question: How do hackers find the IPs of specific locations like power grids, nuclear facilities, etc? Are there other non-physical forms of "making contact and getting in" apart from an IP?
comment: For a start, there's services like Shodan. ### Shodan Shodan is like Google, except rather than searching for webpages, you search for services running on specific ports which are exposed to the internet. On top of knowing almost every exposed port, it also does things like fingerprint the software behind those ports, which kind of server it's running, its version, if any known exploits work on it. If it's exposed to the internet, chances are Shodan and similar services know about it. Armed with a list of services you can now throw exploits at them, millions at once from hundreds of thousands of compromised computers all over the world in illegal botnets. The ones which succeed get reported back to a command and control server, and then that entry point is used to start scanning around inside, effectively trying to identify where the original server is, and what else it is connected to once inside the firewall. ### DNS scanning What about something a bit more available? Well most services are run on specific IPs that have a DNS name attached to them, to make things easier to work with. There are many services out there which help map which DNS name maps to which IP, and of course, because it's a DNS name you know they all tend to be connected. Here's Reddit for example - URL_1 Click "more" on observed subdomains and you can find hundreds of relevant IPs and services. ### Humans suck Alternatively, you target the weak link, this is almost always a human, and by and large humans are a bit dumb. You find the target that you want and then spear phish it. Find the email addresses of people working at the facility and then contact them through it, maybe try to get an immediate foothold by attaching a trojan (most people will open an infected PDF, office macro, or click a link if you send it to them, if you social engineer them well enough e.g. " < plant manager name > . Please see the attached doc, it contains a report on staff performance and we need you to check it over. Signed, < Name of executive you found on their website > "). Let's say you don't want to expose yourself by attaching an offensive payload, you can still use this technique to do recon, even a simple reply can potentially give valuable information, such as a series of IP addresses used when the person replied, that might help you narrow down your potential Shodan results from billions, to a few thousand. ### Feeling Around Either way, once you're inside, you're usually past the main defences, the perimeter firewall. It's then a case of moving about inside. Once you've got the ability to execute code inside the network you can then try and connect to other machines inside that network, and run exploits on them, even if they were not directly accessible to the internet. The goal is to move between servers and computers (this is called lateral movement) while trying to gain access to something that would allow you to reach more important computers (escalating movement), for example a technicians PC might not be crucial, but if they've got the admin password to the control system stored in password.txt, or if you can secretly install something like a keylogger, then it's is going to allow the attacker to access something potentially more damaging. ### Unlimittteddd Powarrrr What's more damaging? Well there's usually a handful of servers which are responsible for controlling all the other ones, these are often called domain controllers, or SCADA systems which control machinery. When the US/Israel wanted to shut down Iran's nuclear program, they hacked the SCADA system controlling their nuclear enrichment centrifuges by using software which would move between windows systems inside the refinery plants, until one of them was eventually connected to the heavily protected control system, at which point it took control. ### Opening the door, reaching back out Regardless of how an attacker gains a foothold, once they're on the inside, it's common do what's called a reverse shell, or reverse connection. The infected computer or device contacts another server on the outside, and waits for instructions. Outgoing traffic is usually much less restricted than incoming traffic, and offers a more reliable path through the firewall. ### Back to the original question So in general... the external IPs are not overly important. While they certainly can be used, targeted attacks at a specific location tend to try and find their way in using other methods. Other than that, it's just a case of throwing a few billion requests at things and seeing what sticks... then take your pick from the results. I think there was a defcon talk a few years back when they did a random IP scan of remote desktop.. and the first thing which came up was the monitoring screen of some kind of chemical plant. Found it! URL_0 Edit: Cleared up a bit of text, added headers, added the link.
passages: In 2009, the "Wall Street Journal" reported that spies from China and Russia, as well as from other countries, "penetrated the U.S. electrical grid and left behind software programs that could be used to disrupt the system." According to U.S. officials, the spies didn't seek to damage the power grid; however they might be able to do so during a war or crisis. Most of the intrusions were detected by American intelligence agencies.
  
  Section::::North American Electric Reliability Corporation.
   Another option they have is an intrusion detection system. This system alerts when there are possible intrusions. Some companies set up traps or "hot spots" to attract people and are then able to know when someone is trying to hack into that area.
  
  Section::::Concerns.:Security solutions.:Encryption.
   In 2010, there was a security breach at a Belgian air force base which possessed U.S. nuclear warheads. The incident involved six anti-nuclear activists entering Kleine Brogel Air Base. The activists stayed in the snow-covered base for about 20 minutes, before being arrested. A similar event occurred in 2009.
  
  On December 5, 2011, two anti-nuclear campaigners breached the perimeter of the Cruas Nuclear Power Plant, escaping detection for more than 14 hours, while posting videos of their sit-in on the internet.
  
