Satellite Views Of The Blackout

An anonymous reader writes "These Before and After satellite views of the blackout, from the NOAA, show the geographic extent and intensity of the outage. Toronto, Ottawa, and Detroit seem the worst hit. Currently, a cnn article mentions that a reverse of power flow around Lake Erie may have caused an overload that triggered the programmed shutdown of the power grid. Would be interesting to know how the system and software works, but then again, that information could be dangerous in the wrong hands."

Comments

Dangerous in the wrong hands?

[bc90021]

If a private citizen were to show the interconnections of the power grid on their website, what would happen? How long would it be before the government ordered him/her to remove that information in the interest of "National Security"? Why is it that CNN can show it freely? A similar map was being broadcast on TV all morning.

And as for how the software works, it would be interesting to know just what OS the power company computers were running. Not to sound like a conspiracy theorist (well, ok, that's exactly what I'm trying to sound like ;) ) as soon as there were variants on the Blaster worm, a large section of the power went out? Hhhmmm...

Re:Dangerous in the wrong hands?

[Anonymous Coward]

If a map with so little detail can be used to bring down the power grid, we've got bigger problems. There isn't even a scale on that map.

Re:Dangerous in the wrong hands?

[Anonymous Coward]

Come on. 'Sensitive' information can be found in any street map you buy from the corner store. Did you know, for example, that JFK airport is in New York City? Keeping power plants secure, and airports for that matter, doesn't rely on keeping them hidden. It means using more than a chain link fence and a rent-a-cop to keep people out. If you think you'll be able to keep terrorist from finding power plants you're crazy. You can see them from the highway!

Re:Dangerous in the wrong hands?

[weave]

Some people on bugtraq are already speculating that the blaster worm may have had something to do with it...

• a post
• another post
• Info on SCADA

Got me if it's true. I'm not up on that stuff. Made for some interesting reading though! :)

Re:Dangerous in the wrong hands?

[RobotRunAmok]

Some people on bugtraq are already speculating that the blaster worm may have had something to do with it...

Dude, people everywhere are speculating that their own personal boogeyman is responsible. Here in New York, Mets fans are blaming Yankee fans, Brooklyn is blaming Manhattan, and everyone is kinda suspicious of Jersey...

Too bad X-Files has been cancelled, eh?

Re:Dangerous in the wrong hands?

[Lars T.]

Article in German, Google Translation.

With our searches we are encountered the following connections: The failed Niagara power station belongs too national to Grid the USA . This power supplier is specified as a reference customer of Northern Dynamics. This company calls itself as "Home OF the OPC Experts" and offers a set of products, which use OPC for communication with control and control systems.

OPC stands for Process control "for" OLE for and touches down on Microsofts COM/DCOM model. That is however exactly the technology with the safety hole, which the worm W32.Blaster uses. In a net, in which this worm is active, malfunctioned due to the regular restarts, which observe now final users also concerned with their PCS, DCOM communication and concomitantly OPC on ungepatchten systems.

Story refused yesterday.

Re:Dangerous in the wrong hands?

[thatguywhoiam]

Dude, people everywhere are speculating that their own personal boogeyman is responsible. Here in New York, Mets fans are blaming Yankee fans, Brooklyn is blaming Manhattan, and everyone is kinda suspicious of Jersey...

... and the US has Canada. :)

"Those damn topless legally-married lesbian pot-smoking hippies! Shut 'em down!!!!

(a proud Canuck)

Re:Dangerous in the wrong hands?

[1u3hr]

Come on. 'Sensitive' information can be found in any street map you buy from the corner store.

IN SOVIET RUSSIA they used to "hide" whole cites such as the "Atomic City" full of nuclear bomb workers; they weren't on any maps. Of course, the CIA knew exactly where they were -- by satellites if not otherwise. So who were they keeping it secret from? Their own citizens.

The power grid is composed of enormous power stations, with thousands of workers, the power lines are either huge pylons you can see for miles, or if underground, emblazoned with warning signs. If they tried to hide these, the first thing you'd notice would be a large increase in outages due to lines being cut by backhoes, etc.

As for whether "terrorists" would target the power grid, I don't see it. Not much bang for the buck. How many died in this, the biggest outage in the US for decades? A half-dozen. It'll be forgotten in a few weeks. Blowing stuff up and killing lots of people is much simpler and does a much better job of terrorising the population. Cutting the power off for a few hours just pisses them off. (With apologies to anyone on a heart-lung machine.)

