Search NASA⌕ Search

SEARCH · Search NASA

Results for “reference systems catalog”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

122 records · Page 7
All sourcesNASA NTRSDOE OSTI
NASA NTRS2019

High-Resolution Mid-Infrared Molecular Line Survey of the Orion Hot Core

The basic building blocks of life are synthesized in space as part of the natural stellar evolutionary cycle, whereby elements ejected into the interstellar medium by dying stars are incorporated back into the dense clouds, which form the next generation of stars and planets. The formation of stars and planets are fundamental to the evolution of matter in the Universe as complex molecules are created and destroyed during this step. Understanding these processes will allow us to answer “What is the relation between the molecules we see in the ISM and the molecular inventory of Earth and the terrestrial planets in the Solar System?” Measuring and cataloging the inventory of organic molecules and understanding their evolution requires observations over a broad wavelength range (IR, MIR, FIR, (sub)mm, and radio) to cover all stages of this evolutionary cycle needed to link interstellar material to that delivered to planets. High-resolution molecular line surveys provide chemical inventories for star forming regions and are essential for studying their chemistry, kinematics and physical conditions. Previous high spectral resolution surveys have been limited to radio, sub-mm and FIR wavelengths; however, Mid-infrared observations are the only way to study symmetric molecules that have no dipole moment and thus cannot be detected in the (sub)mm line surveys from ALMA. Past midinfrared missions such as ISO and Spitzer had low to moderate resolving power that were only able to link broad features with particular molecular bands and could not resolve the individual rovibrational transitions. JWST will provide exceptional sensitivity in the MIR, but will also not have sufficient spectral resolution, which can lead to confusion in identifying the contribution from strong to moderate strength molecular species. We present new results from an on-going high resolution (R ~ 60,000) line survey of the Orion hot core between 12.5 - 28.3 μm and 7 - 8 μm, using the EXES instrument on the SOFIA airborne observatory. SOFIA's higher-resolution and smaller beam compared to ISO allows us to spatially and spectrally isolate the emission towards the hot core. This survey will provide the best infrared measurements (to date) of molecular column densities and physical conditions, providing strong constraints on the current chemical network models for star forming regions. This survey will greatly enhance the inventory of resolved line features in the MIR, making it an invaluable reference to be used by the JWST and ALMA scientific communities.

Rangwala, Naseem↗
DOE OSTI2022

Precursor Analysis Report: Doppelpaymer Ransomware Attack on Petroleos Mexicanos (PEMEX) 2019

The DoppelPaymer Ransomware Attack on Petroleos Mexicanos (PEMEX) 2019 Precursor Analysis Report leverages publicly available information about the PEMEX cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The 2019 DoppelPaymer ransomware attack on PEMEX, Mexico’s nationalized petroleum corporation, highlights a unique threat that ransomware and cybercriminal extortion poses to Operational Technology (OT) environments in critical infrastructure. The incident began with an employee downloading commodity malware that allowed adversaries to gain initial access to PEMEX’s enterprise environment. After conducting privilege escalation, tool ingress, and data exfiltration, the adversaries deployed DoppelPaymer ransomware throughout the PEMEX enterprise environment, resulting in the company having to take dozens of systems offline for at least several days. Although PEMEX stated that their operations were not affected, the data exfiltrated from PEMEX was made available for download on DoppelPaymer’s leak site, as well as on other illicit criminal forums. This stolen data included not only company information, but also sensitive OT-specific configuration data. This incident showcases how cybercriminal exfiltration and posting of sensitive OT architecture documentation can pose security concerns for the targeted organization for years due to the long lifespan of OT assets and architectures. Researchers and analysts identified 18 unique techniques utilized during the attack with a total of 190 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fifteen of the identified techniques used during the DoppelPaymer ransomware attack were precursors to the triggering event. Analysis identified 163 observables associated with these precursor techniques, 34 of which were assessed to have an increased likelihood of being perceived in the 60 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
NASA NTRSDate not supplied

Analysis of Launch Vehicle Liftoff Debris: Historical Perspective from Space Shuttle and Application to Artemis I

