The nuclear power plant and the cyber attack

The KKNPP is the biggest nuclear power plant in India, equipped with two Russian-designed and supplied VVER pressurised water reactors with a capacity of 1,000 megawatts each. Both reactor units feed India’s southern power grid. The plant is adding four more reactor units of the same capacity, making the Kudankulam Nuclear Power Plant one of the largest collaborations between India and Russia.

According to the NPCIL statement, the malware attack on KKNPP was noticed September 4 by the CERT-In (Indian Computer Emergency Response Team), which is the national agency for responding to cyber security incidents. Investigation by India’s Department of Atomic Energy revealed that a user had connected a malware-infected personal computer to the plant’s administrative network. While the plant’s operational network and systems are separate from and not connected to the administrative network, one newspaper reported that there may have been a second “more serious” target.

VirusTotal, a virus scanning website owned by Google’s parent company, Alphabet, has indicated that that a large amount of data from the KKNPP’s administrative network has been stolen. If this is true, subsequent attacks on the nuclear power plant could target its critical systems more effectively. Cyber attacks on nuclear power plants could have physical effects, especially if the network that runs the machines and software controlling the nuclear reactor are compromised. This can be used to facilitate sabotage, theft of nuclear materials, or – in the worst-case scenario – a reactor meltdown. In a densely populated country like India, any radiation release from a nuclear facility would be a major disaster.

Isolating the computer network from the internet won’t protect against a targeted attack

In its initial denial, the NPCIL stated that “Any cyberattack on the Nuclear Power Plant Control System is not possible.” The KKNPP site director went on record stating that “the totally isolated network of KKNPP could not be accessed by any outside network from any part of the globe. Hence there was no question of it being hacked.” Even the second statement by NPCIL emphasizes that “the critical internal network” was isolated from the administrative one, and by implication, the Internet.

This physical isolation of a computer or a local network from the Internet to prevent any outside breach is called an “air gap.” However, this security strategy can leave a nuclear plant quite vulnerable. The NPCIL’s statement thus either reflects a complacency about the cyber security of Indian nuclear power plants or ignorance of its network’s vulnerabilities.

Air-gapped nuclear facilities can be attacked. Air gaps can be effective against unsophisticated and untargeted cyber threats – but not against targeted attacks. As the Nuclear Threat Initiative states in its 2016 report on cyberthreats to nuclear facilities, targeted attacks go beyond network connections and generally leverage “witting or unwitting humans, or a long and difficult-to-defend supply chain, to deliver the attack.” Another report by the Fissile Materials Working Group (a coalition of global civil society organizations) highlights that in practice, “organizations must transfer data into and out of their operational networks for a variety of reasons.” For instance, new data has to enter even an air-gapped operational network to update the software and hardware in the network. That exposes the critical internal network in a nuclear power plant to a host of vulnerabilities. Most famously, the Stuxnet attack penetrated Iran’s air-gapped Natanz uranium enrichment facility.

Did North Korea launch the attack?

Some researchers suggest that the KKNPP attack was caused by a variant of the DTRACK virus, developed by the North Korea-linked Lazarus group. The NPCIL has not challenged these claims. India maintains good diplomatic and economic relations with North Korea, so if Pyongyang did sponsor the attack, expect a diplomatic fallout.

However, tracing a cyber attack to North Korea won’t be easy. Studies indicate that most state-sponsored North Korean cyber operations are perpetrated from abroad. Nearly one-fifth are launched from India, where North Korea nationals have a considerable presence. North Korean students are present in India’s universities and other centers of higher education. The Indian Technical and Economic Cooperation (ITEC) program trains many North Korean students in India across several technical fields. This means that a cyber attack from North Korea could even originate from Indian territory.

In the past, North Korean cyber-activity has targeted the Indian Space Research Organization’s Institute’s National Remote Sensing Centre and the Indian National Metallurgical Laboratory, and conducted network reconnaissance on laboratories and research centers. The use of humans, rather than network connections, to bypass an air gap in Indian critical infrastructure by North Koreans or their associates, hence cannot be ruled out. The malware that attacked the KKNPP system was reportedly custom-built for the nuclear power plant’s IT systems. That suggests that such a breach by an insider to the nuclear power plant may have happened already.

Could such attacks lead to military escalation?

While the Kudankulam attack did not cause any critical systems damage or, apparently, affect the reactors, it revealed that India’s cyber defenses are based on outdated principles like the air gap strategy. NPCIL officials’ early denials suggested a sense of complacency about cyber defense, which means India’s critical infrastructure is vulnerable to attack.

Cyber attacks can increase the risk of military escalation. Since the recent Kashmir crisis, there has been a rise in cyber attacks from Pakistan on India. Indians have also been responding with their own cyber operations against Pakistan. Given the low threshold of military escalation between India and Pakistan, and high potential for escalation from cyber to the real world, India may wish to treat the Kudankulam attack as a wake-up call about its vulnerable cyber defenses at nuclear facilities and other critical infrastructure

Published                                                                                                                  Washington Post