Experts Hack Power Grid in Less Than a Day

bednarz writes "Cracking a power company network and gaining access that could shut down the grid is simple, a security expert told an RSA audience, and he has done so in less than a day. Ira Winkler, a penetration-testing consultant, says he and a team of other experts took a day to set up attack tools they needed then launched their attack, which paired social engineering with corrupting browsers on a power company's desktops. By the end of a full day of the attack, they had taken over several machines at the unnamed power company, giving the team the ability to hack into the control network overseeing power production and distribution."

Comments

I hate the term "Social Engineering"

[Anonymous Coward]

What's wrong with the good old fashioned "lying" or "scamming"? Fucking con-artists trying to sound legit.

Re:I hate the term "Social Engineering"

[causality]

What's wrong with the good old fashioned "lying" or "scamming"? Fucking con-artists trying to sound legit. It's "social engineering" if you fell for it.

Re:I hate the term "Social Engineering"

[IBBoard]

"Social Engineering" is using normal behaviour and expectations to get people to do what you want when they're not supposed to, without them noticing.

Lying is telling a falsehood as truth.

Scamming is offering something but never following up, or following up with less than was promised (e.g. bait and switch or fake companies that run off with money).

There's big differences in those definitions.

The most obvious example I know of is social engineering with USB pen drives. A penetration testing company was asked to test corporate security. They did it by leaving a number of USB pen drives around the office. With no lying or scamming, people took the drives, wondered whose it was, plugged it into the computer, and the drive automatically grabbed some data. At the end of the exercise the pen. testers listed the names of people who had connected the drives, even when its origin was unknown. No lying or scamming was involved, but there was a social norm that they exploited as social engineering, which is that people will look to see what is on it to see if they know whose it is. If it had been a virus/trojan then that simple social engineering could have taken down the network, been pumping out spam, or allowed someone access via a back door.

Re:I hate the term "Social Engineering"

[vux984]

The most obvious example I know of is social engineering with USB pen drives. A penetration testing company was asked to test corporate security. They did it by leaving a number of USB pen drives around the office. With no lying or scamming, people took the drives, wondered whose it was, plugged it into the computer, and the drive automatically grabbed some data.

That is probably the ONLY example I've seen that DOESN'T involve lying or scamming. Usually 'social engineering' refers to calling in to the receptionist, posing as the IT helpdesk, or something else, and then have them tell you their passwords...or type 'arcane things into a command line'...or run the attachment in an email you send them...and they do it without a 2nd thought. And that, would be a clear case of 'lying' or even 'scamming'.

Phishing sites, email spam from 'John' that says "Check out our Vacation Photos", etc also fall under the wide umbrella of 'social engineering'.

Re:I hate the term "Social Engineering"

[IBBoard]

It's the only well known one I can think of, but "check out our vacation photos" is more social engineering than scamming. You're not exactly lying (you can argue you are because you're not actually giving them the photos, or they're not really John, but that's not necessarily the case - they could put the photos up anyway to make it look more legit) and you're not scamming by offering something of value and taking something away from the victim, you're relying on 'normal' human behaviour to go "I don't know who this is, but I'll check out the link anyway in case I can tell from the photos".

Similarly, wearing a fluorescent jacket and working on an exchange box or other equipment isn't lying or scamming anyone, but through social engineering and societal training you'll get away with what you're doing because people go "oh, he's a contractor, he must be doing some contract work".

Ditto for walking in to buildings - we've got guards at the main gates, but once you're in then you can get in to a lot of buildings without question just by looking like you belong and having something pass-like hung around your neck. You're using people's social expectations of "he is on site, has a pass and knows what he is doing so must be allowed here" to get you in to places where your swipe card won't work.

Re:I hate the term "Social Engineering"

[Daimanta]

Lying is telling a falsehood as truth.

I am not entirely convinced of that. Some people see lying as telling a falsehood as truth. But others see lying as intentionally try to lie to a person even when telling the truth. It's all about intention. If you accidentally misinform someone, are you lying or are you simply mistaken?

Re:I hate the term "Social Engineering"

[somersault]

If it's an accident then it's a mistake. If it's purposely tring to make someone believe, or knowingly let someone believe something you know to be a lie, then it's deceit.

Re:I hate the term "Social Engineering"

[vux984]

"You're not exactly lying (you can argue you are because you're not actually giving them the photos, or they're not really John, but that's not necessarily the case - they could put the photos up anyway to make it look more legit).

Lying by omission is when an important fact is omitted, deliberately leaving another person with a misconception. This includes failures to correct pre-existing misconceptions. One may by careful speaking contrive to give correct but only partial answers to questions.

Even my 4 year old has no difficulty understanding that weaseling like this is a form of lying. :)

I agree you can engage in social engineering without lying, but its an important and ubiquitous tool of the trade.

As for your uniformed workers, while they don't by definition have to communicate with anyone, odds are they will. And odds are they'll at the very least have a prepared lie to go along with their outfit. Whether or not they use it. Hell, even the guys that went around leaving usb drives probably had a cover story in case someone had confronted them. "I'm just returning it." or "Its got some marketing materials for the new yadda yadda..." or whatever.

Re:I hate the term "Social Engineering"

[famebait]

What's wrong with the good old fashioned "lying" or "scamming"?

The problem with them is that they do not denote the subject at hand with the precision required in a serious discussion of security.

Sure, lying and scamming may tools of social engineering, but there are social engineering attacks that do not use those, and there are plenty of lies and scams that do not qualify as social engineering.
I.e. there is an overlap but not congruence. Draw your own Venn diagram if you have to.

They are simply different concepts. Get over it.

Re:I hate the term "Social Engineering"

[IBBoard]

Still, lying or omissions are just an (optional) part of a social engineering "attack", so social engineering cannot be covered by just "scamming" and "lying" - it's a more complex act of sociology and human behaviour.

Besides, are you actually lying when you only tell truths and never say a false word? It is deceit by omission because you're giving a wrong impression by missing out information, but is that lying or is it just deceit as no untruth has been spoken?

Re:I hate the term "Social Engineering"

[famebait]

Moral: make sure your computers are set up so connecting anything to a USB port cannot by itself initiate running anything.

Re:I hate the term "Social Engineering"

[Anonymous Coward]

Social engineering IS used by bad guiys, but not everyone who uses it is a bad guy. These sorts of security professionals ARE legitamate, and though they lie to front-line workers, they have (and MUST have) agreements with managment to do it. Otherwise, they're legally liable and can be sued. Part of this agreement, I'm sure, involves "first, do no harm." That's what makes these guys bettert than phishers and hackers.

In order to immunize you from certain diseases a doctor injects you with a vaccine, which is pretty much the same thing but unable to do real harm. once your body knows what the threat is, it can react appropriately when it encounters the actual thing.

Re:I hate the term "Social Engineering"

[Anonymous Coward]

What a load of poop. If the attacker already had physical access to the office, why go through all that usb drive nonsense. They could just have walked out with computers, install keyloggers, sniffers, etc. then remove those later.

Sure, just pay me and tell me to pentest some place and give me physical access too..? Would be faster if you just gave me the money.

  If there was no physical security in place (id cards, revolving electronic doors for 1 person at a time=no tailgating, locked doors, etc) why pentest in the first place?

Re:I hate the term "Social Engineering"

[g0bshiTe]

I can vouch for this one. I used to do contract work at a military hospital, Portsmouth Naval not that it matters. The work I did was washing windows, still had to have a hard hat. I went through areas of the hospital that I probably shouldn't have, as a shortcut to get to somewhere I needed to be. Radiology, even went through an empty surgery once. Because I was wearing a hard hat, no one ever questioned or asked me to leave or even show ID, or even asked so much as what company I was with. This was all pre 9/11 though so one would hope things are not this lax now.

Re:I hate the term "Social Engineering"

[s_p_oneil]

I think you're right, but I don't feel you explained it well. In addition, if you're going to correct posts like that, you should at least comment on whether you agree with them or not.

