Australia at increased risk of cyber attack: Microsoft report

The nation’s critical infrastructure is “severely vulnerable” to attacks from cyber criminals, according to a new report by Microsoft.

Australia is in danger of being swept up in attacks from cyber criminals targeting critical infrastructure.

Critical parts of the energy grid and essential services such as sewage treatment plants could be hit by cyber attacks, shutting down operations and threatening lives, according to Microsoft‘s latest Cyber Signals report.

75 per cent of the most common control technologies used by critical infrastructure companies – such as energy operators – around the world are severely vulnerable to cyber attacks, the report found.

Energy infrastructure is under heightened risk of attack, with major power outages possible if hackers gain access. Picture: NCA NewsWire / Kelly Barnes

As companies link their real world operations to the online world, hackers are looking to exploit weaknesses and break in. Picture: NCA NewsWire / Kelly Barnes

As Australian utility companies increasingly automate their systems and connect their operations to IT systems, they’re becoming more vulnerable to attack, according to Microsoft Australia’s national security officer, Mark Anderson.

“The problem is, similar to many of the devices in our homes, these technologies, especially in an industrial context, where they may be several decades old, may not have been initially built with cyber security in mind,” Mr Anderson said.

“So when these traditionally disconnected systems are bridged to connect to IT, they can be left vulnerable to cyber attacks which originate from the IT side of the business.”

The threat of cyber attacks has been brought into the spotlight after major attacks on Medibank and Optus. Picture: NCA NewsWire / Christian Gilles

Hacks in the United States have shut down major infrastructure such as the Colonial pipeline, which sparked fuel shortages in five states and resulted in a major jump in prices.

Attacks have also threatened lives, such as when hackers accessed systems at a local water plant in Florida and attempted to raise the level of chemicals in the water to a level which would have been poisonous.

“Nation-State and cybercriminal gangs have figured out that attacking these technologies, when not secured correctly, can in some cases be quite easy, with catastrophic consequences, for example stopping the flow of oil or electricity to an area or country,” Mr Anderson said.

“Cybercriminals have also found that while holding IT systems to ransom can these days be hit or miss in terms of if the victim will pay, holding an operational technology system which may prevent clean water from reaching millions of residents has greater consequence, and as such, increases their chance of a payout.”

Energy companies in particular are at higher risk of coming under attack.

Hackers are able to use Australian workers’ home devices and routers to break into the infrastructure of the companies they work for. Picture: NCA NewsWire / Kelly Barnes

“Adversaries realise the financial impact and extortion leverage of shutting down energy and other critical infrastructures is far greater, compared to other industries,” the report says.

Companies are increasingly finding weak links in their systems, with a 78 per cent jump in those disclosing “high-severity vulnerabilities” from 2020 to 2022 in industrial control equipment.

There are warnings everyday Australians are being used as pawns by cybercriminals. Microsoft has observed Chinese-linked threat actors target vulnerable home and small office routers to use these devices as footholds from which to launch new attacks.

According to Microsoft, China is the most common country where these attacks originate, comprising 38 per cent of attacks in 2022.

Despite an attack the scale of that on the Colonial Pipeline not being seen in Australia “yet”, Mr Anderson warns companies still need to be careful.

“We hope this new data from Microsoft reinforces the message which is already known in the industry to those who operate Operational Technology systems, and all Australian organisations, that when it comes to cybersecurity, you can never let your guard down,” he said.