Threat Analysis of BlackEnergy Malware for Synchrophasor based Real-time Control and Monitoring in Smart Grid

The BlackEnergy malware targeting critical infrastructures has a long history. It evolved over time from a simple DDoS platform to a quite sophisticated plug-in based malware. The plug-in architecture has a persistent malware core with easily installable attack specific modules for DDoS, spamming, info-stealing, remote access, boot-sector formatting etc. BlackEnergy has been involved in several high profile cyber physical attacks including the recent Ukraine power grid attack in December 2015. This paper investigates the evolution of BlackEnergy and its cyber attack capabilities. It presents a basic cyber attack model used by BlackEnergy for targeting industrial control systems. In particular, the paper analyzes cyber threats of BlackEnergy for synchrophasor based systems which are used for real-time control and monitoring functionalities in smart grid. Several BlackEnergy based attack scenarios have been investigated by exploiting the vulnerabilities in two widely used synchrophasor communication standards: (i) IEEE C37.118 and (ii) IEC 61850-90-5. Specifically, the paper addresses reconnaissance, DDoS, man-in-the-middle and replay/reflection attacks on IEEE C37.118 and IEC 61850-90-5. Further, the paper also investigates protection strategies for detection and prevention of BlackEnergy based cyber physical attacks.

Real-time PCR demonstrates high prevalence of Schistosoma japonicum in the Philippines:implications for surveillance and control

BACKGROUND: The Philippines has a population of approximately 103 million people, of which 6.7 million live in schistosomiasis-endemic areas with 1.8 million people being at risk of infection with Schistosoma japonicum. Although the country-wide prevalence of schistosomiasis japonica in the Philippines is relatively low, the prevalence of schistosomiasis can be high, approaching 65% in some endemic areas. Of the currently available microscopy-based diagnostic techniques for detecting schistosome infections in the Philippines and elsewhere, most exhibit varying diagnostic performances, with the Kato-Katz (KK) method having particularly poor sensitivity for detecting low intensity infections. This suggests that the actual prevalence of schistosomiasis japonica may be much higher than previous reports have indicated.

METHODOLOGY/PRINCIPAL FINDINGS: Six barangay (villages) were selected to determine the prevalence of S. japonicum in humans in the municipality of Palapag, Northern Samar. Fecal samples were collected from 560 humans and examined by the KK method and a validated real-time PCR (qPCR) assay. A high S. japonicum prevalence (90.2%) was revealed using qPCR whereas the KK method indicated a lower prevalence (22.9%). The geometric mean eggs per gram (GMEPG) determined by the qPCR was 36.5 and 11.5 by the KK. These results, particularly those obtained by the qPCR, indicate that the prevalence of schistosomiasis in this region of the Philippines is much higher than historically reported.

CONCLUSIONS/SIGNIFICANCE: Despite being more expensive, qPCR can complement the KK procedure, particularly for surveillance and monitoring of areas where extensive schistosomiasis control has led to low prevalence and intensity infections and where schistosomiasis elimination is on the horizon, as for example in southern China.