A con is one type of social engineering, just as a scam is one type of con, which means a scam is one type of social engineering. You can not say the reverse is true in either case because there are many types of social engineering, and not all of them are cons. There are also many types of cons, and not all of them are scams.

However, I think the post you replied to was correct in implying that this kind of social engineering was a con, and that the article should go ahead and call it that. It is better for articles to be specific than to be vague, and in this case they are being vague on purpose to make it sound more socially acceptable. That would be another form of social engineering that could also be called: lying, embellishing, marketing, etc. (Take your pick, or feel free to add your own terms for it.)

Re:I hate the term "Social Engineering"

[aproposofwhat]

That's 'scamming', not spamming, dufus!

Re:I hate the term "Social Engineering"

[DavidTC]

Because, dumbass, it's easy to have walk-in escorted access to most offices on some pretense or another. But they tend to stop you if they see you carrying things out, or even if they see you typing on their computer.

Dropping flash drives, OTOH, is easy.

Re:I hate the term "Social Engineering"

[Gription]

Actually the USB scam that he referred to was a case where they just left them laying around. It was in a widely reported article a year or so ago. If I remember correctly they left some of them laying on the ground outside the company they were penetration testing.

Re:I hate the term "Social Engineering"

[IBBoard]

And if you're on your own, so you're supposed to be escorted but you're not?

Where I work we have coloured passes to make that identification earlier (white holders for employees, green for trusted temporary, yellow for low clearance and red for constant escort/uncleared) but I've walked out of buildings carrying computers and with my pass in my pocket so it doesn't get snagged. No identity, no uniform (we don't have them), nothing.

As for typing, people may ask you if you're in a large office and they don't recognise you, but if you jump in to an empty corner office, or if you look like you're doing some repairs, people are a lot less likely to bother because they've been trained not to ask engineers/repair men "are you repairing it or are you some kind of thief?".

Also, walking out with a USB drive shouldn't raise any eyebrows at all as you can't even tell the person is doing it.

Yes, dropping flash drives is easy, but it's not the only social engineering attack.

Re:I hate the term "Social Engineering"

[ehrichweiss]

Correct, and IIRC the company was a bank.

Re:I hate the term "Social Engineering"

[FredFredrickson]

Do we need a venn diagram? Come on folks, they're not exclusive! Certain subsets of lying and scamming intersect some subsets of Social Engineering.

Father, I have my foot in your bedroom and also in the hallway. As you can see from my diagram I am not only in the bedroom, I am also in the hallway. - Eddie Izzard

Re:I hate the term "Social Engineering"

[ehrichweiss]

Another example, and my favorite, is to dress like a delivery driver and carry a pizza bag. While even the most strict security will check you at the front door, once you're in you will find that you have pretty much free access. Same goes for wearing overalls(and as mentioned below, a hard hat helps at times) and holding a metal clipboard.

Re:I hate the term "Social Engineering"

[Koiu Lpoi]

...and the drive automatically grabbed some data.

What in God's name kind of computer network has autorun on USB devices set to "always run"? What are we running here, Windows ME? That's a ridiculous hole in computer security, rather unrelated to the people themselves. That's like getting your computer auto-infected with a word macro virus and saying "Well, it's your fault even though our system has macros set to autorun. Social engineering, nehh."
 
Now, if they put in the same USB keys in any real operating system, either it wouldn't run, or it would come up with a menu, the top option being "Clearly not a Virus." Anyone who's ever used a USB drive before knows the XP (or higher) autorun has "Open these files" further down on the list, and would be put off by a fake one being at the top and probably report something.

Re:I hate the term "Social Engineering"

[Defectuous]

They will not deny they are scamming or lieing. But they are creating a situation in which they are capable of getting what they want. So they are socially engineering the situation to their needs.

Re:I hate the term "Social Engineering"

[geekoid]

That's nice that your 4 year old can solve a 3000 year old philosophical question.

I mean, sure the person answering should always be aware of the intent of the question, possible by reading the mind of the person asking the question~

Re:I hate the term "Social Engineering"

[Hsensei]

How about where peope are offered free pens or t-shirts for thier network passwords. I've read where lots of people were more than willing to give up passwords for swag. That didnt require any lying or scamming.

Re:I hate the term "Social Engineering"

[aaarrrgggh]

Hard hat, clip board, tyvec suits, pointing a boom-shaped object at things while looking at a display, or rolling around a cart of strange looking tools will generally get you into plenty of places you shouldn't be going. Oddly enough, no matter how well secured the front door is (well after 9/11), there is usually a back door that can get you in.

The most surprising one is just juggling a bunch of crap and asking for the guard to let you through the man-trap.

While my purposes aren't nefarious, these things can easily be exploited.

Re:I hate the term "Social Engineering"

[pclminion]

Why do you say "trying to sound legit?" These people were being paid to do this, by the power company.

Anyway, it seems your objection to the term "social engineering" is that is doesn't sound "evil enough." Well, that's in the ear of the beholder, isn't it? I don't see how calling it "social engineering" is an attempt to sound more legitimate. It's just a description of what it is, and a fairly accurate on at that.

Re:I hate the term "Social Engineering"

[pclminion]

Even my 4 year old has no difficulty understanding that weaseling like this is a form of lying. :)

A bunch of moralizers saying it doesn't make it so. I'm not responsible for making sure you're aware of the state of the universe. That's your job. The error occurs when somebody assumes that if X was not said, then X is not the case. That's a ridiculous assumption to make.

Re:I hate the term "Social Engineering"

[ShiNoKaze]

Saying that social engineering is lying or scamming is like saying that all fighting is boxing or wrestling. They can be kinds of social engineering, but all social engineering is not lying or scamming. Yay analogies!

Re:I hate the term "Social Engineering"

[dmartin]

But lying by omission is a lot harder to pin down than what I would call lying i.e. knowingly giving a false statement as a true one.

Using your definition, all sorts of cultural and personal norms come into the game -- who considers something important? If someone jumps to the wrong conclusion based off my actions and does not tell me, have I lied by omission? This seems like it would include many things that I would classify as "misunderstandings". Or is it defined by whether or not the person making the statement had an intent to deceive?

Maybe your 4 year old can help me out here =).

Re:I hate the term "Social Engineering"

[kalirion]

How does this work? Was it using the autoplay functionality that's such a pain in the ass in Windows? Or some automatic driver install?

Re:I hate the term "Social Engineering"

[AK Marc]

Besides, are you actually lying when you only tell truths and never say a false word?

Yes. Telling a known falsehood with the intent to decieve is a lie. If you wanted to gain access to the fusebox somewhere and walk up to the front desk with a clipboard wearing the uniform of the local power company and a cool toolbelt and said "I'm here to inspect the power circuits for the east wing" you did not utter a false word. You are there to inspect the circuits, and maybe sabotage them while you are there. Yet you spoke with the intent to decieve and did not give the information you knew to be relevant to the person behind the desk. "They didn't ask if I actually worked for the power company" is an excuse only a politician could love. You knowingly decieved someone through use of words. That isn't the strict dictionary definition, but it's close enough that I would guess most people would consider it a lie, and when the dictionary and popular use conflict, the people win.

Re:I hate the term "Social Engineering"

[IBBoard]

So despite saying "yes", your answer is actually "no"? You specifically said you deceived them and spoke with the intent to deceive, not that you lied to them. When you're getting to the definition of words then it's an important distinction.

People may feel they've been "lied to", but that's just because people treat "lied to" and "been spoken to and deceived" as close enough alternatives as to use them interchangeably. Get in to a technical or legal situation and you can't be so casual.

Re:I hate the term "Social Engineering"

[jafac]

Well, in a way, 9/11 was a form of social engineering as well.

The premise was:
American Civilians believe that they are non-combatants. So if the terrorists make the passengers believe that if they cooperate, they will not be killed, then terrorists can commandeer a plane, and do whatever they want. As long as the passengers are compliant.

However, Flight 93 proved that 5 armed terrorists can not successfully commandeer a planeload of civilians who know that they ARE combatants, and will be killed according to the most savage set of rules: survival of the fittest.

The mistake the Flight 93 terrorists made was to let the passengers use their cell phones, and find out the truth.