Human exploration-class launch vehicles are inherently prone to debris due to the extreme environments generated during pre-launch operations, liftoff, and flight. The use of cryogenic propellants often requires thermal protection system (TPS) coatings, typically foam, to maintain the propellant conditions in the tank and prevent an accumulation ice on the external surface of the vehicle. Some ice growth is to be expected at umbilical interfaces, vents, flanges, or brackets where it is difficult to apply TPS. This ice may come loose at any time due to wind on the launch pad, structural vibration and acoustics after rocket ignition, or aerodynamic forces during flight. This phenomena is especially apparent on vehicles with no TPS, such as the Saturn V rockets used in the Apollo Program, see Figure 1. During propellant tanking, the thermal contraction of the underlying substrate may generate cracks in the TPS (Figure 1). Chunks of TPS can release due to the expansion of ingested gas from cryopumping or from aerodynamic forces if the crack creates an offset surface. Most foams will also have a certain amount of “popcorning” where small pieces of foam will pop off during flight because of the differential between the static surface pressure and the pressure of the gas trapped in the foam cell structure. There are a number of other coating or closeout materials that may be shed from the vehicle and become debris. During pre-launch operations and liftoff, the vehicle may also be exposed to debris originating from the launch pad or ground support equipment. This debris is separate from foreign object debris, or FOD, which is not intended to be present and is strictly controlled through operations and maintenance procedures. In this case, debris is generated from hardware and materials that are necessary for launch and are subject to the intense vibration, acoustics, and direct plume impingement of the launch environment. Examples include ice from umbilicals, tape and tie wraps that protect cables, and rust or corrosion from the launch platform. While NASA has historically been aware of debris as a potential issue that could cause a failure resulting in loss of mission, loss of vehicle, or loss of crew, the likelihood and severity of that risk was not always well understood or given sufficient weight in program and flight decisions. After the Space Shuttle Columbia accident (STS-107), the investigation found that foam TPS debris shed from the external tank was the proximate cause of the damage to the orbiter wing. Six previous observations of debris released from the foam ramp that covered the bipod connecting the forward end of the orbiter to the external tank resulted in minor changes or were determined to be accepted flight risks. Two occurrences of bipod ramp foam loss were not identified until the STS-107 investigation. Despite the damage inflicted by these debris strikes, the Shuttle Program Requirements Control Board deemed the vehicle safe to fly. During the Return to Flight effort following the Columbia disaster, NASA Engineering developed a process for the assessment of debris transport, impact, and damage tolerance to support independent assessments of risk by NASA Safety and Mission Assurance (S&MA). Under this system, each element (vehicle or ground system) defines a catalog of all expected debris based on launch history, component testing, or analysis. Debris transport analysis (DTA) is conducted using the debris catalog characteristics and potential flow transport mechanisms (e.g., vehicle aerodynamics, gravity, wind, plume-driven). The predicted debris impact locations and velocities are provided to the hardware owners, who use available test data and analysis to determine whether each component can withstand the impacts. In cases where the element hardware may be severely damaged or fail, the options are to mitigate the debris source through some change in design or operation, or to work with S&MA to try to characterize the probability of the impact and damage for program risk acceptance. Because of the differences in debris characteristics and transport, the DTA has been divided between the Liftoff and Ascent regimes. The development and application of Liftoff DTA methodology from the Shuttle Program to the current Artemis Program is the subject of this paper. Liftoff DTA covers the time from the start of pre-launch operations at the launch pad, up until the vehicle clears the launch tower and there is no longer any interaction with ground systems. Debris transport during this period is broadly classified as either gravity, wind, and plume-entrained (GWPE) or plume driven (PD). GWPE debris is generally lower speed, travelling in a forward-to-aft direction. PD transport includes flow features from the rocket ignition transient, as well as plume impingement and recirculation that occur as the vehicle lifts off the launch platform. In these cases, the debris typically moves in an aft-to-forward direction at higher speeds. The applicable transport mechanisms must be considered for each piece of debris depending on the material, and release location and time. For example, rust or metallic debris from the tower could fall (GWPE) and impact the vehicle before landing on the launch platform deck where it could be also be transported by plume impingement (PD). However, falling ice (GWPE) from an umbilical is unlikely to survive impact with the vehicle or launch platform and be available for PD transport. Modeling of debris transport is accomplished using a set of DTA tools which simulate debris trajectories subject to a reference frame acceleration (i.e., gravity) and aerodynamic drag. Where the trajectory encounters a solid surface, the debris is allowed to rebound with a specified coefficient of restitution. The drag is calculated by interpolating the fluid state at each point in the debris trajectory from high-fidelity computational fluid dynamics (CFD) simulations of the launch vehicle and pad. The CFD data may either be static (steady state or time averaged), typically for GWPE transport, or dynamic (time-accurate) for PD flow features like the ignition transient. Examples of the CFD flow field solutions for the Space Launch System (SLS) rocket and launch pad are shown in Figure 2. Typical SLS debris trajectory predictions from DTA are illustrated in Figure 3. The final version of this paper will include a more detailed examination of the Liftoff DTA process developed during the Shuttle Program, and how it has been augmented and applied to the SLS rocket under the Artemis Program. Comparisons with debris observations from the Artemis I launch will demonstrate validation of the tools and methodology.

