A Government official is reported to have claimed that approximately 300 oil and energy companies in Norway have been hit by
one of the biggest cyber-attacks ever to have happened in this Scandinavian country.
This was first reported by The Local and Dagens Næringsliv which stated that the
National Security Authority Norway (Nasjonal Sikkerhetsmyndighet, NSM)
has detailed how 50 companies in the oil sector were hacked and how
another 250 have been warned that they may have been hit too.
NSM which is Norway's cyber crime prevention authority, an
equivalent of CERT-UK in Great Britain has warned companies about the
newest threats. It
took part of the CyberEurope2014 exercise in June.
The companies themselves haven't been named – although NSM is
investigating whether the computer systems at Statoil, Norway's largest
oil company, were targeted. Prima facie it seems that Statoil was able
to fend of the attack. Statoil claimed it “has control” over the
attack. It also confirmed that it was among the firms who were target
of a “massive and advanced” attack by hackers last year that went on for
three days. Technical details are also few and far
between at this moment in time.
This isn't the first time this type of attack has hit Norwegian shores,
with ten oil, gas and defence sector firms hit via targeted
spear-phishing emails in 2011. The unidentified hackers made off with
industrial drawings, contracts and log-in credentials.
“It’s a big, bad world out there,” wrote John Knight,
Statoil’s strategy
director, in an update on the company’s internal website earlier this
summer. Newspaper Dagens Næringsliv (DN), which broke the news this week
about the national security agency (NSM)’s warnings to as many as 300
Norwegian companies, reported Thursday that Statoil faced an even more
serious situation last year.
“It started on March 12,” recalled Statoil IT director Sonja Chirico
Indrebø. She told DN that it prompted Statoil to confiscate 40 computers
from its employees who hadn’t even noticed that unknown hackers were
using them to get around Statoil’s security systems.
The attack involved the hackers’ earlier success at breaking into the
website of a well-known international company that gathers data on the
oil industry. Statoil declined to identify it, but DN reported that it’s
a site Statoil employees regularly log into with a user name and
password, to gain access to its exclusive data for which Statoil
reportedly pays large sums.
Alarms rang when Statoil’s Intrusion Detection System (IDS)
discovered that someone was trying to download code into some of
Statoil’s employees’ computers. Statoil’s IT experts then saw that the
code tried to enable communication with so-called “black lists,” areas
within Statoil’s systems that aren’t related to ordinary business
operations.
“Our employees were naturally surprised when we called and told them
that we had to confiscate their PCs because we suspected they’d been
attacked,” Indrebø told DN. The employees hadn’t noticed anything, but
had received a message when logging into the international data website
to click on a java page. That set off the process of downloading the
dangerous code.
Other energy companies also ended up under attack, which Indrebø
described as “advanced,” not least because the dangerous code was
altered while the attack was in progress, indicating someone was
monitoring it. Statoil’s team battled the attack for three days until it
was successfully fended off on March 15.
Indrebø said Statoil’s defense systems block around 2,500 emails sent
to the company every week, because of suspicious files and content.
“Every month the virus alarm sounds a few thousand times,” she added. At
a time of widespread cost-cutting at Statoil,
computer security is one area that’s expected to grow. Knight, the
member of Statoil’s top management in charge of strategy, wrote that
cyber criminals are getting increasingly sophisticated and potentially
dangerous, and employees are urged to be extra vigilant.