The THREAT of this attack vector ended the moment the first cell-phone call made it out of Flight 93. NOW: no planeload of passengers is likely to EVER AGAIN cooperate with terrorists. Terrorists know this. That is why they've never tried this plan again since 9/11. They get onto planes all the time, and it's certainly trivial to smuggle weapons on board a plane. But they now know they have no chance in hell of gaining control of a plane.

The reality that Americans didn't like, is learning that their civilians were now combatants. This reality has been strongly rejected - but it's still real. Cognitive Dissonance.

Re:I hate the term "Social Engineering"

[FLEB]

Well, if they never actually verified the passwords, I could imagine a lot of lying and scamming going on-- just not by the people giving out the swag.

Re:I hate the term "Social Engineering"

[pipingguy]

The term 'Social Engineering' has been co-opted so as to now commonly mean something other than it's original definition.

http://en.wikipedia.org/wiki/Social_engineering_(political_science)

Social engineering through history

Before one can engage in social engineering, one must have reliable information about the society that is to be engineered, and one must have effective tools to carry out the engineering. Both of these only became available relatively recently - roughly within the past one hundred years. The development of social science made it possible to gather and analyze information about social attitudes and trends, which is necessary in order to judge the initial state of society before an engineering attempt and the success or failure of that attempt after it has been implemented. At the same time, the development of modern communications technology and the media provided the tools through which social engineering could be carried out.

While social engineering can be carried out by any organization - whether large or small, public or private - the most comprehensive (and often the most effective) campaigns of social engineering are those initiated by powerful central governments.

Extremely intensive social engineering campaigns occurred in countries with authoritarian governments. In the 1920s, the government of the Soviet Union embarked on a campaign to fundamentally alter the behavior and ideals of Soviet citizens, to replace the old social frameworks of Tsarist Russia with a new Soviet culture, to create the New Soviet man. The Soviets used newspapers, books, film, mass relocations, and even architectural design tactics to serve as "social condenser" and change personal values and private relationships. Similar examples are the Chinese "Great Leap Forward" and "Cultural Revolution" program and the Khmer Rouge's plan of deurbanization of Cambodia.

Non-authoritarian regimes tend to rely on more sustained social engineering campaigns that create more gradual, but ultimately as far-reaching, change. Examples include the "War on Drugs" in the United States, the increasing reach of intellectual property rights and copyright, and the promotion of elections as a political tool. The campaign for promoting elections, which is by far the most successful of the three examples, has been in place for over two centuries. In Singapore, the government's housing policies attempt to promote a mix of all races within each subsidized housing district in order to foster social cohesion and national loyalty while providing the citizens with affordable housing.

Social theorists of the Frankfurt School in Weimar Germany like Theodor Adorno had also observed the new phenomenon of mass culture and commented on its new manipulative power, when the rise of the Nazis drove them out of the country around 1930 (many of them became connected with the Institute for Social Research in the United States). The Nazis themselves were no strangers to the idea of influencing political attitudes and re-defining personal relationships. The Nazi propaganda machine under Joseph Goebbels was a synchronized, sophisticated and effective tool for creating public opinion.

In a similar vein the Greek military junta of 1967-1974 attempted to steer Greek public opinion not only by propaganda but also by inventing new words and slogans such as: palaiokommatismos (translated as old-partyism), Ellas Ellinon Christianon translated as: Greece of Christian Greeks, Ethnosotirios Epanastasis translated as Nation-saving Revolution meaning coup d'état etc.

Social engineering can be used as a means to achieve a wide variety of different results, as illustrated by the different governments and other organizations that have employed it. The discussion of the possibilities for such manipulation became especially active following World War II, with the advent of television, and continuing discussion of techniques of social engineering - particularly in advertising - is still quite pertinent in the western model of consumer capitalism.

Re:I hate the term "Social Engineering"

[AK Marc]

Get in to a technical or legal situation and you can't be so casual.

And again, only politicians need worry about that. And, even if you follow the judge's instructions in answering a question (after asking for clarification to make sure your answer is accurate) you will be impeached for lying, even if you spoke the truth. So, the lesson is that speaking the truth will get you prosecuted for lying, even in these "technical or legal"" situations. It's too late, the cat is out of the bag. If someone feels that you deceived them through use of words, even if your words were 100% accurate, then you are a liar.

Re:I hate the term "Social Engineering"

[ukyoCE]

Not 100% sure about USB, but Windows XP auto-runs data cds automatically, no questions asked. I tried desperately to turn this off on my latest Windows XP install, and could find no way possible to turn off cd auto-run short of hacking the registry. Somehow every time I install XP I am dumbfounded yet again by how bad it is.

Re:I hate the term "Social Engineering"

[IBBoard]

But is that lying to the court or is that impeachment for deceiving the court? To some it may be a minor difference, but when you're talking about defining terms and making sure they're not misused then it is everything.

Re:I hate the term "Social Engineering"

[Magada]

Unless the story of flight 93 is a lie, that is.

Re:I hate the term "Social Engineering"

[vux984]

Or is it defined by whether or not the person making the statement had an intent to deceive?

Precisely.

You can say something that's outright false and not be lying. If someone wanders into your offices and tells you he's there to repair the network, and you then mention in passing to someone else that you saw someone come into repair the network, are you lying?

Objectively its a falsehood. He's really there to install keyloggers and case the place out for other security weaknesses. But subjectively, from your point of view you have no intention to decieve or mislead. I might tell you you are mistaken, but I'd never accuse you of lying, unless I had reason to believe you were a conspirator.

Maybe your 4 year old can help me out here =).

Probably not eloquently, but again, yeah, he knows the difference between making a mistake and lying.

Re:I hate the term "Social Engineering"

[Merl3]

Analogies can either be misleading or spot-on. Anonymous Coward's vaccine analogy (like a lot of what AC contributes) is both +5 spot-on "insightful" but also something I'll use today to deflect wrath from couple of pissed-off staffers who got "vaccinated" yesterday. Gotta talk to "Management" in ways they understand. I can sell "Dr. Merl" giving "vaccinations" a lot better than "social engineering" (which sounds like something an HR person would say).

one word.

[Neuropol]

bzzt.

Re:one word.

[brain defrag]

Mod parent up for SimCity 2000 reference!

I'm Shocked!

[ookabooka]

Not really though. A good team of social engineers (con men) and CS people can accomplish many many things...How can you prevent such things? Ridiculously strong security? Require the security guard at my place of employment to scan my ID each and every time I walk in the building? Is he supposed to also stop law enforcement from going in without clearance from HQ? I'm quite serious, what would be an effective way to stop these tactics? Everything I think of is either too impractical for most situations or prone to the same failures, but at different points.

Re:I'm Shocked!

[QuantumG]

Require the security guard at my place of employment to scan my ID each and every time I walk in the building? If you work with national infrastructure, they god damn better.

Re:I'm Shocked!

[teh moges]

Maybe don't go to the extremes of requiring everything to need high security (such as entering the building or doing everyday work), but things such as shutting down the power grid should require extra security. Access to the important controls should have extra security. With security, one size does not fit all.

Re:I'm Shocked!

[Anonymous Coward]

Security, in all forms, is never about prevention - its about deterrence. Even nuclear weapons don't prevent anything, but the threat of a counterstrike deters a nuclear attack. Similarly, WEP keys don't mean shit, passive scanning (completely undetectable) can crack the best WEP keys in probably under a day as well, and good security experts have tricks not just to crack, but the bypass and cut down those issues far further (if I prepare and then try to go crack a secure wifi home/small office wifi network - even larger companies as well - it takes me all of about 10-30 seconds. That time is just the physical time it takes the gateway to update after I log in and hijack, which can be done essentially instantly.

Just the same, bouncers outside a club don't prevent entry, they just deter brute forcing the door. If you really wanted to get in the club in a hurry you could walk up with a gun, mow them down, and walk in - wouldn't even have to break stride.