Debris↗
DOE OSTI2025

Precursor Analysis Report: Blackmatter Ransomware Attack on New Cooperative 2021

The BlackMatter Ransomware Attack on New Cooperative 2021 Precursor Analysis Report leverages publicly available information about the New Cooperative cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The BlackMatter ransomware was first identified in July 2021 and is reported to have infected more than 50 corporations around the world. , The Iowa-based grain cooperative, New Cooperative, was impacted by the BlackMatter ransomware on or before 18 September 2021. The adversary likely resided on New Cooperative’s networks for 15 days prior to encrypting its network and demanding New Cooperative pay $5.9 million in ransom by 25 September to unlock systems and prevent 1 terabyte (TB) of sensitive data from being publicly released. It is not clear if New Cooperative paid the ransom. The full impact of the ransomware attack is not known; however, according to New Cooperative’s general manager, the attack caused the company’s automated processes to revert back to processes used in the 1970s. , As of 6 October, only 50 percent of New Cooperative’s operations were utilizing automated processes. The company took eight weeks to rebuild the entire network and information technology (IT) systems from the ground up, which puts the date of fully recovery around 13 November. Researchers and analysts identified 20 unique techniques utilized during the attack with a total of 404 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Seventeen of the identified techniques used during the New Cooperative cyber attack were precursors to the triggering event. Analysis identified 360 observables associated with these precursor techniques, 284 of which were assessed to have an increased likelihood of being perceived in the 15 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: Ryuk Ransomware Attack on Universal Health Services 2020

The Ryuk Ransomware Attack on Universal Health Services (UHS) 2020 Precursor Analysis Report leverages publicly available information about the 2020 UHS cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. UHS manages over 400 hospitals and is one of the largest healthcare providers in the United States with 3.5 million patients each year. On 27 September 2020, UHS suffered a widespread ransomware attack that resulted in a denial of service to critical internet-dependent healthcare systems including workstations, phones, and data centers. Employees resorted to filing patient details with pen and paper, while other facilities had to redirect ambulances and urgent patients to other facilities for adequate care. Adversaries carried out the attack with Ryuk, a ransomware that encrypts data and generates a RyukReadMe.txt ransom note with the ransom fee to decrypt the data, varying from 15 Bitcoin (BTC) to 50 BTC, equivalent to roughly $\$$353,892 to $\$$964,617. UHS did not pay the ransom and was able to recover data through backups, but still reported an impact of $\$$67 million dollars in recovery costs. On 29 October, one month after the attack, UHS made an official statement that their systems had been restored and they were resuming normal operations. Researchers and analysts identified 18 unique techniques (used in a sequence of 19 steps) utilized during the attack with a total of 185 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fourteen of the identified techniques used during the UHS cyber attack were precursors to the triggering event. Analysis identified 106 observables associated with these precursor techniques, 82 of which were assessed to have an increased likelihood of being perceived in the 30 days to two hours preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Conti Ransomware Attack on the Health Service Executive of Ireland 2021

The Conti Ransomware Attack on the Health Service Executive (HSE) of Ireland 2021 Precursor Analysis Report leverages publicly available information about the attack and catalogs anomalous observables for each technique employed by the adversary. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The HSE provides public healthcare corporate services and operational services throughout Ireland, with critical functions including the acute national ambulance service, acute hospital service, and community healthcare service. On 14 May 2021, Conti ransomware encrypted 80 percent of the HSE’s Information Technology (IT) infrastructure across corporate, hospital, community, and electronic health record services. Conti is a ransomware-as-a-service operation that encrypts local files, uses double extortion against victims, and is facilitated by many intrusion tools. The attack forced the HSE to shut down its entire IT infrastructure to contain the ransomware, forcing employees to revert to pen and paper recordkeeping and leading to the cancellation of many appointments and procedures. The adversary also exfiltrated 700 GB of data, compromising the confidentiality of patients’ protected health information. Had the adversary targeted the COVID-19 cloud systems or operational technology assets, such as Internet of Medical Things medical devices or smart building management systems, the impact of the attack would almost certainly have been far more severe. Researchers and analysts identified 21 unique techniques (used in a sequence of 23 steps) likely utilized during the attack with a total of 1,185 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-one of the identified techniques used during the attack on the HSE were precursors to the triggering event. Analysis identified 1,086 observables associated with these precursor techniques, 850 of which were assessed to have an increased likelihood of being perceived in the 57 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022

The Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022 Precursor Analysis Report leverages publicly available information about the Industroyer2 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. An adversary attempted to cause a blackout in Ukraine in April 2022 by using the Industroyer2 malware against a regional Ukrainian energy provider. The adversary targeted eight high-voltage electrical substations and utilized the malware in tandem with disk wipers for Windows, Linux, and Solaris operating systems in an attempt to make response and recovery efforts more difficult. The adversary reused a piece of the original Industroyer malware designed to open circuit breakers and de-energize target substations. The adversary gained initial access to the victim’s enterprise network through unknown means in February 2022 and was able to perform reconnaissance, pivot to the operations network, and reside in the system for at least 51 days. This gave the adversary a detailed understanding of the environment and allowed them to customize the Industroyer2 malware to the victim’s operations network. However, defenders detected and stopped the attack before the adversary could achieve their intended impact. Had the Industroyer2 attack been successful, it could have caused a blackout for more than two million people during the early stages of Russia’s invasion of Ukraine. Researchers and analysts identified 22 unique techniques (used in a sequence of 31 steps) utilized during the attack with a total of 297 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-three of the identified techniques used during the Industroyer2 cyber attack were precursors to the triggering event. Analysis identified 224 observables associated with these precursor techniques, 122 of which were assessed to have an increased likelihood of being perceived in the 51 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016

The Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016 Precursor Analysis Report leverages publicly available information about the December 2016 cyber attack against the Ukrainian Ukrenergo electric transmission utility and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. Industroyer is a modular malware framework designed to deploy several Industrial Control System (ICS) protocol-specific attack payloads to disrupt electricity distribution. Adversaries deployed Industroyer within the target network on a Microsoft Windows endpoint capable of directly manipulating or communicating with ICS. Industroyer abuses the functionality of a targeted ICS’s legitimate control system to achieve its intended impact. Adversaries likely first gained access to Ukrenergo enterprise networks in early 2016 after a successful spearphishing campaign against organizations in the electric power sector. Adversaries then began capturing credentials beginning on 1 December 2016. This allowed access to the ICS environment at the Pivnichna electric transmission substation outside Kyiv through a device dual-homed on the Information Technology (IT) and ICS networks. Adversaries conducted discovery, targeting, and access to this device using information and previously captured credentials from compromised enterprise IT machines. Finally, the adversaries deployed and launched the Industroyer malware just before midnight on 17 December. By midnight, Ukrenergo had lost control of a targeted substation, resulting in electric power outages for over an hour in the city of Kyiv and the Kyiv region. Researchers and analysts identified 31 unique techniques (used in a sequence of 33 steps) utilized during the attack with a total of 846 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-nine of the identified techniques used during the Industroyer cyber attack were precursors to the triggering event. Analysis identified 548 observables associated with these precursor techniques, 353 of which were assessed to have an increased likelihood of being perceived in the 300 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: JBS Foods Ransomware Attack 2021

The JBS Foods 2021 Ransomware Attack Precursor Analysis Report leverages publicly available information about the JBS ransomware cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In late May 2021, one of the world’s largest meat producers, JBS Foods, announced they had fallen victim to a worldwide ransomware attack, later found to be REvil ransomware. In the United States alone, JBS Foods accounts for nearly 25% of beef and roughly 20% of pork production. Adversaries initially launched a Distributed Denial of Service (DDoS) attack on the company’s Information Technology (IT) networks in Australia, but the attack impacted operations in Brazil, Canada, and the United States, as well. The attack caused plant operations in all four countries to shut down for at least one day. All nine of the U.S. meatpacking plants temporarily shut down because of the attack. The adversaries initially demanded a $\$$22 million ransom for the company’s data, but later negotiated the ransom down to $\$$11 million even after JBS Foods restored most of their systems. JBS Foods eventually paid the $\$$11 Million for reassurance from the adversaries that none of their customers’ data would be compromised in the future. Despite its short duration, the attack still caused large stocks of meat to spoil. The incident also underscored how adversaries can simultaneously compromise and move laterally through global subsidiaries of an organization. Researchers and analysts identified 22 unique techniques (in a sequence of 21 steps) utilized during the attack with a total of 361 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Sixteen of the identified techniques used during the JBS Foods cyber attack were precursors to the triggering event. Analysis identified 308 observables associated with these precursor techniques, 163 of which were assessed to have an increased likelihood of being perceived in the 75 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003

The SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003 Precursor Analysis Report leverages publicly available information about Davis-Besse’s 2003 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 25 January 2003, the SQL Slammer worm infected more than 90% of vulnerable hosts and crashed the internet in 10 to 15 minutes, making it one of the fastest spreading worms in history. SQL Slammer is a fileless, memory-resident worm that remotely exploits a stack-based buffer overflow vulnerability on local hosts to intensively scan and rapidly self-propagate across the internet. The worm infected approximately 300,000 unpatched hosts running Microsoft Structured Query Language (SQL) Server 2000 or Microsoft Desktop Engine (MSDE) 2000 with SQL Server Resolution Service. The SQL Slammer worm indirectly infected FirstEnergy’s Davis-Besse nuclear power plant by first infecting a consultant’s company network server and then propagating through an external misconfigured connection into Davis-Besse’s site network. The infection caused major network congestion, slow performance, data overloads, and the inability of local hosts to communicate with each other, which eventually caused a loss of availability and a loss of view when the Safety Parameter Display System (SPDS) and Plant Process Computer (PPC) crashed. At the time of the infection, the plant was already offline, the digital monitoring systems had redundant analog backups, and the plant control and safety functions were not affected, so there were no concerns of a safety breach. However, this incident resulted in many lessons learned and spawned important discussions about cybersecurity’s role in nuclear safety and electric power reliability regulation, policy, and guidance. Researchers and analysts identified 10 unique techniques utilized during the attack with a total of 640 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Eight of the identified techniques used during Davis-Besse cyber attack were precursors to the triggering event. Analysis identified 596 observables associated with these precursor techniques, 428 of which were assessed to have an increased likelihood of being perceived in the 331 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Survey of Surveys: I. The largest compilation of radial velocities for the Galaxy

In the present-day panorama of large spectroscopic surveys, the amount, diversity, and complexity of the available data continuously increase. The overarching goal of studying the formation and evolution of our Galaxy is hampered by the heterogeneity of instruments, selection functions, analysis methods, and measured quantities. Here, we present a comprehensive catalogue, the Survey of Surveys (SoS), built by homogeneously merging the radial velocity (RV) determinations of the largest ground-based spectroscopic surveys to date, such as APOGEE, GALAH, Gaia-ESO, RAVE, and LAMOST, using Gaia as a reference. This pilot study serves to prove the concept and to test the methodology that we plan to apply in the future to the stellar parameters and abundance ratios as well. We have devised a multi-staged procedure that includes: (i) the cross match between Gaia and the spectroscopic surveys using the official Gaia cross-match algorithm, (ii) the normalisation of uncertainties using repeated measurements or the three-cornered hat method, (iii) the cross calibration of the RVs as a function of the main parameters on which depend (magnitude, effective temperature, surface gravity, metallicity, and signal-to-noise ratio) to remove trends and zero point offsets, and (iv) the comparison with external high-resolution samples, such as the Gaia RV standards and the Geneva-Copenhagen survey, to validate the homogenisation procedure and to calibrate the RV zero-point of the SoS catalogue. We provide the largest homogenised RV catalogue to date, containing almost 11 million stars, of which about half come exclusively from Gaia and half in combination with the ground-based surveys. We estimate the accuracy of the RV zero-point to be about 0.16–0.31 km s –1 and the RV precision to be in the range 0.05–1.50 km s –1 depending on the type of star and on its survey provenance. We validate the SoS RVs with open clusters from a high resolution homogeneous samples and provide the systemic velocity of 55 individual open clusters. Additionally, we provide median RVs for 532 clusters recently discovered by Gaia data. The SoS is publicly available and ready to be applied to various research projects, such as the study of star clusters, Galactic archaeology, stellar streams, or the characterisation of planet-hosting stars, to name a few. We also plan to include survey updates and more data sources in future versions of the SoS.