Re:Dangerous in the wrong hands?

[EvanED]

>>As for whether "terrorists" would target the power grid, I don't see it. Not much bang for the buck. How many died in this, the biggest outage in the US for decades? A half-dozen. It'll be forgotten in a few weeks. Blowing stuff up and killing lots of people is much simpler and does a much better job of terrorising the population. Cutting the power off for a few hours just pisses them off. (With apologies to anyone on a heart-lung machine.)

OTOH, cutting off power immediately before an "actual" attack could cripple the response.

Re:Dangerous in the wrong hands?

[TimTheFoolMan]

This is almost funny, were it not something that has affected so many people in a serious way. My group works with OPC systems every day (doing integration work between various BAS systems and 3rd party products), and one of my biggest concerns with OPC is when we're forced to deploy it via DCOM.

By definition, OPC uses COM for local (within the same PC) client/server interaction, and DCOM for client/server interaction across a network. The setup, connect, and disconnect issues surrounding DCOM have spawned an industry within the OPC industry for working around these issues.

For example, some OPC servers require "remote registry browsing." This means exactly what it sounds like. My computer browses the registry of your computer so I can find out what OPC servers you have installed. In one of its better moves, Microsoft told the OPC foundation that future versions of Windows would restrict remote registry browsing, so they've come up with various solutions. However, some older servers still require this for server browsing, and some companies (ahem) are perfectly OK with it!

Last week, I exchanged e-mails with another engineer who suggested that because my group wanted to avoid DCOM security issues, that it must be because we weren't technically savvy enough to do so. I'm on the other side wondering why he's willing to put the customer's system at risk.

Now, back to reality, W32.Blaster attacks a machine using remote procedure calls, and OPC uses RPC to perform client/server data transfer. While setting up a network to facilitate OPC *may* not inherently make it susceptible to W32.Blaster, it may, depending on how Blaster actually works (I don't know enough about it to say one way or the other).

In short, I'm not ready to point the finger at OPC for the blackout, but it wouldn't surprise me to find that many places that implement OPC using DCOM have been hammered by W32.Blaster. The very settings that make it easy to make OPC/DCOM work correctly open their systems up to all sorts of nasty things once a rogue program is running on one of them.

OPC/DCOM (as typically implemented) represents a serious "trust relationship," and most companies don't make process control PCs part of an NT domain. As a result, setting up launch/access/config permissions becomes a tricky and error-prone matter of managing account names and passwords from other PCs. Since managing those becomes a distributed nightmare, many places unwisely don't force those machines to abide by password policy, and (even worse) use simple password & username combos.

This should sound like a recipe for disaster.

Tim

P.S. I sincerely hope that RPC and the W32.Blaster had *nothing* to do with the blackouts, but I doubt that most of the public will ever know. The insiders will most certainly not let out the details if it did.

Re:Dangerous in the wrong hands?

[Blkdeath]

Nor does that map show the "Lake Erie Loop" which is supposedly where the problem started.

I also notice a little place called "Canada" missing from the map.

Re:Dangerous in the wrong hands?

[Dr. Manhattan]

How many died in this, the biggest outage in the US for decades? A half-dozen.

You don't target the plants. You hit the high-voltage transformers. They step down the power from the high-voltage long-distance power lines to the local transmission lines. There's only ~3000 in the whole United States. They're not made domestically and there's an 18 month lead time on manufacture.

You pick a municipality, e.g. New York. You get ~20 men, armed with automatic weapons and explosives. They start ~1am, and go around taking out HVTs. You have four groups; the first two hits each group makes (maybe more) meet no resistance at all, there's no security on these things beyond a padlocked gate.

By the time people realize that a coordinated attack is going on, and get armed guards capable of fighting off automatic weapons placed around the remaining HVTs, at least 30 of them are down. Restoring power takes weeks, possibly a couple of months. Imagine what that'd do to, e.g., Wall Street.

Now, imagine one of those four groups, instead of targeting HVTs, targets water mains instead. You now have a very large region without power or water. That requires a massive support effort, possibly even refugee camps. Picture the economic impact.

Pick two widely separated regions (e.g. New York and, I dunno, Dallas, Texas (they're even more dependent on water and power for survival there than most)) and you halve the damage to each one but more than double the chaos.

The only weird thing is why something like this hasn't happened yet.

Re:Dangerous in the wrong hands?