  Section::::Cyber attacks.
   In 2016, members of the Russian hacker organization "Grizzly Steppe" infiltrated the computer system of a Vermont utility company, Burlington Electric, exposing the vulnerability of the nation's electric grid to attacks. The hackers did not disrupt the state's electric grid, however. Burlington Electric discovered malware code in a computer system that was not connected to the grid.
  
  Section::::Potential solutions.
   Today, an important role is played by a Computer Security Incident Response Team (CSIRT), due to the rise of internet crime, and is a common example of incident faced by companies in developed nations all across the world. For example, if an organization discovers that an intruder has gained unauthorized access to a computer system, the CSIRT would analyze the situation, determine the breadth of the compromise, and take corrective action. Computer forensics is one task included in this process. Currently, over half of the world’s hacking attempts on Trans National Corporations (TNCs) take place in North America (57%). 23% of attempts take place in Europe. Having a well-rounded Computer Security Incident Response team is integral to providing a secure environment for any organization, and is becoming a critical part of the overall design of many modern networking teams.
   BULLET::::- Identifying attackers is difficult, as they are often in a different jurisdiction to the systems they attempt to breach, and operate through proxies, temporary anonymous dial-up accounts, wireless connections, and other anonymizing procedures which make back tracing difficult and are often located in yet another jurisdiction. If they successfully breach security, they are often able to delete logs to cover their tracks.
   Fingers were pointed at Wackenhut when it was revealed that anti-nuclear protesters, including an 82-year-old nun, had managed to cut through fences of one of the United States’ most protected nuclear facilities at Oak Ridge in Tennessee in July 2012. Three activists broke into the US Government's only weapons grade storage facility to paint graffiti and throw what they claimed was human blood on the walls. The breach and lack of security at the site at the time was blamed upon the absence of key Wackenhut personnel in the previous few weeks; the plant manager and chief operating officer had retired 12 days prior to the incident.
   A common example might be following unauthorized network intrusion. A specialist forensic examination into the nature and extent of the attack is performed as a damage limitation exercise. Both to establish the extent of any intrusion and in an attempt to identify the attacker. Such attacks were commonly conducted over phone lines during the 1980s, but in the modern era are usually propagated over the Internet.
   Computers control functions at many utilities, including coordination of telecommunications, the power grid, nuclear power plants, and valve opening and closing in water and gas networks. The Internet is a potential attack vector for such machines if connected, but the Stuxnet worm demonstrated that even equipment controlled by computers not connected to the Internet can be vulnerable. In 2014, the Computer Emergency Readiness Team, a division of the Department of Homeland Security, investigated 79 hacking incidents at energy companies. Vulnerabilities in smart meters (many of which use local radio or cellular communications) can cause problems with billing fraud.
   The number and sophistication of cyber attacks is on the rise. "Stuxnet" is a computer worm discovered in June 2010 that is believed to have been created by the United States and Israel to attack Iran's nuclear facilities. It switched off safety devices, causing centrifuges to spin out of control. The computers of South Korea's nuclear plant operator (KHNP) were hacked in December 2014. The cyber attacks involved thousands of phishing emails containing malicious code, and information was stolen.
  
  Section::::Attacks on nuclear installations.
   The number and sophistication of cyber attacks is on the rise. The computers of South Korea's nuclear plant operator (KHNP) were hacked in December 2014. The cyber attacks involved thousands of phishing emails containing malicious code, and information was stolen.
   The concept of CyberHumint allows cyber experts and human intelligence specialists to use real-life human sources, both in the gt and within many public or secret online social networks and operating systems.
  
  By investigating authentic human sources, intelligence experts and cyber experts can explore the various possible aims of potential attackers and their abilities, by monitoring their electronic activities. Outcomes usually leave much to be desired. Attackers are only identified after the attack has started. In just a handful of cases did companies manage to alert their clients against a pending attack.
   Iranian hackers, possibly Iranian Cyber Army pushed a massive power outage for 12 hours in 44 of 81 provinces of Turkey, holding 40 million people. Istanbul and Ankara were among the places suffering blackout.
  
  Howard Schmidt, former Cyber-Security Coordinator of the US, commented on those possibilities:
  
  It's possible that hackers have gotten into administrative computer systems of utility companies, but says those aren't linked to the equipment controlling the grid, at least not in developed countries. [Schmidt] has never heard that the grid itself has been hacked.
   There are many ways for cybercrime to take place, and investigations tend to start with an IP Address trace, however, that is not necessarily a factual basis upon which detectives can solve a case. Different types of high-tech crime may also include elements of low-tech crime, and vice versa, making cybercrime investigators an indispensable part of modern law enforcement. Methodology of cybercrime detective work is dynamic and is constantly improving, whether in closed police units or in international cooperation framework.
  
