Cyber-vulnerability of physical security systems: Lessons from 2008 Turkish pipeline explosion

Discussions in our industry about cyber-threats to physical security systems, including IP video, often centre around hypotheticals. How might a hacker gain access to a video camera feed? How might he or she enter the larger enterprise system through a software vulnerability related to physical security? We all know assessing threats often involves considering the hypothetical, of course, but we should also seek to learn from actual events in the past.

In relation to vulnerabilities of video surveillance systems to cyberattack, a historic event from seven years ago provides plenty of food for thought. It was in the news at the time, but the role of cybersecurity wasn’t known then, and, in our market, it has not been widely reported. The event isn’t a usually cited example of the dangers of insufficient cybersecurity in physical security systems; however, it should be. Even seven years later, the lessons of the Turkish pipeline explosion in 2008 couldn’t be timelier.

Cyberattack incident

The Baku-Tbilisi-Ceyhan (BTC) pipeline runs 1,099 miles from the Caspian Sea to the Mediterranean, following a route through the former Soviet Union. On 7 August 2008, there was an explosion on the pipeline near Refahiye, Erzincan, a town in eastern Turkey. Cyber-attackers entered the operational controls of the pipeline to increase oil pressure without setting off alarms. The high pressure may have caused the explosion; no physical bomb was ever found.

The explosion caused more than 30,000 barrels of oil to spill and cost millions of dollars a day in transit tariffs during the two and a half weeks the pipeline was down. The Turkish government reported it as a mechanical failure. However, in 2014, Bloomberg reported that hackers had shut down alarms, cut off communications and super-pressurised the crude oil in the line. Some believe the Russian government was behind the explosion.

The hackers took down the system of sensors and video cameras that monitored the pipeline in the area, so there was no signal of the explosion. News of the event first came 40 minutes later from a security worker who saw the flames. There was 60 hours of video footage erased by the hackers. In fact, the only existing footage related to the event was provided by a single (offline) thermal camera that showed two men with laptop computers walking near the pipeline days before the explosion.

Consequences of ignoring physical security system vulnerabilities

There is a specific reason that this incident should be of great interest to the security marketplace: Because hackers entered the computer system through a software vulnerability that was part of the video surveillance system. Hackers gained entry using vulnerability of the cameras’ communication software and then moved deep into the internal network.

Far from theoretical, in this instance, the cyber-vulnerability of a physical security system provided a means to deploy a massively destructive attack – a cyberattack with physical consequences. The cameras supposedly watching the site were not only useless (after the hacker erased their video feeds), but that very camera system provided entry for the attackers into the systems.

In addressing the cybersecurity vulnerabilities of IP systems, you could say our industry is late to the party. As the Turkish pipeline explosion suggests, we are at least seven years late.

Now, we are playing catch-up with the recent spate of cybersecurity programming at industry shows, and manufacturers are now addressing cybersecurity vulnerabilities in their systems. Previously, basking in the productive and beneficial glow of networked systems, we have denied cyber-vulnerabilities; we have ignored the “elephant in the room.”

More to the point, we have ignored a large open door inviting the bad guys in.