The financial costs of cyberattacks to wind farms

Topics
No items found.
Ilaria Valtimora
August 4, 2017
This content is from our archive. Some formatting or links may be broken.
This content is from our archive. Some formatting or links may be broken.
The financial costs of cyberattacks to wind farms

Two months ago, we warned that companies in the wind sector must be aware of the risks of cyberattacks to wind farms and the potential for financial losses. A new piece of research has now demonstrated just how exposed wind farms are to those risks.

At the Black Hat cybersecurity event in Los Angeles last week Jason Staggs, a University of Tulsa researcher, showed how ransomware – malicious software that demands cash payments – could paralyse a fleet of wind turbines and cause huge costs for project owners: up to around $700,000 per wind farm each day.

Staggs and his team has spent the past two years hacking into wind farms in the US, to demonstrate their vulnerabilities. With the permission of wind energy companies, they have performed penetration tests on five wind farms across the US that use the hardware from five different manufacturers.

The researchers could not disclose names of the wind farms’ owners, the locations they tested, or the firms that built the turbines. But they did disclose their findings.

Staggs found that wind turbines run a variety of operating systems, some of which are outdated and highly susceptible to hacks. Also, many computers that control the turbines frequently use default credentials or lack authentication systems, making them accessible to hackers and, therefore, vulnerable targets for cyberattacks.

The most worrying part is that an attack on a single turbine can quickly spread to the entire wind farm because each turbine is part of a network that includes all the other turbines in the farm, as well as their power substations.

Once they accessed just one turbine, the researchers developed three different types of ransomware to demonstrate how hackers could exploit the vulnerability of the entire wind farm. The effects of the attacks included disabling all the turbines, infecting all of a wind farm’s computers, and falsifying the signals being sent back from the turbines to hide disruptive attacks from the operators.

And what could be the costs of these attacks?

The team calculated the costs depending on the amount of time the wind farm goes offline following the attack. For a 250MW wind farm, the costs could range from $30,000 for just an hour of downtime to $720,000 for a day, to as much as $5m for a week spent offline. The worst case scenario in which the downtime extends to three months, the costs for a wind farm owner could reach $60m.

As a result, the potential of costly downtime for wind farms leaves their owners open to extortion. Companies would be forced to choose between damaging downtime or paying a ransom to a hacker. This shows why wind must take this seriously – as the companies who supported these researchers are already doing.

Ransomwares are increasing becoming a costly reality. A report by IBM has showed that, in 2016, 70% of businesses infected with ransomware paid ransom to regain access to business data and systems, with half of those paying over $10,000 and 20% paying over $40,000. This has led to ransomware attacks becoming more frequent, with nearly half of the businesses surveyed by IBM experiencing them last year.

Wind companies need to be prepared.

Adequate security systems are the only way to protect wind farms from these kind of attacks. Wind turbines’ operating systems must be more secure and the software constantly updated for all devices. Also, turbines should be segmented between each other, so that accessing one does not compromise the entire wind farm.

It is up to wind farm owners and developers to ask the right security questions, and put manufacturers and their IT partners under pressure to make sure these risks are addressed. Once more, we have seen the financial risks of not doing so are huge.

Two months ago, we warned that companies in the wind sector must be aware of the risks of cyberattacks to wind farms and the potential for financial losses. A new piece of research has now demonstrated just how exposed wind farms are to those risks.

At the Black Hat cybersecurity event in Los Angeles last week Jason Staggs, a University of Tulsa researcher, showed how ransomware – malicious software that demands cash payments – could paralyse a fleet of wind turbines and cause huge costs for project owners: up to around $700,000 per wind farm each day.

Staggs and his team has spent the past two years hacking into wind farms in the US, to demonstrate their vulnerabilities. With the permission of wind energy companies, they have performed penetration tests on five wind farms across the US that use the hardware from five different manufacturers.

The researchers could not disclose names of the wind farms’ owners, the locations they tested, or the firms that built the turbines. But they did disclose their findings.

Staggs found that wind turbines run a variety of operating systems, some of which are outdated and highly susceptible to hacks. Also, many computers that control the turbines frequently use default credentials or lack authentication systems, making them accessible to hackers and, therefore, vulnerable targets for cyberattacks.

The most worrying part is that an attack on a single turbine can quickly spread to the entire wind farm because each turbine is part of a network that includes all the other turbines in the farm, as well as their power substations.

Once they accessed just one turbine, the researchers developed three different types of ransomware to demonstrate how hackers could exploit the vulnerability of the entire wind farm. The effects of the attacks included disabling all the turbines, infecting all of a wind farm’s computers, and falsifying the signals being sent back from the turbines to hide disruptive attacks from the operators.

And what could be the costs of these attacks?

The team calculated the costs depending on the amount of time the wind farm goes offline following the attack. For a 250MW wind farm, the costs could range from $30,000 for just an hour of downtime to $720,000 for a day, to as much as $5m for a week spent offline. The worst case scenario in which the downtime extends to three months, the costs for a wind farm owner could reach $60m.