It's not a matter of computer encryption, the level of good modern encryption and layering is a very very effective deterrent to common attacks and even clever ones. Why bother trying to hack a password or bypass routines when you can write an email to an employee from a fake email address claiming to be company tech support and just ask them for their login/password? Or walk in the front door of the building and say your with city power. People are so fucking easy to manipulate that social engineering is the real way to hack nowadays, properly setup linux is really quite secure.

Using both in conjunction? Almost any modern deterrence becomes trivial.

Hell DARPA got 'cracked' awhile back by a guy logging in using the login: Admin, password: , the default windows setup. No social engineering, no computer knowledge required. It's sort of like trying to build a space elevator, putting a satelite and a counterweight and actually getting a nanotube cable and then having a guy just hold the cable from earth. Why bother trying to sabotage the satelite or the counterweight or the cable when you can just wait until the guy gets tired and falls asleep - shit practically cracks itself.

Re:I'm Shocked!

[kestasjk]

Yup the terrorists could shut down the power grid; it'd be like 9/11 but with light bulbs instead of people!

Since OTT security costs OTT money I think they should stick with sane security checks, and not worry about headline grabbing pranks like these

Re:I'm Shocked!

[GeigerBC]

The transmission lines and interstate network are also part of the national infrastructure. Hard to scan IDs when you walk by those.

Re:I'm Shocked!

[Yvanhoe]

Accessing to the crucial computers should require a training where computer security and social engineering are explained. Every user access should have different passwords easily revocable as soon as a flaw is detected. Of course, crucial computers should be on a different network than internet-connected systems.

Re:I'm Shocked!

[witherstaff]

Why not take measures akin to the nuclear facilities? The local ones don't even allow parking right near the facilities, they bus the employees in from remote parking lots on a regular schedule. Let alone the stringent security within the plants.

Re:I'm Shocked!

[Anpheus]

Wait, guys, I have a fix!

*unplugs cat-5 from firewall between power control computer and local intranet*

Wait, you were saying something about prevention and deterrence and I rudely interrupted. Please, carry on.

Re:I'm Shocked!

[witherstaff]

After the '03 outage it made me wonder how safe all those high-rise electrical towers that run across the country are. A stick of dynamite on a tower itself, or even just a few shots with a rifle to the wires attached. Would just one tower lead to another blackout - scary considering those towers are of course everywhere.

I've wondered over the years what someone with a high powered rifle taking potshots at oil/propane/liquid hydrogen tankers on the interstates would do. Mainly this crosses my mind while driving alongside one of them and having seen too many Hollywood movies with things blowing up.

Re:I'm Shocked!

[dbIII]

I have to admit I have gained that sort of access just with a pair of overalls. It was one of those stupid catch22 situations where you had to do a one day safety course to be authorised to get through the gate and you had to get through the gate and walk through the middle of the turbine hall to get to where the course was held so you could get your ID. A similar thing happened at another power station but that time I actually had the company logo on the overalls - but yes I did just walk in and go right up to the control room that time. Oil refineries are a different story - the ones I visited had administrative buildings outside the gate so you didn't have to get full site access just to meet someone in the place.

Re:I'm Shocked!

[FireBreath]

I've wondered over the years what someone with a high powered rifle taking potshots at oil/propane/liquid hydrogen tankers on the interstates would do. Mainly this crosses my mind while driving alongside one of them and having seen too many Hollywood movies with things blowing up.

Don't you watch Mythbusters? They proved you can't just go blowing up canisters in huge firey explosions with rifles. It takes a fair bit of explosives to do that.

Now where did I leave that RPG...? :)

Re:I'm Shocked!

[Jessta]

Seperation of privileges is the best method. Social engineering tends to work because people who have privileges lack certain information and/or lack authority in the role of the privileges they have.

If you have full authority in your role and personally know everyone who is involved in your role then you can't be easily tricked by people outside your role in to doing things.

This requires education and a proper company structure, which requires good smart people in management.

Re:I'm Shocked!

[Anonymous Coward]

shutting down the power grid should require extra security

DANGER WILL ROBINSON!

CRITICAL FAILURE IS IMMINENT, YOU MUST SHUT DOWN THE REACTOR IMMEDIATELY

Please enter password:

Password is incorrect!
Password is incorrect!
Password is incorrect!

You have been locked out for 10 minutes.

Re:I'm Shocked!

[Mikkeles]

Tracers.

Re:I'm Shocked!

[Idaho]

Not really though. A good team of social engineers (con men) and CS people can accomplish many many things...How can you prevent such things? Ridiculously strong security?

It looks to me like having ridiculously *weak* security every step of the way is what made it so easy for these social engineers to be effective. Countering this by saying "well yeah, but what are we supposed to do, they can break it anyway!!" is not a valid argument, IMO.

Of course it will always be possible if someone is really determined and is willing to spend significant resources and take a lot of risk (such as bribing people, blackmailing, hiring PI's, breaking and entering the physical building), but that does not mean it's ok to say "well, someone could break our security system anyways so let's just not bother with placing any security constraints in place whatsoever".

Because if both risk and cost are close to zero (investing 1 day of time and probably some equipment doesn't sound *that* expensive to me), you're practically inviting something bad to happen.

Concretely, it is ridiculous that the same terminals that can be used to control the power plant, are also directly connected to the internet. Had this not been the case, I'm sure it would have taken a lot more effort to do anything interesting (like, shutting down the plant).

Re:I'm Shocked!

[AB3A]

I don't know why you got modded insightful.

Here's the first clue:

Public utilities are public! They're not armed fortresses. They were originally created to be open institutions where people could see what is going on. They're supposed to share data and cooperate with each other.

Here's the second clue:

There are many who need the information about the utility's performance to do their day to day jobs. The volumes of information and the volumes of regulatory agencies, and other groups they need to inform increase every day. Securing these connections isn't for the faint of heart. I say this as a member of ISA-99, the international standards body for SCADA security.

That said, most companies have secured the distribution systems. However, these are highly customized systems. You can't bolt security on them after the fact. Replacing them is nothing like replacing or upgrading an information system. There is this little problem known as system validation. It is extremely expensive. Furthermore, the standards for securing these systems are still very much in development (I'm on one of those standards committees too).

SCADA systems are in the Ford Model T days. You want to bolt a seat-belt and airbags to it. These things may help, but if you really want things to be secure, we need to rethink the entire infrastructure. And that will not be cheap...

Re:I'm Shocked!

[TapeCutter]

"...and social engineering are explained"

Knowing how Sigfreid does a card trick does not mean you won't be dumbfounded when Roy pulls a monkey out of his arse. I'm not saying education is worthless but even the process of educating staff on various common 'tricks', is in itself, a target for social engineering.

"Authorization? How about the United States FUCKING government? Lose the grid, or you lose your job." - Special Agent Johnson - Die Hard movie.

Re:I'm Shocked!

[QuantumG]

Here's a Slashdot tip for ya. Whenever you see a post that you don't know why it is moderated up, look at what it is in reply to. In this case, my post was modded up for pointing out the obvious to someone who is clearly oblivious.

Re:I'm Shocked!

[DougWebb]

Tracers apparently pass through smaller tanks too quickly to ignite anything; they tried that on the Mythbusters show. Also, to get ignition, you need fire, fuel and oxygen. Sticking a fire suddenly into the middle of a fuel tank is just going to heat the fuel up a bit without the oxygen.

Re:I'm Shocked!

[Anonymous Coward]

Require the security guard at my place of employment to scan my ID each and every time I walk in the building?

Why not? I once worked at a company where they did that. And if you forgot your ID badge at home you had to go to the security office and a lecture along with a temporary badge.

Is he supposed to also stop law enforcement from going in without clearance from HQ?

Absolutely. All visitors must be authorized & accounted for. In a free country, police can not barge in to private property without a warrant. On the other hand, if the police have a warrant...

I'm quite serious, what would be an effective way to stop these tactics?

12 gauge shotgun?

Re:I'm Shocked!

[Firethorn]

I don't think that he was looking for a 'huge firey explosion'. I figure he was after 'cut the wire of a major power distribution line causing a massive outage by itself'.

same deal as tossing a metallic rod across some terminals in a switching station.

