to do. We’re not here to try to change human nature, we’re here to find the bad guys and shut them down.
Copyright © 2019 by David Bruns and J. R. Olson
