Photo: Assembled Chemical Weapons Alternatives / Flickr
Russian anti-virus firm Kaspersky Lab announced Tuesday that it plans to develop a secure operating system to protect critical infrastructure systems from online attacks.
Kaspersky hopes to develop a pared-down operating system that would be less vulnerable to attack from malicious programs like Stuxnet – a cyberweapon discovered in 2010 that was designed to target industrial systems that control Iran’s nuclear program.
“Today there exists neither operating systems nor software that could be applied in industrial/infrastructural environments whose produced data on processes could be fully trusted,” wrote company founder Eugene Kaspersky in a blog post. “And this left us with no other option than to begin developing something new ourselves.”
Many industrial control system applications — such as distributed control systems (DCS) and supervisory control and data acquisition systems (SCADA) — currently operate on top of the Windows operating system or on versions of Linux, both of which are general operating systems that contain many features that are unnecessary for running industrial control systems.
Industrial control systems are used in a wide variety of critical facilities, including chemical plants, water treatment plants and electric utilities, as well as in factory settings to control assembly lines and to batch-mix ingredients in food production facilities. Using general-purpose operating systems in industrial settings like these opens them to the same kinds of vulnerabilities that general computer users face from malware.
Kaspersky proposes to create a more locked-down system that contains only the most basic functionality necessary to operate industrial control applications, thus reducing the attack surface for malware to target.
“Since John McClane isn’t around to solve the problem of vulnerable industrial systems, … it comes down to KL to save the world, naturally!” Kaspersky wrote, referring to the fictional character that actor Bruce Willis played in the film Live Free or Die Hard.
But according to one computer security expert, Kaspersky isn’t likely to meet with very many takers for such a system.
“It’s a very ambitious effort, and I think it has a long shot of succeeding anywhere outside of Russia,” says Dale Peterson, CEO and founder of Digital Bond, a firm that specializes in industrial control system security. “I think the odds of it actually succeeding in changing anything in the ICS market is very small.”
Peterson says it’s a smart and legitimate endeavor for a country to want to develop a security system for critical infrastructure inside its borders, but outside of Russia, the company would face trust issues around the security of the supply chain.
“You don’t know if they’re getting funding from the Russian government for doing this,” he says.
Although Kaspersky Lab is an independent company, Eugene Kaspersky was educated in his teens at the Institute of Cryptography, Telecommunications, and Computer Science, a facility backed by Russia’s KGB. He also served for a period as an intelligence officer in the Soviet military.
At a time when concerns about backdoors in Chinese telecommunications equipment have prompted a report from Congress about the potential for the Chinese government to spy on communications, companies contemplating a Kaspersky operating system might be concerned that it could have backdoors in it, for example, or that the Russian government was given access to the source code to find vulnerabilities in it to attack.
A Kaspersky Lab spokesman told Wired that the company is receiving no Russian government funding for the project.
But aside from the potential for Russian-government involvement, Peterson says Kaspersky would likely face an uphill battle in convincing industrial control system vendors like Siemens and Rockwell to revamp their applications to run on a Kaspersky operating system.
Kaspersky didn’t provide details about the planned operating system, but said in his blog post Tuesday that for such an operating system to succeed and provide a guarantee of security, “it must contain no mistakes or vulnerabilities whatsoever in the kernel,” and “must be 100 percent verified as not permitting vulnerabilities or dual-purpose code” and would need to “provide the full range of the very latest principles of security.”
Although the operating system is only in the initial planning stages, Kaspersky wrote that he was disclosing the plan to address rumors that have been circulating.
Rumors had been circulating about what Kaspersky Lab was planning for industrial control systems after a Wired magazine story about the company’s colorful founder revealed in July that his company was working on a “secret project” to “save the world,” or at least protect computers from malicious attacks.
In a locked room down the hall from his office, Kaspersky is working on a secret project to fulfill that lofty ambition. Not even his assistant has been allowed inside. But after we’ve spent a day together—and knocked back a few shots of Chivas 12—he unlocks the door and offers me a peek. It’s an industrial control system, a computer for operating heavy machinery, just like the ones that Stuxnet attacked (and, Kaspersky researchers believe, Flame may also have targeted). Kaspersky’s team is quietly working on new ways to harden these systems against cyberattack—to protect the power grids and prisons and sewage plants that rely on these controllers. The idea is to make future Stuxnets harder to pull off. The controllers haven’t been engineered with security in mind, so the project is difficult. But if it succeeds, Kaspersky’s seemingly outsize vision of his company’s role in the world might become a little less outlandish.