Residents of two apartment buildings in Lappeenranta, a city of around 60,000 people in eastern Finland, were literally left in the cold this weekend. The environmental control systems in their buildings stopped working, and it wasn't because of a blackout. It was actually a DDoS attack that took them down.
Both buildings are managed by Valtia, a facilities services company headquarted in Lappeenranta. Valtia CEO Simo Rounela confirmed to Metropolitan.fi that the central heating and hot water systems in both buildings had been attacked. In attempt to fight off the attack, the systems rebooted -- and subsequently got stuck in an endless loop. This is precisely the kind of thing that Chester Wisniewski at SophosLabs was concerned with when he urged makers (and users) of industrial control systems to take meaningful steps toward improving security.
At This Very Winter Hackers DDoS Attack On Heating System In Finland
Fortunately for the residents, it's not that cold Lappeenranta. The high today should be around 20F. That's a few degrees below the historical average for November, certainly, but nowhere near the -25 they'll see once winter finally arrives. Valtia quickly relocated those affected while they addressed the DDoS attack and brought the control systems back online.
In that sense, it's a good thing the attack happened now. At least Valtia had a chance to shore up defenses while the mercury in Finnish thermometers hasn't plunged as far as it's going to this winter.
Something about this attack feels like the one launched on a Liberian mobile provider last week. Was someone probing a relatively small system in a relatively remote location just to test capabilities? It's a strong possibility. The end game might be a much larger building managed by a company with much deeper pockets... and perhaps one willing to pay attackers to call off the dogs.
Lappeenranta is a small city in eastern Finland with just 60,000 residents. Usually, this city is quiet and peaceful and very very cold in November. So, when people fail to get the desired warmth despite having proper heating mechanism indoors, they are bound to get really angry. This is what happened to residents of two well-facilitated apartment buildings in Lappeenranta.
The buildings that suffered heat cut were both managed by Valtia. Valtia is a Lappeenranta based facilities service provider firm. According to the CEO at Valtia Simo Ruonela, it was indeed true that the central heating and hot water systems of the two apartment buildings were attacked with DDoS and to thwart the attack, the systems automatically rebooted. But afterward, the system got stuck in an infinite loop causing the unannounced heat cut.
According to a published statement from the local IT management firm Valtia, and a report by the local Finnish Communications Regulatory Authority, the attack was noticed after a building automation system used in two properties began issuing strange alarms and could not be remotely accessed. The cause was a sustained denial of service attack that was flooding the building management system with bogus Internet traffic, causing it to restart every few minutes, and denying remote administrators at Valtia access to the device. The attack spanned from late October through November 3 to November 4, according to Simo Rounela, the CEO of Valtia. a report by the website Metropolitan.fi.
Residents of two apartment buildings in Lappeenranta city in southeast Finland were left in the cold after a DDoS attack knocked out heating systems. The cyberattack is believed to have lasted for nearly a week, starting in late October and ending on 3 November, local reports said.
According to Simo Rounela CEO of Valtia, the firm in charge of managing overall operations and maintenance of both the affected properties, the attack temporarily disabled the computer systems that controlled the central heating and hot water distribution of both buildings, Metropolitan.fi reported.
In an attempt to ward off the attacks and remain functional, the targeted systems went into an endless cycle of rebooting. This in turn resulted in the heating system being cut off, leaving residents with no heat and presumably, cold showers. "Remote connection was not working, so went on-site for more inspections," Rounela said. He explained that the controlling systems affected by the attack rebooted every 5 minutes until they eventually stopped functioning altogether.
Rounela noted that the attack hit a DNS servers used by the company. Valtia was made aware of the attack via the affected buildings' automated systems, developed by a firm called Fidelix. Rounela said that once the smart home systems affected had been disconnected from the internet, the heating systems began to function normally.
According to building maintenance expert Sami Orasaari, the security of an automation system is often neglected, with most housing companies and private owners reluctant to investing in network firewalls. Orasaari said that in this particular case, the hackers appeared to have scanned networks to find vulnerable devices and leveraged them.
Residents of two buildings in Lappeenranta, Finland spent a few days in the cold over the past few days as DDoS attacks aimed at a service provider indirectly affected the smart building heating system installed at their residential complex.
It's the latest in a string of attacks that have leveraged the internet of things to overwhelm systems. In this most recent case, the hackers directed traffic to the computer system that controls the heating (including the hot water heaters) for the apartment buildings. The system belongs to a company called Valtia, which provides facility management services.
Earlier this year, tech security journalist Brian Krebs found himself in hackers' crosshairs. The web servers hosting his site, KrebsOnSecurity, became inundated with traffic from a collection of internet devices including routers, DVRs and security cameras. Akamai, a company that provides security services to Krebs' site, was able to fend off the attack. But according to Akamai officials, the amount of traffic they saw was nearly twice that of the largest attack they had seen previously.
Fortunately for the residents of those apartment buildings in Finland, they aren't in the coldest part of winter yet. In late December, Lappeenranta gets barely more than five hours of sunlight, and the high is around 26 degrees Fahrenheit (about negative 3 degrees Celsius). Previous DDoS attacks mostly caused an inconvenience, but this latest example from Finland could put people's lives in danger.
According to the Civil Aviation Administration of Vietnam, at 13h46 on 29 July the IT-systems of VietJet, Vietnam Airlines to do the flight check-ins at the Tan Son Nhat International Airport were attacked and had to stop working. At 16h07', A team of self-proclaimed Chinese Hackers attacked flight information screens at Noi Bai International Airport, posting notices that state media said criticized the Philippines and Vietnam and their claims in the South China Sea.,[9][10] The hackers also took control of the speaker system at Noi Bai airport for a few minutes, during which the speakers broadcast a male voice distorting Viet Nam's claims over the East Sea in English.[11] The check-ins system of Vietnam Airlines there was also attacked and had to switch to manual procedure completion, which lead to flight delays.[12] altogether, Noi Bai airport has 30 flight, and Tan Son Nhat more than 60 flight delayed from 15 til more than an hour, affect about 2.000 passengers.[9] 2ff7e9595c
Comments