[martyros]

As for whether "terrorists" would target the power grid, I don't see it. Not much bang for the buck. How many died in this, the biggest outage in the US for decades? A half-dozen. It'll be forgotten in a few weeks.

Hmm, I'd have to disagree. For just the two days that we were out, it's not a big deal... it's actually kind of novel, an adventure. But it sounds like you weren't here:

• You can't cook anything if you have an electric stove. Sure, you can live off peanut butter & jelly, and canned tuna for a few days; but that's going to get old really quick. Lunch meats & cheese spoil. Some people are lucky enough to have charcoal or gas grill, but you can't store it for more than a day or two, and neither can stores.
• It's really tough to buy gasoline. There were only a handful of places with power to run the pumps or the credit card machines, and at some point everyone realized, "Hey, I have only about a 1/4 tank of gas, and this may last more than a day..." and rushed to the gas stations to wait in long lines.
• You can't access your e-mail, the internet, watch TV, listen to the radio (unless you have battery-powered radio, or in your car; but remember, gas is hard to come by, and batteries only last so long). Even if you can listen to the radio, most of the radio stations are out; those that are on are talking about the power outage. Now, I don't really watch that much TV or play many games, so I have many ways of seeking entertainment that don't require electricity; but how many Americans are used to doing that?
• There is no A/C, no fans, no ice, and after a day the water from the tap wasn't potable: it was pretty hot and humid, with no relief. In the winter, because most heating systems have electronic switches, there would be no heat either (though that's easier to deal with: everybody has coats and blankets).
• Think of all the economic havoc that's going to be wreaked. The entire production of the city of Detroit was shut down for at least a day! This is going to reverberate through the stock markets and financial things pretty soon.

Anyway, the point of terrorism isn't to kill people; the point of terrorism is to make large amounts of people live in fear of something, and through this to put pressure on the goverment. Imagine that Al Qaida managed to do this once a month without being caught, each time demanding, "Pull US troops out of the Holy Land of Mecca!" How many months do you think it would be before popular demand to remove troops from Mecca would be deafening?

Ridiculous

[Mattcelt]

that information could be dangerous in the wrong hands

Nearly any information, used incorrectly, maliciously, or by evil people can be devestating. Making information secret in the interest of "security" is a bad move. This is why many people advocate full disclosure, and why most security experts think that "security through obscurity" is a bad idea. Security should come because systems are strong, not because those systems are "secret".

Re:Ridiculous

[dkemist]

using obscurity as the soles means of security is a bad thing. However, using obscurity as another layer of an already hardended system isn't a bad thing, and would in fact be encouraged.

For a quick example, I'm sure the NSA has all sorts of crazy security measures (both physical and virtual) around some of their sensitive systems. Do they publish the specs to the security methods? No, they hide them as much as the secrets they protect. But if the specs were to be revealed, the security itself probably isn't compromised. The obscurity is just another layer on top of any already tight system.

Re:Ridiculous

[Lemmy Caution]

Because there's nothing to do in Dayton after 6 pm?

Re:Ridiculous

[thrillseeker]

Security should come because systems are strong, not because those systems are "secret".

That's a nice trite statement often made by those who don't try to understand a given problem or that a generality doesn't apply to every situation.

A large power distribution system by its nature has mulitple physical, immovable and fragile weak points. Multiple physical things are hard to hide and multiple fragile things are expensive to protect - one can easily encrypt information and if a good encryption system is used then obtaining the encrypted data provides little value to the wicked. It's quite a different matter to secure physical objects - especially nodes that provide interconnection to multiple further vulnerable systems that pass electrical power and can be destroyed with devices as simple as homemade fertilizer bombs. It's also quite a different matter to secure multiple nodes when it requires multiple individualized security efforts - one can write a good encryption algorithm and apply it everywhere at little additional cost - if it takes x-million dollars to secure a switching node then it will take y times x-million dollars to secure y nodes. The nodes in a power distribution system are not the only weak points - the system can be damaged just as effectively by attacking the interconnections - such attacks can be routed around to a degree in a network but sufficient concurrent (and intentional) attacks will cause tremendous overloads to a power distribution system that requires significant time to recover from - how would you propose securing a million of miles of power lines and a million switching stations affordably?

The power network in North America was built with certain threats in mind - weather, overloaded systems, etc. It works quite well the majority of the time. It is an entirely different matter to build a power distribution system that can survive and recover from intentional and planned manmade attacks. Would you want to start paying ten-times your current power bill for such a system - especially one that can be defeated if one tries hard enough?