As a result, the potential of costly downtime for wind farms leaves their owners open to extortion. Companies would be forced to choose between damaging downtime or paying a ransom to a hacker. This shows why wind must take this seriously – as the companies who supported these researchers are already doing.

Ransomwares are increasing becoming a costly reality. A report by IBM has showed that, in 2016, 70% of businesses infected with ransomware paid ransom to regain access to business data and systems, with half of those paying over $10,000 and 20% paying over $40,000. This has led to ransomware attacks becoming more frequent, with nearly half of the businesses surveyed by IBM experiencing them last year.

Wind companies need to be prepared.

Adequate security systems are the only way to protect wind farms from these kind of attacks. Wind turbines’ operating systems must be more secure and the software constantly updated for all devices. Also, turbines should be segmented between each other, so that accessing one does not compromise the entire wind farm.

It is up to wind farm owners and developers to ask the right security questions, and put manufacturers and their IT partners under pressure to make sure these risks are addressed. Once more, we have seen the financial risks of not doing so are huge.

Two months ago, we warned that companies in the wind sector must be aware of the risks of cyberattacks to wind farms and the potential for financial losses. A new piece of research has now demonstrated just how exposed wind farms are to those risks.

At the Black Hat cybersecurity event in Los Angeles last week Jason Staggs, a University of Tulsa researcher, showed how ransomware – malicious software that demands cash payments – could paralyse a fleet of wind turbines and cause huge costs for project owners: up to around $700,000 per wind farm each day.

Staggs and his team has spent the past two years hacking into wind farms in the US, to demonstrate their vulnerabilities. With the permission of wind energy companies, they have performed penetration tests on five wind farms across the US that use the hardware from five different manufacturers.

The researchers could not disclose names of the wind farms’ owners, the locations they tested, or the firms that built the turbines. But they did disclose their findings.

Staggs found that wind turbines run a variety of operating systems, some of which are outdated and highly susceptible to hacks. Also, many computers that control the turbines frequently use default credentials or lack authentication systems, making them accessible to hackers and, therefore, vulnerable targets for cyberattacks.

The most worrying part is that an attack on a single turbine can quickly spread to the entire wind farm because each turbine is part of a network that includes all the other turbines in the farm, as well as their power substations.

Once they accessed just one turbine, the researchers developed three different types of ransomware to demonstrate how hackers could exploit the vulnerability of the entire wind farm. The effects of the attacks included disabling all the turbines, infecting all of a wind farm’s computers, and falsifying the signals being sent back from the turbines to hide disruptive attacks from the operators.

And what could be the costs of these attacks?

The team calculated the costs depending on the amount of time the wind farm goes offline following the attack. For a 250MW wind farm, the costs could range from $30,000 for just an hour of downtime to $720,000 for a day, to as much as $5m for a week spent offline. The worst case scenario in which the downtime extends to three months, the costs for a wind farm owner could reach $60m.

As a result, the potential of costly downtime for wind farms leaves their owners open to extortion. Companies would be forced to choose between damaging downtime or paying a ransom to a hacker. This shows why wind must take this seriously – as the companies who supported these researchers are already doing.

Ransomwares are increasing becoming a costly reality. A report by IBM has showed that, in 2016, 70% of businesses infected with ransomware paid ransom to regain access to business data and systems, with half of those paying over $10,000 and 20% paying over $40,000. This has led to ransomware attacks becoming more frequent, with nearly half of the businesses surveyed by IBM experiencing them last year.

Wind companies need to be prepared.

Adequate security systems are the only way to protect wind farms from these kind of attacks. Wind turbines’ operating systems must be more secure and the software constantly updated for all devices. Also, turbines should be segmented between each other, so that accessing one does not compromise the entire wind farm.

It is up to wind farm owners and developers to ask the right security questions, and put manufacturers and their IT partners under pressure to make sure these risks are addressed. Once more, we have seen the financial risks of not doing so are huge.

Two months ago, we warned that companies in the wind sector must be aware of the risks of cyberattacks to wind farms and the potential for financial losses. A new piece of research has now demonstrated just how exposed wind farms are to those risks.

At the Black Hat cybersecurity event in Los Angeles last week Jason Staggs, a University of Tulsa researcher, showed how ransomware – malicious software that demands cash payments – could paralyse a fleet of wind turbines and cause huge costs for project owners: up to around $700,000 per wind farm each day.

Staggs and his team has spent the past two years hacking into wind farms in the US, to demonstrate their vulnerabilities. With the permission of wind energy companies, they have performed penetration tests on five wind farms across the US that use the hardware from five different manufacturers.

The researchers could not disclose names of the wind farms’ owners, the locations they tested, or the firms that built the turbines. But they did disclose their findings.

Staggs found that wind turbines run a variety of operating systems, some of which are outdated and highly susceptible to hacks. Also, many computers that control the turbines frequently use default credentials or lack authentication systems, making them accessible to hackers and, therefore, vulnerable targets for cyberattacks.

