Vulnerable Protection Relays Put Power Grid at Risk

Vulnerabilities in networked devices programmed to instantaneously trip power grid substation circuit breakers could be the means hackers use to cause the next blackout, warn researchers.

See Also: From Ancient Myths to Modern Threats: Securing the Transition from Legacy to Leading Edge

Protection relays – devices that continually monitor voltage, current, frequency and phase angle – are “the brains of both protection and control” at the site where high voltage lines meet lower-voltage residential lines, said Google-owned Mandiant in a Monday blog post. Should protection relays detect a problem such as ground fault, they react within 20 milliseconds to trip circuit breakers. Simulated attacks conducted by Mandiant consistently reveal insecure remote pathways into local substation networks.

Substations may appear as the last bastion of a fully analog world, humming behind a locked fence. They’re actually highly-networked, cyber-physical environments that exchange real-time data locally and remotely and protection relays are prime targets for hackers.

Vulnerabilities such as the use of legacy protocols such as Telnet – which is unencrypted – unchanged factory passwords and lack of firewalls amount to “systemic patterns across substations, utilities and industrial sites worldwide,” Mandiant warned.

The threat of hackers attacking the electric grid has transformed from hyped-up fantasy to a reality demonstrated by Russian nation-state hackers who caused blackouts in Ukraine at least three times over the past decade (see: Russian Sandworm Hackers Caused Power Outage in October 2022).

Fears that such an attack could occur in the United States – where substation attacks so far have been confined to gunfire incidents in California and North Carolina – received a boost after the discovery of Chinese nation-state hackers tracked at Volt Typhoon burrowed into critical infrastructure systems in a bid to pre-position themselves. U.S. authorities on Monday further warned critical infrastructure operators to “stay vigilant” given the likelihood of targeting by Iranian-affiliated hackers (see: Infrastructure Operators Leaving Control Systems Exposed).

“Protection relays are high-value devices, and prime targets for cyber-physical attacks targeting substation automation systems and grid management systems,” Mandiant wrote. Its research applies to protection relays made by any manufacturer – major ones include Siemens, ABB, GE, Schneider Electric and Schweitzer Engineering Laboratories.

Because the protection relays have grown into devices that additionally record event data and intermediate communication between digital and analog systems, they’re also networked for remote access and real-time visibility. That gives an opening for hackers to work their way in from the outside, starting with open-source intelligence to identify electrical workers, exposed remote gateways and default credentials.

Once hackers identify protocol gateways and engineering HMIs, they can analyze which services are exposed on each device such as Telnet, HTTP, FTP or manufacturing message specification and gather banner information or port responses that reveal firmware versions, relay models or serial numbers. Hackers prioritize devices with weak authentication or legacy configurations.

An attacker might attempt to log in using factory-set or default credentials, which are often obtainable from device manuals. These credentials are often still active in many substations due to lax commissioning processes. If login is successful, the attacker escalates from passive enumeration to active control, gaining the ability to view or modify protection settings, trip logic and relay event logs.

If the relays are hardened with proper credentials or access controls, attackers might try other methods. Some adversaries have used vendor software like DIGSI, acSELerator and PCM600 on compromised engineering workstations to open relay configuration projects.

Another risk is the presence of undocumented or hidden device functionality. As highlighted in a U.S. federal government advisory, some protection relays contain undocumented capabilities accessible to privileged users. Separately, some relays may expose backdoor Telnet access through hard-coded or vendor diagnostic accounts.

Once inside, attackers can modify protection settings, reset passwords, disable alarms or issue direct breaker commands, effectively assuming full control of the relay.

Upgrading substations to the latest technology isn’t as easy as replacing an obsolete server. The lifecycle of substation equipment is measured in decades and introducing modern security features such as encrypted protocols and firmware validation means adding more computers and bandwidth into an environment built for “deterministic, low-latency communication – not IT-grade flexibility,” Mandiant acknowledged.

Still, there are steps grid operators can take. If they can’t transition away from Telnet to a secure shell, then “tightly restrict access” through virtual networks, firewalls and role-based control. Segment the network rigorously. Change default passwords and mandate site-specific, role-based credentials.

Many manufacturers include security features such as role-based access control, auditing and password retry lockouts that grid operators typically disable or ignore, Mandiant said. Operator should also configure modern protection relays to alert for changes such as modified protection logic or suppressed alarms. Still, the best security isn’t retrofitted in. “Security is most effective when its built in by design, not bolted on later,” it said.