Shutting Down the Power Grid Is Way Easier Than You Think

If you’ve been paying even the slightest bit of attention to cybersecurity, you know that the security of power grids is a top concern. It’s kind of a disturbing threat, given that almost every other critical infrastructure supporting modern life is dependent on keeping the juice flowing. Well bad news, cyber worrywarts. New research shows there’s even more for you to fret about.

A new study published by West Point’s Network Science Center (PDF) shows how hackers can cause blackouts by targeting a relative handful of small substations — the often-overlooked and poorly-defended parts of a power grid. The research, authored by Paulo Shakarian, Hansheng Lei and Roy Lindelauf and sponsored by the Army Research Office, argues that this kind of a strategy can cause a chain reaction of power overloading known a cascading failure.

"An adversary looking to disrupt a power grid may look to target certain substations and sources of power generation to initiate a cascading failure that maximizes the number of customers without electricity," the authors warn. The problem for those trying to defend such systems is that they "can harden the security posture at certain power stations but may lack the time and resources to do this for the entire power grid."

It’s a somewhat counterintuitive approach. The distributed and complex structure of America’s power grid might seem like a natural obstacle for an attacker looking to cause the most mayhem for the maximum number of people. Properly exploited, though, grid complexity can be an asset according to the study.

The security of networks and software in power generation and transmission facilities has been a constant source of concern among cybersecurity experts. Thus far, no hacker has managed to sabotage an American critical infrastructure system. In fact, if you’re looking at threats to the power grid, unlucky squirrels electrocuting themselves on power lines have proven themselves to be a much greater threat to the integrity of the power grid than hackers. Fear-mongering in the debate has also distorted the public perception of relative threats to power grids, leading some to portray humdrum blackouts caused by sooty insulators as the nefarious deeds of cybercriminals.

But that doesn’t mean hacking a grid is impossible. In fact, some experts claim it’s not quite as hard as you might think.

Using game theory, the researchers in the West Point study modeled a simulated attack on a power grid with an attacker and defender strategizing against each other over the integrity of power delivery on a grid. Instead of trying to take on a large, well-defended parts of the grid, the attacker instead set his sights farther down to just a few smaller substations. By knocking these components offline, the attacker forced them to shift their loads to other parts of the grid, causing successive overloading in other facilities and triggering a cascading failure.

For an example of the kind of damage a cascading failure can do, look no further than the blackout of 2003, which abruptly darkened swaths of the Northeast in 2003. The power outage, which began with an accidental fault on a power line in Ohio, cost $6 billion, left 50 million people in the United States and Canada without electricity and was a factor in the deaths of 11 people.

The foibles of software patching and power generation make this kind of strategy all the more difficult to defend against.

Hackers often exploit little-known security vulnerabilities in commonly-used software in order to get access to sensitive data and systems. Once these vulnerabilities are discovered, they can be patched with software updates. Since much of the software and hardware used in power facilities is proprietary, defenders are often dependent on vendors to find and fix potential vulnerabilities. That can cause problems if power companies, as often happens with infrastructure facilities, use older software platforms which are no longer supported with updates and patches. Even if grid facilities had prompt software updates, though, they can’t all shut down to update their systems at once without affecting customers.

Not all is lost, though. Of course, defenders can’t be everywhere at once. So to maximize the use of finite security resources, the authors developed algorithms that randomly identify specific nodes to protect in a grid at different times, which can limit the scope of a potential cascading failure.

So while hackers may be able to cause headaches at a handful of substations, smarter algorithms may just be able to keep the lights on for the rest of us.