Obscurity as a security technique is effective when other techniques are very hard and very expensive - but certainly not bulletproof. Security is a cost-benefits analysis and if hiding some critical information about the sensitive spots in a difficult to secure physical system can provide an immediate benefit, then it's stupid to publish such information so that those who wish you harm can more easily commit it.

Re:Ridiculous

[Ed Avis]

The reason why security through obscurity may be appropriate for elecricity grids but not for computer programs is simple: there is only one electricity grid, but a program can have millions of copies, all alike. Find the flaw in one of the copies and you can crack all of them. With the ease of making copies and the possibility to fully inspect them (using a debugger or just reading through the program code), you cannot realistically hope to stop bad guys finding out the flaws. So you just have to fix them.

However it's impossible to take a copy of the electricity grid, and presumably very difficult for a bad guy to examine the whole system at once and search for flaws. Also, physical systems don't suffer from 'security holes' in quite the same way as software: a buffer overflow may compromise the whole application but is easy to fix when found, whereas a power cable connecting two substations might be very expensive to 'fix' and make sabotage-proof by posting armed guards along it or burying it or whatever.

In short, it's another instance of the general rule that is often ignored on Slashdot: software is different from hardware. What makes sense for information doesn't always make sense for physical objects, and vice versa.

wtc reflection index

[digitalsushi]

i dont know how they referred to it precisely; it was something like reflection index. basically, it was all the stuff floating in the air. i'm not saying this is in any way cool, but it is interesting --

http://digitalsushi.com/wtcreflection.gif

Wrong hands?

[saitoh]

And your telling me that publicising a blackout's cause as being one grid station, and then showing how its braught half of the northeast practically to a halt for a day or two isnt information in the wrong hands?

I'm just waiting for some half baked terrorist to whack off a couple of power grids now... Then our excuse of an administration will want to inspect everything about power right down the the electrons because of "national security"... ;-p

On a larger note, I'm surprised that nobody has really taken it seriously that there are other things in America then commercial airplanes that can bring this nation to its knees (like power, water, lack of a starbucks...)

North Korea

[Eric Sharkey]

Somehow, even during the blackout, it doesn't look as bad as North Korea on a normal night.

Re:North Korea

[chenGOD]

or large parts of Africa, or the interior of South America, or even parts of USA (whatever the hell state is next to California).

Oh wait, I get it. North Korea is communist, so they don't have power.

Re:North Korea

[eln]

North Korea is dark because they have major power problems, due mostly to their horrifically inefficient government.

Nevada is dark because most of it is unpopulated. There's a big difference there.

the eric conspiracy

[the eric conspiracy]

Whatever happened to UFO theories? Are we SURE that space aliens didn't cause this? Didn't the movie "The Day the Earth Stood Still" predict this nearly exactly?

Modern technology

[Henry V .009]

I suppose that if we were to redesign the grid today, we would be able to prevent situations like this, or at least keep them local. Anyone know the projected costs for something like that? How comparable is it to the economic cost of losing power like we did this week?

Well, at least some lights stayed on

[Anonymous Coward]

It's a good thing all the green lights marking the state borders stayed on, or there could have been real trouble.

Hey

[Timesprout]

I cant see my house from here !

Foolish Earthlings!

[FrostedWheat]

*viewing from space*

Kodos: Foolish Earthlings! Relying on such a primitive thing as electricity!
Kang & Kodos: HA HA HA HA ... !

*the ships lights go out*

Kodos: You forgot to feed the hamster again didn't you?

That's Right!

[XplosiveX]

New York's governer blamed Canada for the cause of the outage but our Mayor Mel Lastman answered back with, "How many time have you seen the American's take the blame for anything?"

Re:That's Right!

[thatguywhoiam]

Fucking canadians... first they fucking contaminated our meat supply due to their incompetance of dealing with mad cow disease. Then THEIR stupid power system overloads OURS and they blame US for it....We should just turn canada into a nice sheet of glass and be done with it, that would also elminate the terrorists they protect too.

Well as a person with dual citizenship, living in Canada, I feel compelled to give two answers to this.

AmericanGuyWhoIAm:
Dude that single cow came from the US, and it was your fuckin' transformer, so take that back before I ventilate your face. Commie.

CanadianGuyWhoIAm:
Uh huh. Hey buddy I hear you, eh? Take a hit off this, you'll feel better. You from Texas?

You all are lucky...

[Lovebug2000]

Neo just chose to save Trinity instead of rebooting the matr...