The most worrying part is that an attack on a single turbine can quickly spread to the entire wind farm because each turbine is part of a network that includes all the other turbines in the farm, as well as their power substations.

Once they accessed just one turbine, the researchers developed three different types of ransomware to demonstrate how hackers could exploit the vulnerability of the entire wind farm. The effects of the attacks included disabling all the turbines, infecting all of a wind farm’s computers, and falsifying the signals being sent back from the turbines to hide disruptive attacks from the operators.

And what could be the costs of these attacks?

The team calculated the costs depending on the amount of time the wind farm goes offline following the attack. For a 250MW wind farm, the costs could range from $30,000 for just an hour of downtime to $720,000 for a day, to as much as $5m for a week spent offline. The worst case scenario in which the downtime extends to three months, the costs for a wind farm owner could reach $60m.

As a result, the potential of costly downtime for wind farms leaves their owners open to extortion. Companies would be forced to choose between damaging downtime or paying a ransom to a hacker. This shows why wind must take this seriously – as the companies who supported these researchers are already doing.

Ransomwares are increasing becoming a costly reality. A report by IBM has showed that, in 2016, 70% of businesses infected with ransomware paid ransom to regain access to business data and systems, with half of those paying over $10,000 and 20% paying over $40,000. This has led to ransomware attacks becoming more frequent, with nearly half of the businesses surveyed by IBM experiencing them last year.

Wind companies need to be prepared.

Adequate security systems are the only way to protect wind farms from these kind of attacks. Wind turbines’ operating systems must be more secure and the software constantly updated for all devices. Also, turbines should be segmented between each other, so that accessing one does not compromise the entire wind farm.

It is up to wind farm owners and developers to ask the right security questions, and put manufacturers and their IT partners under pressure to make sure these risks are addressed. Once more, we have seen the financial risks of not doing so are huge.

Two months ago, we warned that companies in the wind sector must be aware of the risks of cyberattacks to wind farms and the potential for financial losses. A new piece of research has now demonstrated just how exposed wind farms are to those risks.

At the Black Hat cybersecurity event in Los Angeles last week Jason Staggs, a University of Tulsa researcher, showed how ransomware – malicious software that demands cash payments – could paralyse a fleet of wind turbines and cause huge costs for project owners: up to around $700,000 per wind farm each day.

Staggs and his team has spent the past two years hacking into wind farms in the US, to demonstrate their vulnerabilities. With the permission of wind energy companies, they have performed penetration tests on five wind farms across the US that use the hardware from five different manufacturers.

The researchers could not disclose names of the wind farms’ owners, the locations they tested, or the firms that built the turbines. But they did disclose their findings.

Staggs found that wind turbines run a variety of operating systems, some of which are outdated and highly susceptible to hacks. Also, many computers that control the turbines frequently use default credentials or lack authentication systems, making them accessible to hackers and, therefore, vulnerable targets for cyberattacks.

The most worrying part is that an attack on a single turbine can quickly spread to the entire wind farm because each turbine is part of a network that includes all the other turbines in the farm, as well as their power substations.

Once they accessed just one turbine, the researchers developed three different types of ransomware to demonstrate how hackers could exploit the vulnerability of the entire wind farm. The effects of the attacks included disabling all the turbines, infecting all of a wind farm’s computers, and falsifying the signals being sent back from the turbines to hide disruptive attacks from the operators.

And what could be the costs of these attacks?

The team calculated the costs depending on the amount of time the wind farm goes offline following the attack. For a 250MW wind farm, the costs could range from $30,000 for just an hour of downtime to $720,000 for a day, to as much as $5m for a week spent offline. The worst case scenario in which the downtime extends to three months, the costs for a wind farm owner could reach $60m.

As a result, the potential of costly downtime for wind farms leaves their owners open to extortion. Companies would be forced to choose between damaging downtime or paying a ransom to a hacker. This shows why wind must take this seriously – as the companies who supported these researchers are already doing.

Ransomwares are increasing becoming a costly reality. A report by IBM has showed that, in 2016, 70% of businesses infected with ransomware paid ransom to regain access to business data and systems, with half of those paying over $10,000 and 20% paying over $40,000. This has led to ransomware attacks becoming more frequent, with nearly half of the businesses surveyed by IBM experiencing them last year.

Wind companies need to be prepared.

Adequate security systems are the only way to protect wind farms from these kind of attacks. Wind turbines’ operating systems must be more secure and the software constantly updated for all devices. Also, turbines should be segmented between each other, so that accessing one does not compromise the entire wind farm.

It is up to wind farm owners and developers to ask the right security questions, and put manufacturers and their IT partners under pressure to make sure these risks are addressed. Once more, we have seen the financial risks of not doing so are huge.

Full archive access is available to members only

Not a member yet?

Become a member of the 6,500-strong A Word About Wind community today, and gain access to our premium content, exclusive lead generation and investment opportunities.

Full archive access is available to members only

Not a member yet?

Become a member of the 6,500-strong A Word About Wind community today, and gain access to our premium content, exclusive lead generation and investment opportunities.