  Section::::Combating computer crime.:Legislation.
   The National Infrastructure Protection Center (NIPC) is the primary national warning center for significant infrastructure attacks. Critical asset owners, DoD installations, and Sector CIAOs monitor the infrastructure daily. Indications of an infrastructure incident are reported to the National Military Command Center, or NMCC. If indications are on a computer network, they are also reported to the Joint Task Force Computer Network Operations (JTF-CNO). The NMCC and JTF-CNO assess the indications and pass them to the NIPC and appropriate DoD organizations. When the NIPC determines that an infrastructure event is likely to occur, is planned, or is under way, it issues a national warning. For DoD, the NIPC passes its warnings and alerts to the NMCC and JTF-CNO. These warnings and alerts are then passed to the DoD components. The warning may include guidance regarding additional protection measures DoD should take.
   Some utility companies have cybersecurity-specific practices or teams. Baltimore Gas and Electric conducts regular drills with its employees. It also shares cyber-threat related information with industry and government partners. Duke Energy put together a corporate incident response team that is devoted to cybersecurity 24 hours a day. The unit works closely with government emergency management and law enforcement.
  
  Some states have cybersecurity procedures and practices:
  
  BULLET::::- New Jersey: Utilities are required to put together comprehensive cybersecurity plans.
  
  BULLET::::- Pennsylvania: Utilities must keep physical and cybersecurity, emergency response and business continuity plans. They also have to report severe cyberattacks.
   In 2011, Andress and Winterfeld drew the attention to the fact that while cyber security experts can deliver extensive reports on Internet risks, most of the alerts are still general, unspecific and do not actually meet the expectations of the specific organization. In addition, cyber security companies locate hackers or cyber attackers only when the attack is already in progress or worse - after a given system has already been damaged or compromised.
   The timing of detection surveys and location scans is critical to success, and varies with the type of location being scanned. For permanent facilities, scans and surveys must take place during working hours to detect remotely switchable devices that are turned off during non-working hours to defeat detection.
  
  Section::::Countersurveillance by countries.:United States.:Methodology.:Devices that do not emit radio waves.
  
  Instead of transmitting conversations, bugs may record them. Bugs that do not emit radio waves are very difficult to detect, though there are a number of options for detecting such bugs.
   In the U.S., plants are surrounded by a double row of tall fences which are electronically monitored. The plant grounds are patrolled by a sizeable force of armed guards.
   If an attacker installs an access point they are able to run various types of vulnerability scanners, and rather than having to be physically inside the organization, can attack remotely - perhaps from a reception area, adjacent building, car park, or with a high gain antenna, even from several miles away.
  
  Section::::Prevention and detection.
  
  To prevent the installation of rogue access points, organizations can install wireless intrusion prevention systems to monitor the radio spectrum for unauthorized access points.
   Specific OTX components include a dashboard with details about the top malicious IPs around the world and to check the status of specific IPs; notifications should an organization's IP or domain be found in a hacker forum, blacklist or be listed by in OTX; and a feature to review log files to determine if there has been communication with known malicious IPs.
   Section::::Published Research.
  
  Research within the public domain shows that state-sponsored malware and APT campaigns exhibit DNS "indicators of compromise" (IOC). Since June 2010, analysis of cyberweapon platforms and agents has been undertaken by labs including Kaspersky Lab, ESET, Symantec, McAfee, Norman Safeground, and Mandiant. The findings as released by these organizations include detailed analysis of Stuxnet, Flame, Hidden Lynx, Operation Troy, The NetTraveler, Operation Hangover, Mandiant APT1, and Careto. These malware and APT campaigns can be reliably identified within computer networks through the use of DNS analytics tools.
   Section::::Reconnaissance of the local-area network.:Footprinting.
  
  Finding "relevant" and "reachable" IP addresses is the objective of the reconnaissance phase of attacking an organization over the Internet. The relevant IP addresses are determined by collecting as many [[Domain Name System|DNS]] host names as possible and translating them to IP addresses and IP address ranges. This is called footprinting.
   BULLET::::- IV. The fourth step is the Vulnerability Assessment. This step is accomplished through multiple channels. Through the CIP program, all critical assets have a baseline vulnerability index, which is calculated from inputs associated with the class of asset and geographic region such as the probability of natural disasters, criminal or national security events, and technological failures. Asset owners, host installations, the sector CIAO, or other DoD entities may provide asset operational readiness and emergency preparedness information.
   Utility owners and operators (whether investor-owned, municipal, or cooperative) typically are responsible for implementing system improvements with regards to cybersecurity. Executives in the utilities industry are beginning to recognize the business impact of cybersecurity.
  
  The electric utility industry in the U.S. leads a number of initiatives to help protect the national electric grid from threats. The industry partners with the federal government, particularly the National Institute of Standards and Technology, the North American Electric Reliability Corporation, and federal intelligence and law enforcement agencies.
  