Disrupting our power system physically is more difficult and would create more isolated outages than if you have access to the computer.

You'd have to choose your target carefully as the high voltage distribution lines tend to be redundant, and in many cases the equipment is designed to compensate automatically. Though the outage last time I was in Florida(switching station failed, caused two nuclear plants to shut down to preserve safety automatically, spreading the outages even further), shows that there's still a lot that can be done with purely physical methods - and the fences around switchyards are more to keep curious kids out of them than determined adults.

Re:I'm Shocked!

[6Yankee]

How can he? He was posting from that power control box, you insensitive clod!

Re:I'm Shocked!

[Oktober Sunset]

Just the same, bouncers outside a club don't prevent entry, they just deter brute forcing the door. If you really wanted to get in the club in a hurry you could walk up with a gun, mow them down, and walk in - wouldn't even have to break stride. Umm, yea, try that in a club in a real city, the bouncers will have bullet proof vests, there will be double barriers in front of the club that you have to jump over , by which time the bouncers will have retreated inside, closed the shutters and radioed for the police who are only 2 or 3 streets away and will be getting the submachines guns out of the boot of thier car. Armed police would be there in about 2 minutes to gun you down.

Clubs in citys with gang problems usualy have extremly well armoured entrances, thats why you go through those such narrow little doorways when you get inside, so they can lock it up real easy.

I've been in a club where someone pulled a gun at the door, we never even knew about it, untill cops and bouncers came down and told everyone the club was closing cos there had been an 'incident' outside, when we got outside, there were cops everywhere, but we didn't even notice anything inside, the bouncers inside just shut the doors and they couldn't do shit except wave thier gun about until they the police turned up and they ran away.


It's all a question of what you are expecting, if you expect a few drunken monkeys, you just hire a couple of big blokes, if you expect armed gang members, you hire a professional security team.

Likewise, if you expect your scallywag neighbour might be mooching your broadband, you turn on WEP. If you expect that determined saboteurs are going to shut down your power grid, you do what the guy in the last reply said, unplug the computer that controls the grid from the network.

Re:I'm Shocked!

[hesaigo999ca]

Simple, follow the regulation set up for the power grid by the main power grid company,

NO COMPUTER SHOULD BE NETWORKED WITH ANY OTHER COMPUTER THAT HAS INTERNET ACCESS.

This means the only social engineering capable, is having someone walk into your office,
then stands the question how hard do you blast your security personnel when they let just anybody in???

Re:I'm Shocked!

[Anonymous Coward]

Sorry, I have to reject your statement. Whether or not you work with a standards body, I worked for a public utility. Security on entering the facilities is fairly tight, it's not for public view. Yes, validation is expensive...however, the utilities really are working on providing as little as they can contractually get away with, at least where I worked. It was actually kind of shameful. If utilities would invest in updating infrastructure, a lot of 'catastrophic failures' wouldn't occur.

Re:I'm Shocked!

[Mikkeles]

I was thinking of an automatic weapon. Tracers are not that useful in a single shot firearm.

Re:I'm Shocked!

[Anonymous Coward]

Vote out the deserter chimp, and vote out his party, in hopes a different party can sweep some of his corrupt incompetent appointees out, who have turned DOJ and DHS into cesspools of incompetence, corruption, and sheer immorality!

Re:I'm Shocked!

[Sandbags]

I can't discuss which power company it is, due to contractual issues, but I can tell you that the power company around here would not be susceptable to such an attack.

The computer systems that control the grid are extremely secure. So secure in fact, they do not HAVE a network connection outside of their own server to server interaction.

The mainframes, UNIX systems, and other systems that operate the switcing grid are isolated in a section of the building that even their own network engineers can not enter without being padded down to ensure they carry no computer media of any kind.

When media does need to be brought in, say to patch the OS on a machine for a bug, or to update the backup server software, the media for that must pass through a several step security scan, including scans by not less than 3 AV applications, repeated on not less than 3 different PCs. All install media for machines in that area are kept in that area, seperate from all other company media.

You wouldn't believe the process we had to go through to bring a new backup system in there...

These systems are so isolated it is virtually impossible to infect them.

On the other hand, the PCs connected to the billing systems, yes, they could be infected. These systems however are backed up in many ways, and even if they had to roll back the database a few days, all they'd have to do is correlate the accounting records with meter readings, and they'll know exactly how much everyone owes or paid. They might have to type a few customer change orders back into the system, but all that is in hard copy anyway... It would be an inconvenience, but not that big of one. Of course, the billing system is only accessible via terminal session from PCs on a specific VLAN that are not used for any other purposes (no web browser, document creation, etc), so infecting it is not exactly easy, and I doubt is could be done with a bot without intimate network design knowledge, a few passwords, and a lot of attempts. It would have to be a targeted hack.

This particular power company is a locally owned co-op, small time company. If they can implement security like this, I'm sure others do as well.

I imaging the power grid itself, not so much the systems controlling them, could somehow be hacked, or fooled with conflicting signals that could cause issues, but I seriously doubt anyone let these people try...

Re:I'm Shocked!

[Anonymous Coward]

my father works in the regional control center for a very large power company. he is directly responsible for keeping the lights on for most of the northeast US. there are PCs in the power control office. these PCs are connected to the internet and used for all kinda of desktop activities. yes, they are more than likely compromised by *something* as most PCs are. The fact that there are PCs in the control room doesnt really mean a damn thing. the integrated systems that control power switching and all that stuff i dont understand are completely sandboxed from the outside world. there is not a single byte of data sent over open channels. The fact that someone could hack the machines in the control room means that they could have access to employees personal e-mails, corporate memos, spreadsheets, etc. there is no customer data on the machines in the control room--why would there be? basically, the part in the title about the "grid" being hacked is false. it is entirely impossible to "hack" the grid without having several hackers physically inside the control room. even the engineers that run the show can't do anything by themselves, they need at least 2 people to work together.

to surmise, the power grid was not hacked. not even close. just another windows pc in an office was hacked. nothing to see here, move along.

Re:I'm Shocked!

[DougWebb]

In that case, if it works at all, it'd probably work by punching a bunch of holes in the tank and causing a leak, and then igniting the fuel that's leaked out and mixed with the air. That's still hard to do though; with a pressurized tank once the leaking starts you get a high velocity stream that carries the fuel away from your target position before it can ignite, and low density around the target point. With a non-pressurized tank, the fuel is probably a liquid stream that'll be falling onto the ground, which also takes it away from your target point and prevents the fuel/air mixture you're looking for from being creating. You'd have to start the leak, wait for a puddle to form, and then try to ignite the vapors over the puddle.

Re:I'm Shocked!

[AB3A]

I have been working for a utility for more than 20 years.

The utility business has three tactical concerns: Safety, Availability, and Security --in that order of priority.

Utilities have been running for decades on old infrastructure. Using SCADA, we're managing the existing capacity in the original infrastructures built by our parents and grandparents. They invested monies that in today's economy would make your utility bills look ridiculously small.

Utilities aren't building infrastructure because the rate payers don't know there is a problem with it. Even when they do know, they may not realize how much it is going to cost to really build in the kind of capacity that previous generations were willing to commit to.

No, instead, we get leaders who slash staff, offer early buy outs, and then discover they don't have anyone who knows where anything is or how it works. Realizing they don't know how to hire people who know what they're doing, because they don't know what to look for, they contract the whole thing out to some private company that in theory could run a utility, but in practice is also understaffed.

And against that backdrop you'd have us invest in a tertiary concern called security? I mean, we are all interested, but there are higher priorities right now.

Re:I'm Shocked!

[geekoid]

Isolated systems and highly trained people work.

Alerts to other people when someone does something that would shut down the system.

Having these highly trained people stay with you for 20 years also helps.

Really, you don't need a expensive security system to prevent this.

I worked with some former con men in the 80's. They taught me how to recognize a situation that would be open for a con.
That is the kind of training people in critical situation need to get.

Re:I'm Shocked!

