It is probably one of the most sinister aspects of any cyberattack. The possibility that a malicious activity can go beyond the digital environment and cause real-world damage changes all the rules, even those that have not been written. The first great example of a cyberattack causing physical damage was Stuxnet, but now news from Germany indicates that a computer intrusion caused serious destruction in a steel factory.
The attack on Sony Pictures left us with scared cinema chains, fights between directors and producers, a comedy that died and came back to life in a matter of days, and a certain media fixation on North Korea. I imagine Sony Pictures can talk about “economic damage” if it considers its systems offline, the loss of productivity, and the fragmentation in the distribution of The Interview, but as far as we know nobody got hurt. In the past, the idea associated with “damage” caused by a computer attack was ordering a printer to spit out copies until it ran out of paper, but today different parameters are handled. Stuxnet destroyed about a thousand Iranian centrifuges, and thus became the first reported cyberattack with physical consequences. This also exposed the critical situation facing many industrial control systems, full of vulnerabilities.
The Steel Factory Attack
The latest news was published just before Christmas. A report from the Federal Office for Information Security in Germany (something like the Spanish INCIBE) reports on the damage caused in a local steel factory, whose name has not been revealed. The attackers gained access to the factory's systems using spear-phishing (the same technique used to hack ICANN) which allowed them to penetrate the corporate network. From there they began their “ascent”, exploring the structure until reaching the production network, where they affected a “multitude” of systems. The most serious thing was that the plant was unable to shut down the blast furnace correctly, causing massive damage to the system, although the report does not provide additional details.
What the text does highlight is that the attackers had extensive knowledge not only of “conventional” computer security, but also of industrial systems and production processes. It has not yet been established whether the damage caused by the furnace was the main objective or simply a side effect, but the feeling that the cyberattack conveys is that of a carefully planned sabotage. This only confirms what has been said in recent years: A country can reinforce its defense in its weapons and communications infrastructure, but if things like hospitals, water treatment plants, and power plants are ignored, the damage can be equally great, or even worse.
