Risk
5/7/2012
07:29 PM
Tim Wilson
Tim Wilson
Quick Hits
Connect Directly
RSS
E-Mail
50%
50%
Repost This

DHS Warns Of Cyberattack On Natural Gas Pipeline Companies

Cybercampaign against multiple U.S. utility companies began four months ago, agency says

U.S. natural gas pipeline companies have been under cyberattack for the past four months, according to alerts issued to the utilities industry by the Department of Homeland Security.

DHS has sent out several alerts warning of a "gas pipeline sector cyber intrusion campaign" against multiple pipeline companies, which began earlier this year and is still under way, the agency says.

The alerts were confirmed by an "incident response" report from the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) late on Friday.

"ICS-CERT has recently identified an active series of cyber intrusions targeting natural gas pipeline sector companies," the report warns. "Multiple natural gas pipeline organizations have reported either attempts or intrusions related to this campaign. The campaign appears to have started in late December 2011 and is active today."

ICS-CERT said its "analysis of the malware and artifacts associated with these cyber attacks has positively identified this activity as related to a single campaign from a single source." The attacks are characterized by a sophisticated spear-phishing campaign.

The full text of the DHS reports was not made public, but sources who had seen the reports told news organizations that they contained an unusual amount of detail and a request that security teams not try to block the attacks so that intelligence professionals could study them more closely.

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: LOL.
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6213
Published: 2014-04-19
Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 Patch 1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1833.

CVE-2013-6214
Published: 2014-04-19
Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 9.05, 10.01, and 10.10 allows remote authenticated users to obtain sensitive information via unknown vectors, aka ZDI-CAN-2042.

CVE-2014-0778
Published: 2014-04-19
The TCPUploader module in Progea Movicon 11.4 before 11.4.1150 allows remote attackers to obtain potentially sensitive version information via network traffic to TCP port 10651.

CVE-2014-1974
Published: 2014-04-19
Directory traversal vulnerability in LYSESOFT AndExplorer before 20140403 and AndExplorerPro before 20140405 allows attackers to overwrite or create arbitrary files via unspecified vectors.

CVE-2014-1983
Published: 2014-04-19
Unspecified vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to cause a denial of service (CPU consumption) via unknown vectors.

Best of the Web