[Bender0x7D1]

You might not be able to use a rifle to do it, but it is quite easy. Columbia has over 200 terrorist attacks per year on it's transmission lines. A couple of minutes with a cutting torch, a pickup with a winch to provide a shearing force, and down comes the transmission tower.

Re:I'm Shocked!

[Skapare]

SCADA systems are in the Ford Model T days. You want to bolt a seat-belt and airbags to it. These things may help, but if you really want things to be secure, we need to rethink the entire infrastructure. And that will not be cheap...

Fixing it means making the decision for either the whole thing, or individually for the many parts of it, what is to be changed and what is to stay as it was. Given the way software development is done these days, anything and everything that gets changed is almost certain to not work effectively for years, if not decades. It won't necessarily be that the software actually written is wrong, but rather, the tools it uses don't work precisely as expected (which is usually some interpretation of the 2 versions old documentation).

Today's software systems, whether Microsoft Windows based, or Free Open Source Software based (e.g. Linux, glibc, etc), are just too complex to be sure things are working right. Things will have too many failure modes and security exposures because no one can really understand all of it to analyze things enough to avoid it.

SCADA is the result of decades of gradual migration to computer control. It may not be pretty, but it has that advantage of slow, careful, methodical development, adoption, and deployment. How are you even going to do any live tests of a new system? How rapidly are you going to try to implement it in the first place (hint: rapid development is a curse to any critical system design).

Re:I'm Shocked!

[Skapare]

There's more to it than simply some command that says "Shut down the generators" or "Open the switch to the grid". There are hundreds of operational parameters to controlling just how the generators are working. You don't need to just shut things down (and likely, you probably cannot just simply do that with a command, anyway). Much of the risk exists in tweaking the way things operate in such a way as to cause problematic situations that could necessitate shutting something down, or cause damage to generation facilities, or worse. One critical step that needs to be taken is total isolation from the internet. And that is because other steps need to be thought out more carefully, and time is needed for that.

Re:I'm Shocked!

[AB3A]

You forgot the most important part: The remote terminal unit (RTU). It's an embedded system. It frequently runs a proprietary network stack. The average age for such things is about seven years. The expected lifetime is about 15 years.

You're thinking only of the control center. There is an entirely different world out there in the field.

Wanna know where the real work is? It's at the remote. It's the fail-safe logic, the protection circutry, the I/O wiring, the documentation. It's the validation of the I/O to the screens the operators see. It's the backup control strategies, and so on and so forth.

The control rooms are cheap compared to what it costs to upgrade the field. Real SCADA security must include the RTU. Security methodologies for control protocols as described in IEC 62351 are just now getting posted. Products are just now starting to get built.

And you're right: it will take years before they make a substantial penetration in to the field. Hardening the control center is important, just like hardening your front door is important. But it's only the front door. And it's not where the real money is.

Re:I'm Shocked!

[RulerOf]

Would just one tower lead to another blackout
IANA Power Grid Engineer, but in most cases involving high tension lines, there are usually redundant links. Much in the same way the internet is a mesh network, if one of those power links were to go down, the others *should* be able to take over, assuming that the remaining lines aren't nearly overloaded in the first place (see frequent California rolling blackouts).

That said, with a large enough team and a big enough plot, you could probably strike specific weak points simultaneously to cause another incident like the blackout of 2003. Supposedly though, after that incident, the power company "learned their lesson" and has retooled their infrastructure to prevent another cascading event such as that from happening again, but I doubt that rules out something deliberate and *very* purposeful.

Re:I'm Shocked!

[RulerOf]

In that Mythbusters episode, tracer rounds couldn't set off the propane tank, so they tried incendiary rounds. Those didn't work either.

Explosives did the trick though.

Re:I'm Shocked!

[vacantskies9]

It would take more than one tower. The grid has redundant paths, and each one can pick up quite a bit of slack.

Re:I'm Shocked!

[Anonymous Coward]

"requires good smart people in management."

Oh, just wish for genies and unicorns while you're at it!

Re:I'm Shocked!

[glitch23]

Public utilities are public! They're not armed fortresses. They were originally created to be open institutions where people could see what is going on. They're supposed to share data and cooperate with each other.

The government is public too but some information is sensitive. The government sets up WAN connections to sites to share data. Why can't companies who run the utilities do the same? Other companies not running utilities use extranets and intranets (some encrypted, some not) for communication between departments or with suppliers. Sounds like some CIOs (or CEOs) needs a refresher in network security. There may not have been security issues when these utility buildings were first erected but there are now and other companies have learned to protect their assets. Utilities should too if they know what's good for them.

Re:I'm Shocked!

[Harald Paulsen]

The mainframes, UNIX systems, and other systems that operate the switcing grid are isolated in a section of the building that even their own network engineers can not enter without being padded down to ensure they carry no computer media of any kind. So.. who checks the security guards who lets them in?

Re:I'm Shocked!

[tc9]

AB3A is correct in ways that many on this thread cannot imagine. I was a t a DOE briefing in January that indicated that if the power grid technology was not totally transformed, just keeping up with the way things are done now would require $800,000 in the next 7 years to just keep even.

There are efforts to change the paradigm. They range from the fairly traditional model, but using complete new control interctions and syntaxes like EPRI's Intelligrid (which feels more like the business as usual, but better described above) to market-based decomposition of the worlds largest robot into autonomous agents and entitites (GridWise, etc) to radical "it is impossible to fix, so dont try, but do something different" to be found in Galvin's Perfect Power Initiative.

Slashdotters who are actually interested might want to make comments on the proposed OpenADR standard now, while it can still be improved.

For the green or sustaianbly oriented, how well the problems of OpenADR (JFGI) are solved is likely to radiacally affect the chances of success for such high profile initiatives as the Zero Net Energy Commercial Building and the 2030 Challenge...

So that's what really happened....

[Anonymous Coward]

Hope it wasn't some hacker who really caused the 2003 blackout.... http://en.wikipedia.org/wiki/2003_North_America_blackout

Is everything on the internet?

[Armon]

Why wouldn't the power company use a private network? Why is there EVER a need to have access to those systems over the internet?
Realistically, no part of a nations critical infrastructure should be networked (other than the internet itself). That seems pretty obvious.

Re:Is everything on the internet?

[Brian Gordon]

They did- and the penetration testers got access to internal-networked workstations and hacked from there.

Re:Is everything on the internet?

[Anonymous Coward]

Given how cheap computers are why are these machines on the internet at all. Stupid, stupid, stupid. It took 5 years after http://www.computerworld.com/printthis/2003/0,4814,84510,00.html for this one company to look into their security? How screwed are the others? At what point does this become criminal negligence?

Re:Is everything on the internet?

[jroysdon]

The problem is the layers. The Desktop PCs (you know, the ones you use to check email and surf the web) have access to the internet (probably just outbound), and access to the SCADA networks. While you cannot initiate an inbound connection to those Desktop PCs, all you have to do is get someone to click on a link and get infected with something that sits on their PC and maintains an outbound connection (think GoToMyPC). From there, the exploit team has access to their PCs and everything their PCs have access to.

In an ideal world, they'd have two PCs on each desktop. One on the internet, one on the SCADA network. The two should never be connected. That's how the military is suppoesd to do it between different levels of their networks (the two different levels are never to be connected).

But that costs you twice as much, and isn't convenient. But you'd never have a security breach.

Oh, and they buy and sell power over the internet between different power companies, so right there is a reason you'd need some SCADA system connected with internet access (but you could have those systems very, very locked down as to what and how they can access between things).

Re:Is everything on the internet?

[pseudochaos]

I agree - that's a rookie mistake.

Re:Is everything on the internet?

[QuantumG]

But you'd never have a security breach. Unless someone wants to transfer a file between the two machines, so they use a USB storage device to do it.

Re:Is everything on the internet?

[Anonymous Coward]

Connectness is transitive. It wasn't a private network if it can be accessed from the outside.

Re:Is everything on the internet?

[Anonymous Coward]

I don't understand "they did". Internet and SCADA where available on the same desktops:

"Individual desktops have Internet access and access to business servers as well as the SCADA network, making the control systems subject to Internet threats."

