Cybercriminals may soon be able to target entire power grids without using Stuxnet like malware to infiltrate critical infrastructure.
Princeton University researchers developed a series of proof-of-concept attacks which would allow threat actors to target power grids using IoT botnets comprised of high wattage devices such as air conditioners and heaters, according to the BlackIoT: IoT Botnet of High Wattage Devices Can Disrupt the Power Grid report.
Dubbed manipulation of demand via IoT (MadIoT) attacks, researchers developed attacks which could cause sudden generation tripping, disrupt grid re-starts, line failures and cascades, and increase demand from the systems, all of which could result in outages or even blackouts.
Threat actors could, for example, simultaneously turn on or off several high-wattage IoT devices which can result in frequency instability resulting in an imbalance between the supply and demand.
Cybercriminals could even use these attacks to increase operating costs of a target by manipulating energy consumption to benefit certain energy providers.
In order to defend against such attacks, researchers recommend grid operators prepare for such attacks by ensuring their systems can handle the drastic load changes these attacks could bring and that IoT device manufactures do more to prevent potential compromises and conduct more research on IoT vulnerabilities.