79 ASTRONOMY AND ASTROPHYSICS↗
DOE OSTI2022

Precursor Analysis Report: Cyber Attack on Thyssenkrupp Blast Furnace 2014

The Cyber Attack on Thyssenkrupp Blast Furnace 2014 Precursor Analysis Report leverages publicly available information about the Thyssenkrupp Steel Mill cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In December 2014, the German Government’s Federal Office for Information Security (BSI) released a report detailing a cyber attack on a German steel mill that occurred earlier that year, though exact dates and details of the attack were not revealed. While the report did not specify the name of the company, multiple sources identified the victim as one of Europe’s largest steel manufacturers, Thyssenkrupp AG. Further, Thyssenkrupp announced on 16 May of that year that Europe’s largest blast furnace, “Schwelgern 2,” located at its facility in Duisburg, Germany, would be offline for several weeks for repairs and upgrades, suggesting Schwelgern 2 was likely the target of the attack. The attack began in early 2014, when adversaries infiltrated the victim steel mill’s Information Technology (IT) network via a spearphishing campaign, then worked their way into the Operational Technology (OT) environment, where they executed software that caused denial of service, denial of control, and eventually a loss of control. This led to the blast furnace shutting down without proper safety procedures, resulting in catastrophic physical damage. No lives were lost in the incident, but ThyssenKrupp suffered $4 million in damage to the blast furnace and an additional $6 million in lost revenue. The adversaries required specialized knowledge and expertise in steel production, which enabled them to compromise a variety of internal systems and components across both IT and OT networks. The attack also demonstrated detailed knowledge of the industrial control systems (ICS) and production processes being used. This combination resulted in one of the earliest known publicly reported cybersecurity incidents resulting in physical damage to ICS equipment. Researchers and analysts identified 19 unique techniques (used in a sequence of 20 steps) utilized during the attack with a total of 454 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fifteen of the identified techniques used during the Thyssenkrupp cyber attack were precursors to the triggering event. Analysis identified 369 observables associated with these precursor techniques, 316 of which were assessed to have an increased likelihood of being perceived in the 120 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
NASA NTRS1996

Grant Proposal for the Continuation of the Voyager Interstellar Mission: LECP Investigation