NO CARRIER

Re:Not blacked out in New England

[johnstein]

I don't think the 'after' picture is accurate at all. I live in columbus where we were *not* affected by the outage. however, the after picture clearly shows that columbus was 'dark'. We were just fine. Most of our power comes from the Ohio River IIRC. Sure, the picture is 'neat' to see parts of NY state and other areas under darkness via satellite, but I am treating it more as an 'artist's rendering', not a legitimate photo. I would expect more from NOAA.

Anyone else notice the same thing?

-John

power distribution

[abhisarda]

Read the reports in various newspapers, you will have come across many articles saying how antiquated the power transmission system has become.

Power companies have specifically stated that putting in new power grids is very problematic because people don't want this anywhere near their property.
This view is exactly like those bastards at Cape Cod. They scream themselves hoarse that they are enviornmentalists and then fscking say no to wind mills 6 miles off the shore.

Same thing with this power grid. Companies that want to lay new power grids cannot go foward and lay lines because the residents will not waste anytime taking them to court. "We don't want it in our backyard".
Well, somebody has to pickup the cost.

Also, Canada has an excess of power generation capacity. If the US had better lines, it could have taken up the excess power Canada generates.

[ "The strain on transmission capacity is particularly acute in New York State, which is known in the industry for having far too few high-voltage power lines",

"community resistance to new lines has been high and continues to prevent new lines from being built, particularly in high-density areas like the northeast. While the federal government can step in and insist on construction of natural gas pipelines, it has no such power related to electrical transmission lines. "People want more power, but they don't want those lines"".

"Most of New York City's and Long Island's power at peak times must be generated in the city and on the Island, because it is physically impossible to transmit that much power into the area along the existing lines." ]

This has been historically proven

[Wierd Willy]

Nearly any information, used incorrectly, maliciously, or by evil people can be devestating. Making information secret in the interest of "security" is a bad move. This is why many people advocate full disclosure, and why most security experts think that "security through obscurity" is a bad idea. Security should come because systems are strong, not because those systems are "secret".

When Westinghouse took over the Hanford WA Nuclear facilities in the mid 70's, there were HUGE problems that are as yet UNSOLVED because of "secrecy". There are scores of gigantic thin shell steel tanks full of god knows what, that are known to be full of extremely radioactive fluids and metals, and nobody knows where the hell they are. They were buried back in the 40's, 50's and 60's, and are known to be leaking. And because of this the problem will never be solved untill we get a Chernobyl like event and by then of course, it will be too late. "Secrecy" in the name of some imaginary threat is more dangerous than the threat itself.

The Government refuses to harden systems such as the national power grids and Freeways, bridges and Refineries/Chemical plants etc because its CHEAPER. Better to let things be, keep the vulnerabilities secret and hope for nothing to happen then actually fix the problems. This is universal to almost everything sensitive and dangerous our government and other governments do. 9/11/01 proved this, because the threat of an airliner being used as a weapon was KNOWN, but was kept out of the public eye for reasons of "national security". Any fanatic with really deep concentration on acts of violence and destruction can think of ways to get around secrecy on the part of an enemy. Everything is a weapon, everything. And as long as there are "secrets", there will be vulneralbilities.

Re:Not blacked out in New England

[the Man in Black]

The image states that it's "~7 hours after blackout" which puts it right around 11pm EDT or thereabouts. Even if Columbus wasn't DARK I'm sure it was darkER.

Dangerous in the "right" hands?

[jc42]

Would be interesting to know how the system and software works, but then again, that information could be dangerous in the wrong hands."

Well, maybe, but if it can be kept secret by the authorities, they'll just "explain" it with reassuring PR, while not bothering to do any real fixes to the problems.

A lot of us have had far too much experience with big organizations to believe that secrecy will lead to solving the problems. The right way to prevent such things is to make the entire system public information. Then independent engineers can study it, point out the weakness, and suggest solutions, without worrying about losing their jobs if they go public with the bug reports.

(Hmmm ... This sounds a lot like the explanations of why Open Source software is so much more secure and reliable than proprietary software. ;-)

Re:Not blacked out in New England

[Anonymous Coward]

Have you had a chance to compare this picture with a concurrent cloud map? IIRC, optical imaging has problems seeing through clouds...

