 | ||
Idaho National Laboratory ran the Aurora Generator Test in 2007 to demonstrate how a cyber attack could destroy physical components of the electric grid. The experiment used a computer program to rapidly open and close a diesel generator's circuit breakers out of phase from the rest of the grid and cause it to explode. This vulnerability is referred to as the Aurora Vulnerability.
Contents
This vulnerability is especially a concern because much grid equipment supports using Modbus and other legacy communications protocols that were designed without security in mind. As such, they don't support authentication, confidentiality, or replay protection, which means any attacker that can communicate with the device can control it and use the Aurora Vulnerability to destroy it. This is a serious concern, as the failure of even a single generator could cause widespread outages and possibly cascading failure of the entire power grid, like what occurred in the Northeast blackout of 2003. Additionally, even if there are no outages from the removal of a single component (N-1 resilience), there is a large window for a second attack or failure, as it could take more than a year to replace it, because many generators and transformers are custom-built for the substation.
The Aurora vulnerability can be mitigated by preventing the out-of-phase opening and closing of the breakers. Some suggested methods include adding functionality in protective relays to ensure synchronism and adding a time delay for closing breakers.
Experiment
To prepare for the experiment, the researchers procured and installed a 2.25 MW generator and connected it to the substation. They also needed access to a programmable digital relay or another device that controls the breaker. That access could have been through a mechanical or digital interface.
In the experiment, the researchers used a cyber attack to open and close the breakers out of sync, to maximize the stress. Each time the breakers were closed, the torque from the synchronization caused the generator to bounce and shake, eventually causing parts of the generator be to ripped apart and sent flying off. Some parts of the generator landed as far as 80 feet away from the generator.
The unit was destroyed in roughly three minutes. However, this was only because the researchers assessed the damage from each iteration of the attack. A real attack could have destroyed the unit much faster.
The experiment was designated as unclassified, for official use only. On September 27, 2007, CNN published an article based on the information and video DHS released to them, and on July 3, 2014, DHS released many of the documents related to the experiment as part of an unrelated FOIA request.
Vulnerability
The Aurora vulnerability is caused by the out-of-sync closing of the protective relays.
"A close, but imperfect, analogy would be to imagine the effect of shifting a car into Reverse while it is being driven on a highway, or the effect of revving the engine up while the car is in neutral and then shifting it into Drive."
"The Aurora attack is designed to open a circuit breaker, wait for the system or generator to slip out of synchronism, and reclose the breaker, all before the protection system recognizes and responds to the attack... Traditional generator protection elements typically actuate and block reclosing in about 15 cycles. Many variables affect this time, and every system needs to be analyzed to determine its specific vulnerability to the Aurora attack... Although the main focus of the Aurora attack is the potential 15-cycle window of opportunity immediately after the target breaker is opened, the overriding issue is how fast the generator moves away from system synchronism."
Mitigations
The Aurora vulnerability is caused by the out-of-sync closing of the protective relays. As such, any mechanism that prevents the out-of-sync closing would mitigate the vulnerability.
One mitigation technique is to add a synchronism-check function to all protective relays that potentially connect two systems together. To implement this, the function must prevent the relay from closing unless the voltage and frequency are within a pre-set range. Additionally, the synchronism-check could monitor the rate of change of the frequency and prevent closing above a set rate.
Criticisms
There was some discussion as to whether Aurora hardware mitigation devices (HMD) can cause other failures. In May 2011, Quanta Technology published an article that used RTDS (Real Time Digital Simulator) testing to examine the "performance of multiple commercial relay devices available" of Aurora HMDs. To quote: "The relays were subject to different test categories to find out if their performance is dependable when they need to operate, and secure in response to typical power system transients such as faults, power swing and load switching... In general, there were technical shortcomings in the protection scheme’s design that were identified and documented using the real time testing results. RTDS testing showed that there is, as yet, no single solution that can be widely applied to any case, and that can present the required reliability level." A presentation from Quanta Technology and Dominion succinctly stated in their reliability assessment "HMDs are not dependable, nor secure."
Joe Weiss, a cybersecurity and control system professional, disputed the findings from this report and claimed that it has misled utilities. He wrote: "This report has done a great deal of damage by implying that the Aurora mitigation devices will cause grid issues. Several utilities have used the Quanta report as a basis for not installing any Aurora mitigation devices. Unfortunately, the report has several very questionable assumptions. They include applying initial conditions that the hardware mitigation was not designed to address such as slower developing faults, or off nominal grid frequencies. Existing protection will address “slower” developing faults and off nominal grid frequencies (<59 Hz or >61 Hz). The Aurora hardware mitigation devices are for the very fast out-of-phase condition faults that are currently gaps in protection (i.e., not protected by any other device) of the grid."
Timeline
On March 4, 2007, Idaho National Laboratory demonstrated the Aurora vulnerability.
On June 21, 2007, NERC notified industry about the Aurora vulnerability.
On September 27, 2007, CNN released a previously-classified demonstration video of the Aurora attack on their homepage. That video can be downloaded at here.
On October 13, 2010, NERC released a recommendation to industry on the Aurora vulnerability.
On July 3, 2014, the US Department of Homeland Security released 840 pages of documents related to Aurora.