Re:Is everything on the internet?

[jroysdon]

Even still, you wouldn't have any way for someone to remotely control those systems. A virus/worm might get spread from the internet PCs to SCADA PCs at the worst, but there is no way to control them (short of sending another message via virus and long time delay via "sneakernet" USB storage device).

But safer than that would be a way to have a DMZ storage system (not internet DMZ, but DMZ between internal Internet-access PCs and SCADA system PCs) that each different type of PC can drop data off in, but that DMZ system has no access out to either side. So you can drop data off, and then go get it from the other side. So long as your data is just raw data (db info of some sort, I'd imagine), there isn't away you're ever going to push a virus/worm back and forth.

Re:Is everything on the internet?

[Anonymous Coward]

Ya, this used to be called sneaker net. When two networks are totally separate, it becomes much harder to socially engineer someone to play a game or watch porn on the (secure) separate network.

Re:Is everything on the internet?

[emjay88]

Airwalls are great!

Unless there's a wireless network...

Re:Is everything on the internet?

[kitsunewarlock]

At this point its probably a money saver. They wanted the internet in the building, but didn't want to buy another set of computers when they already had internet capable computers probably (I'm guessing) as monitoring stations.

The short answer is: "Boss is cheap and employees will quit if they can't watch YouTube in one window as they watch the grid in the other."

Of course, they could be completely incompetant and simply be using the internet this way so they can monitor things from outside the building...which still doesn't make much sense to me. If anything, it should be one man's job to manually transfer the data via flash memory device to and from the non-networked computer and the networked computer every 15 minutes to ensure whoever was too lazy to come to work can get up to the minute information. or, you know, just connect it to the internet when its absolutely necessary. Its the same reason I don't keep my cell phone on all the time: I don't want people accessing it when I'm in the shower, class, driving, etc...

To continue your sentiments: if you don't want people accessing your device, turn it the hell off or snip the (many times, due to wireless technology, metaphorical) chord that connects it to everyone else. There is no shame in unplugging your Ethernet once in a while. If anything connect it with such a slow connection that by the time a virus got through, the connection would sever due to the person attempting to view two images at once (28.5 kbs moden FTW).

Re:Is everything on the internet?

[utunga]

I worked at a place that supposedly had two totally separate networks - one connected to the internet, one corporate wide, for news/data/intranet stuff.

So, sure, everybody has two desktops.. one for internal one for everything else. It was great in theory - really stupid in practice. Just doesn't work.

Reality is - there is an expectation that data from outside is available inside. In the power company case it might be everything from the latest gas pricing information to weather reports to who knows what else - and so in 'getting things done' this will inevitably require connections between the outside and the inside.

So, as a result of this 'blanket policy' contrasting with the 'real world' people would circumvent the rule - but do it in stupid, sneaky ways -- for example in one data center there was, literally, an infrared tunnel between two computers -- "see, they are not 'physically connected' !!" .. And try to keep it secret from the network ops guys, of course.

It would've made a lot more sense to supply a safe, heavily controlled/monitored firewall that connects outside to inside and let the network security people manage it. Otherwise your choices are (1.) actually enforece the rule and totally cripple the effectiveness of the internal system (with the result that nothing of any importance gets put there) or (2.) really lame hacks pretending to be secure and working around the blanket rule, when in actual fact they are invisible bridges that the network ops guys don't know about.

I saw the alternative 2. in real world practice. Lets consider option 1. - if they really did manage to make the SCADA network totally seperate **and enforce that**. In that case you'd probably just end up with the forecasting/power-station-scheduling app running on the 'outside' network - and just the final 'implement it' step on the internal SCADA. Since the scheduling app is the one where the real decisions are made - hacking into that would let you send signals and information that would look relatively harmless but would still, in effect shut down the power grid. You are still sending information - in this case mediated by human brains, but not in a way that the human brain can easily understand because its low level commands (turn this up, turn that down) - that could very effectively mess up the voltage balance or frequency timing or whatever, and causing rolling blackouts and thus achieving the same aim of shutting down the power grid. There is information flowing from outside to inside - whether it is via human or machine.

Security through dis-connectivity is a dangerous myth in most cases. In some cases, say military situations where you are willing to absorb the huge cost to re-implementing a complete replacement for just about every dang thing you might need on the inside (e.g. weather data, or radar data, say) then it may make sense. In just about every realistic corporate case - even power companies - its likely to only cause people to take their eye off the ball of implementing real security and proper firewalls etc.

Re:Is everything on the internet?

[utunga]

Consider -- if the military used data from the 'normal' weather satellites and supplied over, the internet, say, then potentially you could hack that, tell them the wrong weather - resulting in stranded helicopters, or catching them off balance or who knows what else. TO be safe they have to (presumably) have a totally seperate downlink to get weather data directly into the military network - that has to be expensive!!

Re:Is everything on the internet?

[1u3hr]

The problem is the layers.

The problem, as usual, is Windows. If you RTFA, they just set up a site and emailed the power station guys that there was a change to their pensions or health benefits, for more information.... so they clicked on the link and were pwned immediately. No specifics, but does anyone doubt this was Internet Explorer running on Windows?

Solution: Others have pointed out the need to transfer information routinely via the Internet. How about the desktops run Ubuntu, or OSX or ANYTHING except Windows? Risks of an exploit of the desktop will be much reduced, and even if successful, there is a bigger barrier if it has to work across different OSs (sadly the power supply monitoring software apparently runs on Windows, and is unlikely to be rewritten).

Whatever the solution, it will have as Step 1: Get rid of Windows facing the Internet.

Re:Is everything on the internet?

[Tarwn]

In cases where buying and selling of power is happening at the plant level, it is not going to be the equipment operator that is buying and selling power. And the person selling power does not need access to SCADA systems, thats what the telephone is for and why they have operators at plants to run the equipment. if somewhere there is a plant that is small enough that one person is both buying and selling power AND running the equipment, I'm betting they barely have an internet connection, much less the money to keep up on annual maintenance for the equipment, etc.
In the power plants I have worked in (mostly gas turbine, only one nuclear), there was not any type of internet access from PC's on the controls network. For the most part these systems only ran some form of HMI software (WW, RS, WESstation, whatever) and occasionally something like MS Word or Excel for shift pass-down notes. Sure they had a browser (on the Windows systems) but it wouldn't get them anywhere because there was only one system that had any level of access to both the business intranet and the controls systems. This system (data historian) could only receive communications from the controls side (which had interface software that knew how to contact the historian) and communicates in a proprietary protocol.

Now, as far as the corporate office is concerned, pencil and paper are good enough to keep track of which plants are running which generators, which plants have which generators down for minors or majors, and which plants have generators idling (running with no load at very low levels, not on the grid - cheaper to idle them in most cases then to shut them down). However, in the case of at least one company I worked for, their historian had an interface that pushed data back to a corporate historian, then some reports and so on would run at corporate that drew data from the corporate historian and reported machine statuses, load level, etc up to the last few seconds. This is again using the same proprietary protocol (or heck, maybe a different one).

I don't know what power company this article is about, only that I didn't work there and didn't do any type of integration for them. Whoever setup their infrastructure hopefully learned a lesson and will do it right next time.

Re:Is everything on the internet?

[BSAtHome]

Well, the update policy is lacking at those companies. Your idea works much better if you use a different processor architecture (like ppc or arm). Most threats are geared at wintel architecture. Going away from that makes it much harder (and windows luckily won't run on it, which is an implicit benefit).

Re:Is everything on the internet?

[itsthebin]

yes - that windows thing every single Plant Control System that I have used for the past 10 years runs on top of Windows. The PCS will be separated from the inter/intranet via a hardware firewall.

Re:Is everything on the internet?

