Incident: Cyberattack on Kudankulam Nuclear Power Plant in India.

Published Date: 2019-11-04

Postmortem Analysis
Timeline 1. The software failure incident at the Kudankulam Nuclear Power Plant (KKNPP) in Tamil Nadu, India, happened in September 2019 [Article 91900].
System The software failure incident at the Kudankulam Nuclear Power Plant involved the following systems/components/models: 1. Administrative network of the Kudankulam Nuclear Power Plant [91900] 2. Malware-infected personal computer connected to the plant's administrative network [91900] 3. Air gap security strategy implemented at the nuclear plant [91900] 4. CERT-In (Indian Computer Emergency Response Team) [91900] 5. VirusTotal, a virus scanning website owned by Google's parent company, Alphabet [91900]
Responsible Organization 1. The cyberattack on the Kudankulam Nuclear Power Plant (KKNPP) in India was caused by a user who connected a malware-infected personal computer to the plant's administrative network, leading to the breach [91900]. 2. Some researchers suggest that the attack was caused by a variant of the DTRACK virus, developed by the North Korea-linked Lazarus group, although the direct attribution to North Korea is challenging [91900].
Impacted Organization 1. The Nuclear Power Corporation of India Limited (NPCIL) [Article 91900]
Software Causes 1. The software cause of the failure incident at the Kudankulam Nuclear Power Plant was a cyberattack involving malware being introduced into the plant's administrative network through a user connecting a malware-infected personal computer [91900].
Non-software Causes The non-software causes of the failure incident at the Kudankulam Nuclear Power Plant were: 1. The breach occurred due to a user connecting a malware-infected personal computer to the plant's administrative network, indicating a human error or lack of proper security protocols [Article 91900]. 2. The reliance on outdated security principles like the air gap strategy, which can leave nuclear plants vulnerable to targeted cyberattacks [Article 91900].
Impacts 1. Data theft from the Kudankulam Nuclear Power Plant's administrative network was reported, potentially leading to subsequent attacks targeting critical systems [91900]. 2. The incident revealed vulnerabilities in India's cyber defenses, particularly in critical infrastructure like nuclear facilities, due to outdated security strategies like the air gap approach [91900]. 3. The attack raised concerns about the risk of military escalation, especially in the context of heightened tensions between India and Pakistan, as cyberattacks can potentially lead to real-world conflicts [91900].
Preventions 1. Implementing stricter controls on external devices connecting to the plant's administrative network could have prevented the malware infection from a personal computer [91900]. 2. Regular cybersecurity training and awareness programs for employees to prevent inadvertent actions that could compromise the network security [91900]. 3. Continuous monitoring and auditing of the network for any unusual activities or unauthorized access attempts [91900]. 4. Updating and patching software and hardware regularly to address known vulnerabilities that could be exploited by cyber attackers [91900].
Fixes 1. Implementing more robust cybersecurity measures to prevent future cyberattacks, such as enhancing network monitoring, intrusion detection systems, and access controls [91900]. 2. Conducting thorough security audits and assessments of critical infrastructure systems to identify and address vulnerabilities [91900]. 3. Enhancing employee training and awareness on cybersecurity best practices to prevent incidents like connecting infected personal computers to critical networks [91900]. 4. Updating and modernizing cybersecurity strategies beyond relying solely on air-gapped networks, as they may not be sufficient against targeted attacks [91900].
References 1. Nuclear Power Corporation of India Limited (NPCIL) [Article 91900] 2. Indian Computer Emergency Response Team (CERT-In) [Article 91900] 3. Department of Atomic Energy in India [Article 91900] 4. VirusTotal [Article 91900] 5. Nuclear Threat Initiative [Article 91900] 6. Fissile Materials Working Group [Article 91900] 7. North Korea-linked Lazarus group [Article 91900] 8. Indian Space Research Organization's Institute's National Remote Sensing Center [Article 91900] 9. Indian National Metallurgical Laboratory [Article 91900] 10. Indian Technical and Economic Cooperation program [Article 91900]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident having happened again at one_organization: The article mentions that the malware attack on the Kudankulam Nuclear Power Plant (KKNPP) was noticed in September and that a user had connected a malware-infected personal computer to the plant's administrative network [91900]. This incident highlights a breach in the cybersecurity defenses of the nuclear power plant, indicating a vulnerability that could potentially lead to similar incidents in the future within the same organization. (b) The software failure incident having happened again at multiple_organization: The article does not provide specific information about similar incidents happening at other organizations or with their products and services. Therefore, it is unknown if similar software failure incidents have occurred at multiple organizations based on the provided articles.
Phase (Design/Operation) design, operation (a) The software failure incident occurring due to the development phases related to design: The incident at the Kudankulam Nuclear Power Plant (KKNPP) was a result of a cyberattack where a user connected a malware-infected personal computer to the plant's administrative network. This breach occurred due to a design flaw in the system's security measures, allowing an external device to introduce malware into the network [91900]. (b) The software failure incident occurring due to the development phases related to operation: The cyberattack on the Kudankulam Nuclear Power Plant (KKNPP) was a result of an operational failure where a user connected a malware-infected personal computer to the plant's administrative network. This operational error led to the introduction of malware into the system, compromising the security of the plant's network [91900].