The software and technology is from 60's

[Anonymous Coward]

Thankfully. Any decent electrical engineer knows something about hvac grids and tripping them. They are supposed to work exactly how they worked. I suspect that the grid frequency went down below a certain threshold and the grid tripped. This is a very essential feature because all the machinery on the grid and off the grid is designed for 60hz power freq. If it goes any lower, their efficiences wud go down hill and each piece will produce tremendous amounts of heat, which can possibly lead to mass fires/transformer explosions across the grid.
Why this happens is simple - the generators are asked to provide more power can they can ever generate - and they slow down(just like a motor loaded with a mechanical load)- also some generators that are supposed to come on-line but they didnt. Thankfully the grid equipment works by sensing - you know it - the grid, which is good because asshats cant interfere with it without getting soot on their hands. I am glad that cows like the ones that frequent slashdot dont write software for the grids. Its done by more deligient and more perfectionist electrical engineers (I am one - any doubts??).
As far as terrorists are concerned,I wouldnt worry too much about they getting this info (they have it already), because all it takes to know info about a grid is a decent electrical engineer, of which there is no dearth - american or non-amercan.

Re:Not blacked out in New England

[specialized_sworks]

If I interpret the photos correctly, they were taken at 0114Z and 0129Z... only 15 minutes more than exactly 24 hours apart. So I think the relative brightness should be the same.

I would go with extra cloud cover in the second photo as an explanation.

I was funny hearing people talking about lightning strikes near Niagara asa possible cause... There was not a cloud in the area at that time.

-Dubya

Re:Not blacked out in New England

[kpansky]

It may have stopped short of Rhode Island, but apprently it may have actually started in my home town. Check this.

not that hard to find out...

[rm -rf /etc/*]

Most universities have couses on power systems. As a mechanical engineering student, I took several courses on nuclear power plant design and operation. These classes included several tours to working power plants and training sites. This information is not really hard to get.

I can't speak on power plants in general, but I can comment a bit on nuclear plants. Most plants running in the US are quite old, thanks to public perception preventing any new plants from being built. So, most of them run pretty old systems. Most I've seen run on unix variants, mostly HP-UX and AIX. The software used is really just a backup, the plants can operate pretty much without the computer systems. The hardware is pretty much big old mainframes and mini-mainframe type stuff. IBM, Sun, HP, etc.

The primary function of the computer systems it to simplify some operations and to more easily report on conditions. For example you can view the power output of both reactors on one screen at the control center rather than having to walk over to the analog dials to check it out. They also monitor safety systems and can report on the state of different valves and things in the plant, rather than requiring you to go look at all the lights for individual valves.

Most plants are starting to modernize and new software is being developed to allow complete control of the plant. Currently most of the software used is for monitoring only, but it's starting to be deployed for control as well. So, rather than having to walk over and switch a lever to close a vavle, or turn a dial to up reactor power, you can just click. But this isn't really widespread yet.

There is some windows software out there for this stuff, but it's not widely used, at least in the US. Some of the newer advanced control systems are focusing on windows, so it looks like in the future there might be more windows in the plants.

MSBlaster and the Blackout....(securityfocus)

[inKubus]

Read this today:

It is ridiculous to accept that a lightning strike could knock out the grid, or the transmission system is over stressed. There are many redundant fault, limit and Voltage-Surge Protection safeguards and related instrumentation and switchgear installed at the distribution centers and sub stations along the Power Grid
that would have tripped to prevent or otherwise divert such a major outage.

I believe that the outage was caused by the MSblaster, or its mutation, which was besieged upon the respective vulnerability in certain control and monitoring systems (SCADA and otherwise) running MS 2000 or XP, located
different points along the Grid. Some of these systems are accessible via the Internet, while others are accessible by POTS dialup, or private Frame relay and dedicated connectivity.

Being an old PLC automation and control hack let me say that there is a very good plausibility that the recent East Coast power outage was due to an attack by an MBlaster variant on the SCADA system at the power plant master terminal, or more likely at several of the remote terminal units "RTU". SCADA runs under Win2000 / XP and
the telemetry to the RTU is accessible via the Internet.

- From what I recall SCADA based monitoring and control systems were installed at many water / sewer processing, gas and oil processing, and hydro-electric plants.

I also believe that yesterdays flooding of a generator sub- facility in Philadelphia was also due to an MBlaster variant attack on the SCADA or similarly Win 2000 / XP based system.

To make things worst, the Web Interface is MS ActiveX. Now lets see, how can one craft an ActiveX vuln vector into the blaster?

Oh, and for the wardrivers, SCADA can be access via wireless connections on the road... puts a new perspective on sniffing around sewer plants.