This proposal documents the plans of the Low Energy Charged Particle (LECP) investigation team for participation in NASA's Voyager Interstellar Mission (VIM) as the Voyager 1 and 2 spacecraft explore the outer reaches of the heliosphere and search for the termination shock and the heliopause. The proposal covers the four year period from 1 January 1997 to 31 December 2000. The LECP instruments on Voyager 1 and 2 measure in situ intensities of charged particles with energies from about 30 keV to 100 MeV for ions, and about 20 keV to greater than 10 MeV for electrons. The instruments provide detailed spectral, angular, and compositional information about the particles. Composition is available for greater than 200 keV/nuc using multi-parameter measurements. Angular information is obtained by a mechanically scanned platform that rotates at various commanded rates. Measurements of low energy ion and electron intensities versus time and spatial location within the heliosphere contain an abundance of information regarding various transport and acceleration processes on both local (approx. 1 hr, approx. 0.01 AU) and global (approx. 11 yrs, approx. 100 AU) scales. The LECP instruments provide unique observations of such dynamical processes, and we anticipate that it will return critical information regarding the boundaries of the heliosphere. Several recent and exciting discoveries based on LECP measurements emphasize the important role that low energy charged particle distributions play in physical processes in the interplanetary medium. Yet, at the same time, these discoveries also underscore the fact that our understanding of processes in the outer heliosphere is, in most cases, incomplete, and in others, only rudimentary at best. Among the discoveries referred to above are the following: (1) Shocks: Examination of greater than 30 keV ion intensities have revealed: (a) a total absence of acceleration beyond only -100-200 keV at a strong transient shock in May 1991 at 35 AU, despite an enhanced level of seed particles; (b) a large transient shock in September 1991 of global scale, with intensities of shock-accelerated ions greater than or equal to 30 keV to approx. 30 MeV showing complex, highly energy-dependent spatial evolution, and small-scale (approx. few gyroradii), often anisotropic, micro-structures; (c) recurrent intensity increases in greater than or equal to 30 keV to -few MeV ions, with structures that, in some cases, show no correlation with the associated corotating shock. (2) Superthermal ion pressure: A global merged interaction region with a leading shock, downstream of which the superthermal ion (greater than or equal to 30 keV to approx. 4 MeV) pressure is comparable to that of the thermal plasma, and the total particle pressure yields a plasma beta of order unity. (3) Pickup ions: Measurements of the C/O ratio within transient structures at 35-45 AU showing the first clear evidence that transient shocks can pre-accelerate interstellar pickup ions from approx. 1 keV/nuc to at least 1 MeV/nuc. (4) Seed particles: Injection of ions for acceleration to high energies at the termination shock is unlikely to be a problem, since interplanetary transient and recurrent shocks are continually accelerating ions, of solar wind or interstellar origin, to highly superthermal energies. (5) Precursor electrons: Ambient solar electrons (greater than or equal to few tens of keV) that exist in the outer heliosphere ca form a broad precursor, several days wide, that is upstream of the termination shock and potentially observable a few months prior to the shock crossing. (6) Solar wind velocity at Voyager 1: We can use LECP ion data to obtain the solar wind velocity at Voyager 1, enabling us to provide critical measurement of the plasma flow as we approach and encounter the termination shock and other regions (necessary due to the partial failure of the Voyager 1 PLS experiment). The work of the LECP investigator team during the VIM will include: (1) Continuing operations with regard to the receipt, processing, verification, cataloging, display, and distribution of the data from the LECP instruments on Voyager 1 and 2, (2) Monitoring the health and performance of the LECP instruments, and evaluating and characterizing the response of the LECP instruments to various energetic particle and plasma environments, (3) Participating in, and supporting Voyager Project planning exercises and other coordinated activities relevant to exploration of the outer heliosphere, (4) Developing analysis techniques and operational procedures suitable for searching for and characterizing the boundaries and unique regions of the outher heliosphere, (5) Continuing the preparation of data sets appropriate for submission to the National Space Sciences Data Center (NSSDC) and, where appropriate, the Planetary Data System (PDS), (6) Maintaining direct Web access to online LECP data through the JHU/APL Voyager LECP home page, (7) Performing scientific evaluations of the Voyager 1 and 2 LECP data sets in conjunction with other data sets and other investigators, with particular focus on the outer regions of the heliosphere, and (8) Publishing the results of these evaluations in the scientific literature and presenting the results in scientific conferences.