Boundary (Internal/External) within_system, outside_system (a) The software failure incident at the Kudankulam Nuclear Power Plant (KKNPP) was within the system. The incident was caused by a cyberattack where a user connected a malware-infected personal computer to the plant's administrative network, leading to the breach. The malware attack was noticed by the CERT-In, indicating that the failure originated from within the system itself [91900]. (b) The software failure incident at Kudankulam Nuclear Power Plant (KKNPP) also had contributing factors that originated from outside the system. Reports suggest that the attack may have been caused by a variant of the DTRACK virus, developed by the North Korea-linked Lazarus group. This external attribution points to the possibility of the failure originating from outside the system [91900].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: The software failure incident at the Kudankulam Nuclear Power Plant was primarily due to a cyberattack. The incident involved a malware attack on the plant's administrative network, which was noticed by the CERT-In (Indian Computer Emergency Response Team) [91900]. The malware-infected personal computer was connected to the plant's administrative network, leading to the breach. Additionally, reports indicated that a large amount of data from the administrative network was stolen, potentially making the plant vulnerable to subsequent attacks targeting critical systems [91900]. (b) The software failure incident occurring due to human actions: The incident at the Kudankulam Nuclear Power Plant was also influenced by human actions. It was revealed that a user had connected a malware-infected personal computer to the plant's administrative network, which facilitated the cyberattack [91900]. The decision to connect the infected computer to the network was a human action that contributed to the software failure incident.
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: The software failure incident at the Kudankulam Nuclear Power Plant (KKNPP) was attributed to a cyberattack where a user connected a malware-infected personal computer to the plant's administrative network [91900]. This incident highlights how hardware, specifically the infected personal computer, played a role in the failure. (b) The software failure incident occurring due to software: The software failure incident at the Kudankulam Nuclear Power Plant (KKNPP) was primarily caused by a cyberattack involving malware that infected the plant's administrative network [91900]. This indicates that the failure originated in the software domain, specifically the malicious software used in the cyberattack.
Objective (Malicious/Non-malicious) malicious (a) The software failure incident at the Kudankulam Nuclear Power Plant was malicious in nature. The incident involved a cyberattack where a user connected a malware-infected personal computer to the plant's administrative network, leading to the breach. The malware attack was noticed by the CERT-In, and data from the administrative network was reported to have been stolen, indicating malicious intent [91900]. Additionally, researchers suggested that the attack may have been caused by a variant of the DTRACK virus developed by the North Korea-linked Lazarus group, further pointing towards a malicious cyberattack [91900]. (b) The software failure incident was not non-malicious as it involved intentional actions by individuals to breach the plant's network and potentially steal data. The incident was not accidental or unintentional but rather a targeted cyberattack with the objective of compromising the nuclear power plant's systems [91900].
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident at the Kudankulam Nuclear Power Plant was primarily due to poor decisions made regarding cybersecurity measures. The incident was caused by a user connecting a malware-infected personal computer to the plant's administrative network, leading to a cyberattack [91900]. The initial denial by NPCIL officials and their belief that the plant's isolated network could not be hacked reflected complacency or ignorance about the vulnerabilities in their network security strategy [91900]. The reliance on an "air gap" security strategy, which physically isolates the computer network from the Internet, was not sufficient to protect against targeted cyberattacks, as demonstrated by the breach at Kudankulam [91900].
Capability (Incompetence/Accidental) accidental (a) The software failure incident at the Kudankulam Nuclear Power Plant was not due to development incompetence. It was reported that a user had connected a malware-infected personal computer to the plant's administrative network, leading to the cyberattack [91900]. (b) The software failure incident at the Kudankulam Nuclear Power Plant was accidental in nature. The incident occurred when a user connected a malware-infected personal computer to the plant's administrative network, which was not intentional but accidental [91900].
Duration temporary The software failure incident at the Kudankulam Nuclear Power Plant (KKNPP) in India was temporary. The incident was caused by a cyberattack where a user connected a malware-infected personal computer to the plant's administrative network [91900]. The malware attack was noticed on September 4 by the CERT-In, and it was reported that a large amount of data from the KKNPP's administrative network was stolen [91900]. This incident was not a permanent failure as it was due to specific circumstances introduced by the cyberattack.
Behaviour other (a) crash: The software failure incident at the Kudankulam Nuclear Power Plant (KKNPP) did not result in a crash where the system lost state and did not perform any of its intended functions. The incident involved a cyberattack on the plant's administrative network, leading to potential data theft and security concerns [91900]. (b) omission: The software failure incident did not involve the system omitting to perform its intended functions at an instance(s). Instead, the incident was related to a cyberattack compromising the administrative network of the nuclear power plant [91900]. (c) timing: The software failure incident was not characterized by the system performing its intended functions correctly but too late or too early. The incident was primarily focused on the cyberattack and potential data theft at the Kudankulam Nuclear Power Plant [91900]. (d) value: The software failure incident did not involve the system performing its intended functions incorrectly in terms of providing incorrect outputs or results. The incident was related to a cyberattack on the plant's administrative network, potentially leading to data theft [91900]. (e) byzantine: The software failure incident did not exhibit the system behaving erroneously with inconsistent responses and interactions, as seen in a byzantine failure scenario. The incident primarily involved a cyberattack on the Kudankulam Nuclear Power Plant's administrative network [91900]. (f) other: The software failure incident at the Kudankulam Nuclear Power Plant can be categorized as a security breach due to a cyberattack compromising the plant's administrative network. This incident highlights the vulnerability of critical infrastructure like nuclear power plants to cyber threats [91900].

