Authorities don’t seem to understand the real threat from cyber-operations.
By Debak Das November 4, 2019 at 4:30 p.m. GMT+5:30
The Nuclear Power Corporation of India Limited (NPCIL) has now confirmed that there was a cyberattack on the Kudankulam Nuclear Power Plant (KKNPP) in Tamil Nadu, India, in September. The nuclear power plant’s administrative network was breached in the attack but did not cause any critical damage. KKNPP plant officials had initially denied suffering an attack and officially stated that KKNPP “and other Indian Nuclear Power Plants Control Systems are stand alone and not connected to outside cyber network and Internet. Any Cyber attack on the Nuclear Power Plant Control System is not possible.”
So what really happened at Kudankulam? Here’s what you need to know.
1. The nuclear power plant and the cyberattack
The KKNPP is the biggest nuclear power plant in India, equipped with two Russian-designed and supplied VVER pressurized water reactors with a capacity of 1,000 megawatts each. Both reactor units feed India’s southern power grid. The plant is adding four more reactor units of the same capacity, making the Kudankulam Nuclear Power Plant one of the largest collaborations between India and Russia.
According to the NPCIL statement, the malware attack on KKNPP was noticed Sept. 4 by the CERT-In (Indian Computer Emergency Response Team), which is the national agency for responding to cybersecurity incidents. An investigation by India’s Department of Atomic Energy revealed that a user had connected a malware-infected personal computer to the plant’s administrative network. While the plant’s operational network and systems are separate from and not connected to the administrative network, one newspaper reported that there may have been a second “more serious” target.
VirusTotal, a virus scanning website owned by Google’s parent company, Alphabet, has indicated that a large amount of data from the KKNPP’s administrative network has been stolen. If this is true, subsequent attacks on the nuclear power plant could target its critical systems more effectively. Cyberattacks on nuclear power plants could have physical effects, especially if the network that runs the machines and software controlling the nuclear reactor are compromised. This can be used to facilitate sabotage, theft of nuclear materials, or — in the worst-case scenario — a reactor meltdown. In a densely populated country like India, any radiation release from a nuclear facility would be a major disaster.
2. Isolating the computer network from the Internet won’t protect against a targeted attack
In its initial denial, the NPCIL stated, “Any cyberattack on the Nuclear Power Plant Control System is not possible.” The KKNPP site director went on record stating that “the totally isolated network of KKNPP could not be accessed by any outside network from any part of the globe. Hence there was no question of it being hacked.” Even the second NPCIL statement emphasizes that “the critical internal network” was isolated from the administrative one, and by implication, the Internet.
This physical isolation of a computer or a local network from the Internet to prevent any outside breach is called an “air gap.” However, this security strategy can leave a nuclear plant quite vulnerable. The NPCIL’s statement, thus, reflects either a complacency about the cybersecurity of Indian nuclear power plants or ignorance of its network’s vulnerabilities.
Air-gapped nuclear facilities can be attacked. Air gaps can be effective against unsophisticated and untargeted cyberthreats — but not against targeted attacks. As the Nuclear Threat Initiative states in its 2016 report on cyberthreats to nuclear facilities, targeted attacks go beyond network connections and generally leverage “witting or unwitting humans, or a long and difficult-to-defend supply chain, to deliver the attack.” Another report by the Fissile Materials Working Group (a coalition of global civil society organizations) highlights that in practice, “organizations must transfer data into and out of their operational networks for a variety of reasons.” For instance, new data has to enter an air-gapped operational network to update the software and hardware in the network. That exposes the critical internal network in a nuclear power plant to a host of vulnerabilities. Most famously, the Stuxnet attack penetrated Iran’s air-gapped Natanz uranium enrichment facility.
The Iran nuclear deal isn’t so great — for Iran
3. Did North Korea launch the attack?
Some researchers suggest that the KKNPP attack was caused by a variant of the DTRACK virus, developed by the North Korea-linked Lazarus group. The NPCIL has not challenged these claims. India maintains good diplomatic and economic relations with North Korea, so if Pyongyang did sponsor the attack, expect a diplomatic fallout.
However, tracing a cyberattack to North Korea won’t be easy. Studies indicate that most state-sponsored North Korean cyberoperations are perpetrated from abroad. Nearly one-fifth are launched from India, where North Korea nationals have a considerable presence. North Korean students are present in India’s universities and other centers of higher education. The Indian Technical and Economic Cooperation program trains many North Korean students in India across several technical fields. This means that a cyberattack from North Korea could even originate from Indian territory.
In the past, North Korean cyberactivity has targeted the Indian Space Research Organization’s Institute’s National Remote Sensing Center and the Indian National Metallurgical Laboratory, and conducted network reconnaissance on laboratories and research centers. The use of humans, rather than network connections, to bypass an air gap in Indian critical infrastructure by North Koreans or their associates, hence cannot be ruled out. The malware that attacked the KKNPP system was reportedly custom-built for the nuclear power plant’s IT systems. That suggests that such a breach by an insider to the nuclear power plant may have happened already.
4. Could such attacks lead to military escalation?
While the Kudankulam attack did not cause any critical systems damage or, apparently, affect the reactors, it revealed that India’s cyber-defenses are based on outdated principles like the air gap strategy. NPCIL officials’ early denials suggested a sense of complacency about cyberdefense, which means India’s critical infrastructure is vulnerable to attack.
Cyberattacks can increase the risk of military escalation. Since the recent Kashmir crisis, there has been a rise in cyberattacks from Pakistan on India. Indians have also been responding with their own cyberoperations against Pakistan. Given the low threshold of military escalation between India and Pakistan, and high potential for escalation from cyber to the real world, India may wish to treat the Kudankulam attack as a wake-up call about its vulnerable cyber defenses at nuclear facilities and other critical infrastructure.
Don’t miss anything! Sign up to get TMC’s smart analysis in your inbox, three days a week.
Debak Das (@debakd) is a MacArthur nuclear security pre-doctoral fellow at the Center for International Security and Cooperation, Stanford University, and a PhD candidate in political science at Cornell University.