Krimigis, Stamatios M.↗
NASA NTRS2007

Large Solar-Rejection Filter

NASA utilized Image Intensified Video Cameras for ATV data acquisition from a jet flying at 12.8 km. Afterwards the video was digitized and then analyzed with a modified commercial software package, Image Systems Trackeye. Astrometric results were limited by saturation, plate scale, and imposed linear plate solution based on field reference stars. Time-dependent fragment angular trajectories, velocities, accelerations, and luminosities were derived in each video segment. It was evident that individual fragments behave differently. Photometric accuracy was insufficient to confidently assess correlations between luminosity and fragment spatial behavior (velocity, deceleration). Use of high resolution digital video cameras in future should remedy this shortcoming. A scenically accurate description of matter interpreted as a substance made up of corpuscular constituents was established during the course of the 19th century. In this description, atoms--the building blocks of the matter--form molecules. The properties of the molecules were described by chemistry or thermodynamics depending on what characteristics of the matter were investigated. In both theories, the molecules can dissociate to atoms when the kinetic energies of the atoms exceed the strength of the chemical bonds. The number of atoms is always preserved in a closed system. This is not true, however, when the matter takes up much higher energies at relativistic scales. New particles can be produced at the expense of the kinetic energy. The number of particles is no longer preserved. There are other conserved quantities, however, these quantities, the charge, baryon number, lepton number, are associated with particles that are considered elementary today. The properties and behavior of these elementary particles is the subject of Particle Physics or High Energy Physics. Practice Page: A crewmember touching a positively charged surface was thought to be galvanically isolated from the vehicle ground analogous to a bird on a high voltage power wire. Recent analysis confirms that positive floating potentials, ionospheric currents to the EVA suit, can be hazardous. The analysis is wrong in that the ionospheric plasma itself can close the circuit. Parametric analysis of very low voltage exposures (2 to 15 volts) could cause pain and/or involuntary muscle tetani or spinal cord shock. NASA worked with the Naval Health Research Center Detachment Directed Energy Bioeffects Laboratory to examine the affects electrical hazards could have on extravehicular activity using two models. The results of the two computational models were combined to predict areas of the body in which neurons of different diameters would be excited. They predicted that physiologically active current could be conducted across the crew member causing catastrophic hazards. Future work to analyze additional current paths was proposed. The FUSE spectrum of BB Dor, observed in a high state, is modeled with an accretion disk with a very low inclination (possibly lower than 10 degrees). Assuming an average WD mass of 0.8 solar mass leads to a distance of the order of approximately 650pc, consistent with the extremely low galactic reddening in its direction, and a mass accretion rate of 10 (exp -9) solar mass a year. The spectrum presents some broad and deep silicon and sulfur absorption lines, indicating that these elements are over-abundant: silicon is 3 times solar, and sulfur is 20 times solar. The FUSE spectrum of BB Dor, observed in a high state, is modeled with an accretion disk with a very low inclination (possibly lower than 10 degrees). Assuming an average WD mass of 0.8 solar mass leads to a distance of the order of approximately 650pc, consistent with the extremely low galactic reddening in its direction, and a mass accretion rate of 10 (exp -9) solar mass a year. The spectrum presents some broad and deep silicon and sulfur absorption lines, indicating that these elements are over-abundant: silicon is times solar, and sulfur is 20 times solar. From its previously observed optical emission lines, P831-57 (WD 0334 6400 or Ret 1 in A Catalog and Atlas of Cataclysmic Variables: Living Edition) has been suspected to contain an accretion disk associated with a companion star in orbit around a subdwarf star with a temperature T is greater than 21,000K. P831-57 has therefore been classified as a nova-like. However, our present observations show it to be a DA + dMe binary. The analysis of its Far Ultraviolet Spectroscopic Explorer (FUSE) spectrum (continuum and lines) reveal an average mass white dwarf (Log(g) approximately equals 7.8 plus or minus 0.1)with a temperature T approximately equals 37,000 plus or minus 500K, an extremely low projected rotational velocity, and a distance of about 115 plus or minus 5pc. The photosphere contains C, N, Si, and S (at about 1% of solar abundances). The dMe star is seen as a flux excess in near-infrared photometry and appears to show occasional flaring of about one magnitude as seen in the Harvard plates. There is no evidence of periodic variability in the spectroscopic or photometric data. We find no evidence of a an accretion disk, instead we find evidence of wind accretion as the stellar carbon abundance (N(C)/N(H) = 2.5 x 10 (exp -6) is about ten times larger than predicted by radiative levitation for such a gravity and temperature. The power needs and solutions for the space exploration and lunar mobility program are discussed. Long term missions in space and on the lunar surface require high energy batteries. Rechargeable batteries for mobility systems and portable utility pallet are needed for successful exploration missions. Nanomaterial usage increases the energy density of the cells apart from increasing the power density. The symptoms and threats from acute mountain sickness (AMS) are discussed. The underlying assumptions concerning spacecraft atmosphere mean there is a potential risk to astronauts. The baseline worst case scenario is about 25% based on direct ascent to 8.0 psia with 32% O2. The practical mitigation approach is a staged depressurization scheme. Due to the uncertainty about potential AMS risk the flight surgeon should prepare, focused research should proceed, and current analytical efforts should continue. This slide presentation reviews the threat astronauts face from acute mountain sickness (AMS). The incidence of AMS is highly variable and the risk to astronauts is unclear. However, the potential risk is higher than current EAAs suggest and precautions should be implemented. Due to the uncertain nature of the risk flight surgeons should prepare, and focused research should proceed. Quasiparticle tunneling can be understood at low temperatures using a non-equilibrium kinetic theory. Low-temperature tunneling can be suppressed using existing techniques: island-lead gap engineering, lead cooling with SIN junctions, and quasiparticle traps. The slide presentation reviews the science goals and mission planning for the proposed Jupiter System Observer (JSO). The spacecraft would accommodate 9 instruments making the instrument payload more capable than any previously flown to Jupiter. The would-be mission includes study programs for Jupiter's satellites, interior, magnetosphere and atmosphere. The power needs and solutions for the space exploration and lunar mobility program are discussed. Long term missions in space and on the lunar surface require high energy batteries. Rechargeable batteries for mobility systems and portable utility pallet are needed for successful exploration missions. Nanomaterial usage increases the energy density of the cells apart from increasing the power density. This slide presentation reviews the power requirements for the space exploration and the lunar surface mobility programs. It includes information about the specifications for high energy batteries and the power requirements for lunar rovers,

Roberts, William↗