Risk
5/7/2012
07:29 PM
Tim Wilson
Tim Wilson
Quick Hits
50%
50%

DHS Warns Of Cyberattack On Natural Gas Pipeline Companies

Cybercampaign against multiple U.S. utility companies began four months ago, agency says

U.S. natural gas pipeline companies have been under cyberattack for the past four months, according to alerts issued to the utilities industry by the Department of Homeland Security.

DHS has sent out several alerts warning of a "gas pipeline sector cyber intrusion campaign" against multiple pipeline companies, which began earlier this year and is still under way, the agency says.

The alerts were confirmed by an "incident response" report from the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) late on Friday.

"ICS-CERT has recently identified an active series of cyber intrusions targeting natural gas pipeline sector companies," the report warns. "Multiple natural gas pipeline organizations have reported either attempts or intrusions related to this campaign. The campaign appears to have started in late December 2011 and is active today."

ICS-CERT said its "analysis of the malware and artifacts associated with these cyber attacks has positively identified this activity as related to a single campaign from a single source." The attacks are characterized by a sophisticated spear-phishing campaign.

The full text of the DHS reports was not made public, but sources who had seen the reports told news organizations that they contained an unusual amount of detail and a request that security teams not try to block the attacks so that intelligence professionals could study them more closely.

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3586
Published: 2015-04-21
The default configuration for the Command Line Interface in Red Hat Enterprise Application Platform before 6.4.0 and WildFly (formerly JBoss Application Server) uses weak permissions for .jboss-cli-history, which allows local users to obtain sensitive information via unspecified vectors.

CVE-2014-5361
Published: 2015-04-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Landesk Management Suite 9.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) start, (2) stop, or (3) restart services via a request to remote/serverServices.aspx.

CVE-2014-5370
Published: 2015-04-21
Directory traversal vulnerability in the CFChart servlet (com.naryx.tagfusion.cfm.cfchartServlet) in New Atlanta BlueDragon before 7.1.1.18527 allows remote attackers to read or possibly delete arbitrary files via a .. (dot dot) in the QUERY_STRING to cfchart.cfchart.

CVE-2014-8111
Published: 2015-04-21
Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors.

CVE-2014-8125
Published: 2015-04-21
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.