It is also reasonable to assume that we could have a similar security threat regarding those system (SCADA and otherwise based on MS 2000 or XP) involved in the control, data acquisition, and maintenance of other critical infrastructure, such as inter/intra state GAS Distribution, Nuclear Plant Monitoring, Water and Sewer
Processing, and city Traffic Control. IMO

I think we will see a lot of finger pointing by government agencies, Utilities, and politicians for the Grid outage, until someone confess to the security dilemma and vulnerabilities in the systems which are involved in running this critical infrastructure.

Regardless of whether the Grid outage can be attributed to the blaster or its variant, this is not entirely a Microsoft problem, as it reeks of poor System Security Engineering practiced by the Utility Companies, and associated equipment and technology suppliers.

Nonetheless, the incident will cause lots of money to be earmarked by the US and Canadian Governments, to be spent in an attempt to solve the problem, or more specfically calm the public.

This incident should be fully investigated, and regulations passed to ensure that the Utility companies and their suppliers develop and implement proper safeguards that will help prevent or at least significantly mitigate the
effects of such a catastrophe.

Conversely, I do not want to see our Government directly involved in yet another "business", which has such a controlling impact over our individual lives.

Resist the culture of fear!

[babbage]

Would be interesting to know how the system and software works, but then again, that information could be dangerous in the wrong hands.

Actually, this is very unlikely. Systems like the American power grid are highly resilient.

Blow up a transformer? So what, there goes a neighborhood.

Blow up a substation? Big deal, so a town or small city is messed up for a little while.

Blow up a power plant? A shame, but other production facilities on the grid can pick up the slack for a while.

Catastrophic power failures are rare, because minor failures are common, expected, planned for, and almost always isolated to a small area. By definition, terrorist groups do not have the resources to do any more than minor damage. In attacking the airline system, "minor" damage can be effective, as September 11 showed, but the power system takes more damage from a little summer thunderstorm than al-Qaeda could ever do -- and for the most part life goes on unaffected.

This is why I find all the bleating on by the newscasters & politicians that "the power outage was not the result of terrorism." Well of course it wasn't, this isn't the sort of attack that a small malicious party can pull off. It just isn't. Power stations go out all the time, but normally nobody ever notices. Indeed, it is very, very hard to deliberately bring down a power system: NATO spent a month bombing the power grid & computer networks in Yugoslavia, but they never managed to do much more than bring a city like Belgrade down for a few hours before power was restored. If NATO couldn't do it, then I doubt terrorists could either.

If you want to bring down a whole grid, the best way to do it is by plain dumb luck (or an overwhelming lack of luck, depending on your point of view :-). It was a random fluke that caused yesterday's outage, just as it was random flukes that brought down the grid in the last two major outages, in 1977 & 1965. On the bright side, that suggests that the mean time between power grid failures may have doubled, and the next event like this may happen in 50 years... :-). (Incidently, the Presidential Report on the 1965 outage makes for fascinating -- and newly relevant -- reading material).

Resist the culture of fear! Most of the fears that the government and media have been pushing on us for the past couple of years are way overblown. The news this week wasn't that the power system is unstable, or that terrorists could have done this. No! The news is that the system is remarkably robust, and that our system is so good that we can go for decades at a time without glitches like this. That's a very good record, when you put things in perspective.

That's quite an improvement

[n9hmg]

Now, if we can just shut off the rest of the outside lights... I'll bet some children saw stars for the first time in their entire lives.

obscurity is NOT security

[gregmckone]

Good point! it would be neat to know how the grid works and to understand the various software and its interactions.

Keeping information like "How the power grid works" and "What vulnerabilities the power grid has" secret is short term thinking at best. All it means is that Joe average can't bring the grid down. Anyone who learns the secrets of the grid (man this is sounding like a B movie) can likely exploit its vulnerabilities. (The power company people I know seem to think it would be trivial for motivated people to pull off this sort of crime). This would be a bad thing (for those of you who have too much time on your hands and no moral conscience).

Better to "OPEN SOURCE" (sorry) the vulnerabilities so they can be addressed. Hey if Canada is wired backwards (I'm Canadian) then that should be fixed. If there are no "Giant circuit breakers at the border (state or national) then maybe there should be. Better for One state to completely black out while the others experience a surge or brownout or whatever than for everything to go down.

It's like our lives. If we hide our character from ourselves or others, our opportunity to have that character refined or improved (or challenged) is very minimal. But if we live our lives openly and honestly, then there is the chance to have good challenges, and improvements.

