Asymmetric cyberwarfare: 'States increasingly use cyberattacks in support of their other objectives'

Well, now, as a reminder, then Europe has seen two major cyber attacks targeting supermarket refrigerators over the past two months. Back in October, temperatures of refrigeration units in hundreds of supermarkets across France and the Netherlands as well rose to up to 50 degrees Celsius, causing several fires and massive quantities of food waste. Now, despite those attacks targeting known vulnerabilities, a second similar wave of attacks targeted supermarkets in eight. Other nations, Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland, those attacks then bearing the same signatures and the same consequences. That's to say temperatures reaching 50 degrees Celsius, spoiling food, causing small fires. Now, there had been little information about possible culprits until Monday when French officials then officially accused Iran. They've now threatened, as you heard Clovis saying there, a harsh response. Tehran still rejecting the accusations as baseless. For more on this, we're going to speak now to Rafe Pilling. He's a senior director of threat intelligence at the cyber security firm Sophos. Thank you very much for joining us today, Rafe. So we've now heard the French foreign minister moments ago saying that he's sure that Iran is behind these attacks. How solid then is the evidence linking Tehran to these cyber attacks? So the announcements that we've made so far are presumably based on intelligence that the multiple French intelligence agencies have collected and compiled a report and produced this political attribution assessment. There will be a process. The level of technical information that has been released involving the details behind that process is still fairly high level and superficial. But what we have seen does fit with the details of other... Iranian-linked attacks on industrial control systems that we have seen in the past and it fits their MO and potentially further details will be forthcoming. We'll just have to wait and see. Now, you were quoted in a Guardian piece, Rafe, earlier this month, warning that finding the culprit in these attacks would be hard because there was no trace of a weapon, so to speak, at the scene of the crime. You had compared it to wearing rubber gloves and messing with switches. So why do you think the evidence that France has publicly pointed to now was hard to decipher until this week? I think the, yeah, as I mentioned before, The nature of this attack is essentially finding a website on the internet using default credentials, so credentials that are published in manuals by the vendors or other weak credentials that the attackers can decipher, and gaining access to these consoles, which are then used to control these refrigeration systems. And they change the settings, and that results in the impact we've seen. So there's not a huge amount of... malicious software or other tooling that is linked directly to the attackers. However, it's likely the case that French agencies were able to use their capabilities to trace the attackers path back across the Internet and along the way perhaps identify systems that had Traces of the attackers and so like Farsi language artifacts are noted along with some scripts used to enumerate industrial control systems. Now, on the security angle of this, Rafe, these attacks are said to have exploited known vulnerabilities in these refrigeration systems and ones that were theoretically pretty easy to fix. So is it surprising to you that they weren't addressed in the month between these two incidents, also knowing that similar incidents targeted supermarkets in the United States as well earlier this past summer? So it does look like in between the two different waves, and certainly recently, there's been a reduction in the number of these systems available or accessible, visible via the Internet. So presumably some organizations have taken action to remove the accessibility of these consoles from the Internet. But, I mean, the fundamental problem with securing industrial control systems is things do tend to move slowly, changes slow, patching is slow, because ultimately they want to make sure that the physical process, whatever it's manufacturing or refrigeration or whatever it might be, is maintained consistently 24/7. And, yeah, the general problem we see with industrial control systems is this lagging of security controls that are necessary. Now, I spoke to a cybersecurity expert several days ago who said that the fact that these systems are connected to the Internet obviously makes them vulnerable to hacking and remote access. Is there any reason for refrigeration systems to be connected to the Internet? I mean, at this stage, does that potentially bring more risk than benefit? Absolutely brings more risk than benefit. So the reason will be as simple as enabling a remote support company to be able to connect in and make changes to these devices without, you know, traveling to a to a location. However, we do have secure remote access systems that would enable that same connectivity to occur, but without exposing the the consoles to everybody on the internet. And that is hopefully What a lot of these organizations will put in place following these attacks, look to lock down and reduce the access that malicious hackers, whoever they might be, have to these systems. Now, when we think of incidents like these ones, then who do you think is best positioned to respond to these vulnerabilities? I mean, is it on is it should it be the burden of individual private companies or do you think that government should be stepping in to impose potentially rules to protect consumers from these types of cyber attacks? It really requires a number of different stakeholders. So the onus is ultimately on the private organizations that run the systems, and certainly the impact will be on those organizations, as we have seen with these attacks in the form of spoiled food and merchandise that wouldn't be able to be sold now. However, there are, you know, additionally, they need to be supported by their vendors who will support upgrades and changes to the way they conduct their business practices like remote access in order to make that work. And it might be the case that the government or a national cyber authority needs to provide guidance or potentially some form of regulation or legislation to strongly encourage these organizations to make those changes in order to strengthen the. the country's national resilience from a digital perspective. Do you think that cybercrime laws in France specifically or perhaps in the European Union at large are sufficient at this stage to protect organizations, companies, institutions from these types of cyberattacks? I mean, especially because we've seen a host of really detrimental cyberattacks, especially in France over the past several months, targeting things like blood banks, tax offices, amongst other public institutions. Is there enough legal protection? I mean, unfortunately, the laws themselves don't really provide protection. Thank you. What is needed is for entities, for organizations, private organizations, but also government organizations, to ensure that they have secured their systems to a reasonable standard and done as much as they can to harden and reduce the attack surface of those organizations. So, for example, in this case, removing remote access for these refrigeration management systems from the internet and from general access. So legislation can support and encourage industries to secure their system, particularly if it means making it a level playing field, requiring that everyone has to move to a particular standard. But it doesn't necessarily provide that protection. Even when we're seeing sort of privacy laws around data, we still see a lot of data breaches. And ultimately, it's those organizations that are storing that data, processing that data that need to make the changes to protect our data. How concerned do you think people should be at this stage, given these revelations about food security specifically in light of these attacks? I don't think there's any cause for alarm or concern, but I think it does underline the disruption and the, we talk about an asymmetric attack. So with a small amount of effort from the adversary side, they can create a large impact, in this case, destroying food and producing empty shelves or empty refrigeration units in stores. Obviously, in this case, recovery was fairly rapid. Stock was replaced. But I think it highlights the fragility. And the impact that could be had through a cyber attack on physical systems. As a final question for you, Rafe, how... common are state-sponsored cyber attacks. We obviously often hear of the same culprits, nations like Russia, China, Iran, and North Korea. But do Western nations also use these methods? And what does that look like? I ask also, you know, in reference to what Jean-Noël Barrot, the French foreign minister, said earlier, which is that France hasn't eliminated the possibility that it'll carry out its own cyber attacks against Iran in response. So what might that look like? Yeah, obviously cyberspace is now an area that nations consider to conduct operations of various kinds, and those operations are in support of the legal and the political and military interests of those countries. We tend to see different forms of attacks from, say, a country like Iran, where they are relatively... They have a relatively low bar for using these disruptive attacks. They've done it a number of times now in a variety of different circumstances. Similarly, Russia will use disruptive physical attacks in conjunction with some of their military operations. We've seen it in Ukraine and Poland earlier this year with some energy attacks. attacks, so So, yeah, it's absolutely increasingly the case that states will use cyber attacks in support of their... There are other objectives, but how they do it is very much defined by the legislative frameworks and just how they conduct themselves on the international stage. Rafe Pilling, Senior Director of Threat Intelligence at the Cybersecurity Sophos, thank you very much for joining us today.