IoT System Layer

Layer Option Rationale
Perception sensor, processing_unit, network_communication, embedded_software (a) sensor: The software failure incident at the Kudankulam Nuclear Power Plant was related to a cyberattack where a user connected a malware-infected personal computer to the plant's administrative network, leading to the breach. This breach involved the introduction of malware through a sensor (personal computer) connected to the network [91900]. (b) actuator: The articles do not mention any failure related to an actuator error. (c) processing_unit: The cyberattack on the Kudankulam Nuclear Power Plant involved the plant's administrative network being breached due to a user connecting a malware-infected personal computer. This breach indicates a failure related to the processing unit (administrative network) of the cyber physical system [91900]. (d) network_communication: The cyberattack on the Kudankulam Nuclear Power Plant involved the breach of the plant's administrative network, indicating a failure related to network communication error as the malware was introduced through a connected personal computer [91900]. (e) embedded_software: The malware attack on the Kudankulam Nuclear Power Plant involved the introduction of malware into the plant's administrative network through a user connecting a malware-infected personal computer. This indicates a failure related to embedded software error within the cyber physical system [91900].
Communication unknown Unknown
Application TRUE The software failure incident at the Kudankulam Nuclear Power Plant (KKNPP) in India was related to the application layer of the cyber physical system. The failure was caused by a cyberattack where a user connected a malware-infected personal computer to the plant's administrative network, leading to the breach. This incident involved bugs, operating system errors, and incorrect usage, contributing to the failure at the application layer of the cyber physical system [91900].

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence (a) death: People lost their lives due to the software failure - No information about people losing their lives due to the software failure incident was mentioned in the articles [Article 91900]. (b) harm: People were physically harmed due to the software failure - The article did not mention any physical harm to people due to the software failure incident [Article 91900]. (c) basic: People's access to food or shelter was impacted because of the software failure - There was no mention of people's access to food or shelter being impacted by the software failure incident [Article 91900]. (d) property: People's material goods, money, or data was impacted due to the software failure - The software failure incident at the Kudankulam Nuclear Power Plant resulted in a cyberattack where a large amount of data from the plant's administrative network was stolen, potentially leading to subsequent attacks targeting critical systems [Article 91900]. (e) delay: People had to postpone an activity due to the software failure - The articles did not mention any activities being postponed due to the software failure incident [Article 91900]. (f) non-human: Non-human entities were impacted due to the software failure - The software failure incident affected the Kudankulam Nuclear Power Plant's administrative network, potentially leading to risks for the nuclear facility's operations and systems [Article 91900]. (g) no_consequence: There were no real observed consequences of the software failure - The software failure incident at the Kudankulam Nuclear Power Plant had consequences related to potential data theft and risks to critical systems, indicating observed consequences [Article 91900]. (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur - The articles discussed potential consequences of cyberattacks on nuclear power plants, such as physical effects, sabotage, theft of nuclear materials, or reactor meltdown, which did not occur in this specific incident [Article 91900]. (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? - The articles did not mention any other specific consequences of the software failure incident beyond those related to data theft and potential risks to critical systems at the nuclear power plant [Article 91900].
Domain information, utilities, government (a) The failed system was related to the industry of information as it involved a cyberattack on the Kudankulam Nuclear Power Plant's administrative network, leading to data theft and potential risks to critical systems [Article 91900]. (g) The incident also impacted the utilities industry as the Kudankulam Nuclear Power Plant is a significant nuclear power plant in India, contributing to the power grid in the southern region [Article 91900]. (l) The government sector was involved as the cyberattack targeted a nuclear power plant, which is a critical infrastructure under the purview of the government. The incident raised concerns about the cybersecurity of Indian nuclear power plants and highlighted vulnerabilities in the country's critical infrastructure [Article 91900].

Sources

Back to List