In October 2019, a cyber-attack on an Indian nuclear plant was detected. The incident raises worrying questions for the rest of the world, including our country Malaysia.
In the 1st half of 2019, no country endured more cyber-attacks on its Internet of Things than India did according to Subex, an Indian telecommunications firm, which produces regular reports on cyber-security. Between April and June alone, it said, recorded cyber-attacks jumped by 22%, with 2,550 unique samples of malware discovered.
On October 28th, 2019, reports by Subex indicated that malware had been found on the computer systems of Kudankulam Nuclear Power Plant in Tamil Nadu, the newest and largest such power station in India. The attackers apparently had acquired high-level access and struck “extremely mission-critical targets”.
Officials denied the news as false information insisting that the facility’s control systems could not be hacked because they were not connected to the internet. But on October 30th the body that operates nuclear power plants acknowledged, sheepishly, that a computer had indeed been infected, but it was only an “administrative” one.
Sensitive sites such as power plants typically isolate the industrial-control systems (those that control the workings of a plant) from those connected to the wider internet. They do so using air-gaps (which involve disconnecting the system from the wider world), firewalls (which monitor data-flows for suspicious traffic) or data diodes (which allow information to flow out but not in).
But breaching a computer on the outside of these digital moats is nevertheless troubling. It could have given the attackers access to sensitive emails, personnel records and other details which would, in turn, make it easier to gain access to the more isolated operational part of the plant. America and Israel are thought to have sneaked the devastating Stuxnet virus into Iran’s air-gapped uranium-enrichment plant at Natanz around 2007 by planting a USB stick on a worker, who carried it inside and plugged it in.
In 1998 a group of teenagers in America, Britain and New Zealand hacked into the administrative computers of the Bhabha Atomic Research Centre, India’s main nuclear-research site, shortly after India tested nuclear bombs that year. They were able to read sensitive emails and files, and defaced the centre’s website. “Don’t think destruction is cool, coz its not”, said a message over a mushroom cloud. “If a nuclear war does start, you will be the first to scream”.