Cyberattacks on Military Bases Expose Critical Infrastructure Security Gaps

After a series of cyberattacks on freezer systems at U.S. military bases and across Europe, the Cybersecurity and Infrastructure Security Agency (CISA) joined the FBI and three other federal agencies Thursday in issuing guidance to help safeguard against further vulnerabilities.

In a post on CISA’s website, the officials from the cybersecurity agency along with the FBI and departments of Agriculture, Health and Human Services and Transportation said they “are aware of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally” and called on operators to either patch and update their systems or, if necessary, take them offline until they were secure.

“The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards,” the guidance said.

The concerns over the susceptibility of refrigeration systems emerged after a series of cyberattacks in August at six commissaries housed on U.S. military bases. Reuters has reported that similar attacks have since occurred in France, Sweden, Belgium, Luxembourg and other countries.

Lauryn Williams, deputy director and senior fellow in the Strategic Technologies Program at the Center for Strategic and International Studies, said the attacks in some ways mirror July’s hack of water utility companies across at least seven states, highlighting the vulnerabilities in many information technology and operational technology (IT/OT) systems.

“There are some parallels to what we know about these refrigeration attacks in that cyberthreat actors were able to target those water systems through remote connection points, the connection points that were connected to the internet and that provided an easy entry point for would-be threat actors,” said Williams, a former chief of staff to the assistant secretary of defense for industrial base and director for strategy in the White House Office of the National Cyber Director.

The potential of cyber vulnerabilities in IT/OT systems has been a concern for federal agencies for some time, but has since been elevated by the introduction of artificial intelligence tools that can allow attackers to find traditional vulnerabilities more quickly and exploit them with fewer resources and skills than previously.

Williams added that AI also offers cyber defenders different strategies to mitigate threats as well, also providing them speed to react and take action on exploitable weaknesses or to take systems offline until they can be patched.

“One of the things that companies and organizations have had to do is; I think we saw this just a couple of weeks ago around the php2shell vulnerabilities, which AI helped identify and also helped identify patches and mitigations,” she said. “We’ve seen companies take websites offline because of how quickly they know threat actors might be able to exploit vulnerabilities once they’re publicly known, even before they, on the other side of things, are able to catch those vulnerabilities.”

Thursday’s CISA guidance called on operators to take minimum steps like reducing control system devices and/or systems’ public internet exposure, creating dedicated OT virtual local area network (VLAN) to separate OT devices from business networks, restricting access, ensuring reliable backups, applying software patches, enforcing credential security and other steps to safeguard these systems.

Williams said that she hopes the occurrence of these types of cyberattacks will spur more awareness in the inherent vulnerabilities in IT/OT systems, but that could depend on the cyber hygiene actions taken by the owners and operators of these systems.

“The history of cybersecurity policy in the U.S. is that we have a landscape that is dominated by voluntary guidance as opposed to requirements for critical infrastructure owners and operators,” she said. “So the same sorts of mitigations have been identified for years, but they are largely not required, they are largely voluntary and it’s up to your privately-owned and operated utilities and operators in general to implement these requirements.”