In the same way we reveal ourselves to others gradually, starting with those who are trusted. It would make sense in this case to reveal this in a graduated way, where initially it would move beyond the power companies (motivation money) to those responsible for maintaining public services / order (motivation serve the public) to those who are not responsible for power, but might have valuable insight (motivation accountability)

FWIW there is my $0.02 ($0.03 CDN)

Greg
http://www.GreenTreeSoftware.ca

Re:Another aspect ..Cell phone services in a black

[AndroidCat]

It's also manditory that dumbasses don't tie all the circuits up by making useless calls to each other. All "Hello. Yeah, I just called to say that I'm on the bus" types calls should be canceled, and if people do have to call all their friends to ask them if they have power, keep the calls short.

Re:Not blacked out in New England

[Guppy06]

" the after picture clearly shows that columbus was 'dark'."

If you look at both pictures, you'll see that Columbus is closer to the edge of the picture in the "dark" photo than in the "light." Which means that during the "dark" picture, the satellite saw Columbus almost eddge-on, reducing the amount of light the camera could see coming from Columbus as well as putting more atmosphere between the two. Columbus got "darker" because of the same reasons the sun gets "darker" near sunset.

Re:Not blacked out in New England

[usotsuki]

Since I live in Niagara Falls, NY, I can vouch for that.

It was a bright, sunny day. I was in Wilson Farms (convenience store) picking up some supplies, and had just paid for it, when the power just died.

Oddly, the power at home was fine.

-uso.

An even more impressive photo

[devphil]

is the one in the Rotten Library entry for North Korea.

Combined image.

[Stephen Samuel]

I've got a composite of the difference that the blackout made areas that were darker during the blackout are in red. Areas that were bright at both times are white.

Dark vs. dim and "the wrong hands"

[badasscat]

As a New Yorker, I can assure you the city was 100% dark on Thursday night. The fact that it looks brighter on the satellite view than Ottawa or even Toronto could be for a number of reasons but is most likely due to nothing more than population density - more cars (and their headlights), more people outside (using flashlights, or other light sources to light up local areas), and more businesses with backup power in a smaller amount of space. Most of the light I see on that image from the NY area is on what I know are the major roadways, particularly the NJ Turnpike. The electricity itself, though, was out to 100% of the city. Ottawa wasn't hit any harder than NYC.

As for info on the power grid getting into "the wrong hands", this isn't some sort of national secret. It's not classified information. Some of the security methods used to protect individual plants or other parts of the power grid are not made public, but anyone who watches The Discovery Channel on a fairly regular basis probably has as good an idea of how the power grid works as would be needed to bring part of it down. The method of the failure this time (3 high power transmission lines failing simultaneously, causing an overload) seems remarkably similar to what happened in 1965. Which in itself is pretty ridiculous - this wasn't supposed to happen again. Any terrorist could plant a few bombs at the base of some of these high tension wire towers and bring the system down if this is all it takes - this is not something that would require declassifying information to figure out.

And I don't agree with those who say this is not a dangerous thing. I was one of the millions of New Yorkers who had to walk home over one of our river crossings on Thursday. Imagine a coordinated attack involving first taking out the power to the northeast, followed by any one of the following:

• An aerosol anthrax attack from the air on the millions of people who had taken to the street.
• One or more intentional crashings of small learjet-sized airplanes (probably the biggest they could get away with now) and/or helicopters into the major bridges as millions of people used them to cross the rivers.
• The smuggling of nuclear and/or radiological devices into major cities as power is off to the newly-installed radiation detectors scattered around inner cities.

Those are just a few examples - I'm sure there are many more that terrorists have already thought of. It is very dangerous for power to be completely out in any major city, let alone the northeast - nobody is able to get any news or announcements (land and cel phones were down on Thursday, and even the news outlets not knocked off the air were relying on those who could get through on phones for information), emergency calls cannot be made, emergency vehicles cannot get through streets choked by pedestrians, police and fire departments cannot communicate with their bases, hospitals have to rely on minimal power from backup generators, etc.

Until we heard definitively that this was not a terrorist act on Thursday, everyone in this city was very nervous - I was surely not the only one who thought it could be a setup for something larger. After all, we've been through this before - both large-scale power outages and large-scale terror attacks. Once we were told that it definitely was not terrorism, that's when the partying started - but until that point, there was what I consider to be a perfectly justified fear in the voice of pretty much everyone I talked to.