[Anonymous Coward]

The last power company I worked for had a separate network for control. They did, however, have a Citrix client that could make a connection to a server on the normal network. The reason for this was that Email, Trouble Tickets, HR, time card, and various other functions of the job were done there. The control network was every bit as complex as an enterprise IT network. So even if a little social engineering and crafted attack got them to a PC, they still need the specialize knowledge of the control applications and an understanding of the control network. If I am in and do not know the username/password/port for connecting to the terminal server and the commands needed to toggle a relay, then the accomplishment is overstated. Is it still a security breach? Yes. But with an IDS in place and some firewall rules, it may take quite a bit of additional time to figure out how to impact anything. Even the summary acknowledged that they only made it past the first layer.

Re:Is everything on the internet?

[Firethorn]

TO be safe they have to (presumably) have a totally seperate downlink to get weather data directly into the military network - that has to be expensive!!

Expensive? Generally speaking the we have our own weather people and equipment. We'll often share data(two doppler radars are better than one), but half the data is coming from military equipment in the first place.

Re:Is everything on the internet?

[Inda]

I work in one of those corporate offices you mention and I chuckled when you said pencil and paper. The company intranet homepage displays generation...

I have Excel plugins for listing data from, I guess, 30,000 sensors on each of the dozen plants we operate. Data goes back years. I'm not special; anyone with a day's training can access the data.

I have graphical programs for displaying this data. All live. All customisable.

I cannot operate the plant from here, nor do I know of anyone else that can from their desk. That's the operator's job on the plant.

Re:Is everything on the internet?

[DrSkwid]

There's more to networking than IP, downloading data files and having them available across networks is entirely possible without giving away TCP/IP possibilities.

ATA over Ethernet is one such route, I'm sure there are more.

Re:Is everything on the internet?

[m50d]

Because of course databases never have buffer overflows.

Re:Is everything on the internet?

[hairykrishna]

I worked at AWE for a while. They have an internal network that's air gapped from the 'net. All email is handled via tape transfer between an inside and an outside server. Everyone runs thin clients apart from people who absolutely can't (CAD guys mainly); they run off desktops with removable drives which are locked in a safe overnight. Is actually much less of a pain in the ass than you'd think; you adjust pretty quickly to a 2 hour delay on your email.

Re:Is everything on the internet?

[DrSkwid]

Incompetent

There are non-routeable networking protocols that exist not just tcp/ip. It's quite easy really, just needs competent implementers.

Re:Is everything on the internet?

[Anonymous Coward]

In an ideal world, they'd have two PCs on each desktop. One on the internet, one on the SCADA network.

Solaris has some neat technology where you combine zones with Trusted Solaris on one machine.

One zone is a general public clearance, but you can have others that are SECRET and TOP SECRET. This even ties into the GUI, so you can one browser or text editor or e-mail client that can connect to the high security network, while others that connect to the low security ones. It even restricts cut-and-pasting between the the different levels.

Network access is handled via virtual interfaces for each zones, VLANs, and network labeling (CIPSO).

One machine, multiple security levels.

Re:Is everything on the internet?

[Anonymous Coward]

You can flow from the inside out securely, by the way. Or from one system out to both.

All you need is something one way only - say, an infrared LED on the transmitter (but no detector!) and a detector but no LED on the receiver. One way only.

This only works if the transmitter is the trusted side, though. You could transmit diagnostics from a secure, unconnected system to an externally accessible system (for reading by humans, presumably) that way, but not orders from the outside in, for the obvious reason.

Don't do this for real.

[Profane MuthaFucka]

Google can help you pick your target.

http://www.google.com/search?q=%40ercot.com&btnG=Search&hl=en&safe=off&rlz=1B3GGGL_enUS264US264

That's a search for "@ercot.com", and if you don't know, ERCOT runs the Texas power grid market. There's another one for the East grid, and another for the West. You can find them yourself.

Oops.

[Renraku]

An attack on a control point of the power grid could cause millions in damage if properly executed, and possibly lives from extended loss of power. I'd like to think the power grid has built-in protections to keep a 'bad node' from ruining several others, but it just might not..seeing as how companies build for economy before they build for safety.

Even something as simple as opening a few junctions could cause fireworks..take a look at some online videos about 'opening hot' for example..now imagine if that arc caught other pieces of equipment because the line was still energized.

Simply put, the power industry needs to step up to the plate and harden both their network infrastructure and their meatspace infrastructure against malicious attack.

Re:Oops.

[Ruke]

To be fair, there have been steps taken since the 2003 blackout to make the power system more reliable. With the Energy Policy Act of 2005, membership in the North American Reliability Council (NERC) has gone from completely voluntary to federally mandated. Failure to adhere to industry standards can carry a fine of up to $1 million per day. The CIP- standards all deal with cyber-security, and the EOP- standards specify what happens in an emergency situation - for example, a big node goes down, and initiates a cascading failure. Automated systems are required to be in place that will cut the power in such situations, leaving some people in the dark, but protecting the grid as a whole. Is the system perfect? No, probably not. A good social engineer could probably still weasel his way into a system. But steps have been taken to minimize damage in such a situation.

Re:Oops.

[Pastis]

seeing as how companies build for economy before they build for safety.

The funny thing is that building for safety would build for economy on the long run. A good example is nature. We are fairly resistant systems and we wouldn't have survived if not for it.

Re:Oops.

[Firethorn]

seeing as how companies build for economy before they build for safety.

I'd argue that building for safety is right up there, perhaps before economy even.

It's just that the power company's idea of safety != producing, delivery 100% of the time.

Electricity itself is dangerous. So the power companies do all sorts of things like install breakers to shut off the power if a potentially dangerous situation is detected. First is protect human life*, second is the expensive equipment. A fuse is cheap, even if it costs $100 because it's designed for 18KV@1KA compared to a switching station transformer.

Anyways, on 'possibly lives from extended loss of power.'

Anybody dependant on electricity for life should already have backups as necessary. If you're dependant on electricity to power a charger for your artificial heart, dialysis machine, breathing assistance device**, or whatever, you should have a generator, battery backup, whatever's needed. I mean, the way power delivery goes, local events can take out power to a house/business fairly easily, and are fairly common.

I think one guy with a medical problem requiring frequent access to electricity had the house hookup, a backup generator, and a 12V adaptar for cars.

*If nothing else, dead people tend to be REALLY expensive.
**Though I imagine simple pressurized O2 and an appropriately selected mechanical valve system should be able to eliminate the need for electricity for a good while.

Re:Oops.

[NatasRevol]

I think he was talking about people's entire lives depending on power.

Like all of Canada in the winter.

Re:Oops.

[Firethorn]

I'm in North Dakota. It ain't much different, I assure you.

One of the first things I did was get a second heating source that doesn't require electricity to produce heat. It wouldn't take much of an ice storm to take out serious sections of the grid.

Besides, lack of heat, even in Canada, isn't normally going to kill you quickly. Most people have vehicles that can be used as a heat source. More clothing can be worn, etc...

Re:Oops.

[Renraku]

The power system, at 'man level' is very safe relatively speaking. There are codes, systems, devices, etc, etc..all designed to keep people safe and then deliver power. However, once you get up into the thousands of volts and amps range things are different. Its now a matter of 'if this isn't wired properly this metal screwdriver will vaporize instantly and blow back into my face' and 'if the ground in this area is getting too much power, standing near it could be fatal' or 'if this line is opened hot and arcs to other lines, can they tolerate the extra power without melting everything down to the breaker'

The industry has even regulated (mostly with OSHA's help) those things to be as safe as possible.

When I say safety, I mean in stability of the grid.

Imagine, for example, that some fool goes and fires a thick chain into a substation. Chances are that it will contact multiple metallic surfaces that are energized, and will conduct power between the two. This has the potential of destroying expensive pieces of equipment at the site. If the power grid rolls a 1 on its save-vs-explode chcek, it could very well destroy equipment in both directions up and down the line, or even equipment at the power station itself. The system is VERY complex and it would take very powerful computers to be able to simulate things like this.

I would say that regulations need to be made to any switching station over a certain size or power rating that makes power companies harden the site against physical, network, and electrical attack/damage/etc. In return for that investment, the government could have a plan to help out those power companies in case of such an attack or natural disaster, etc.

Re:Oops.

[Firethorn]

When I say safety, I mean in stability of the grid.

And I'll say that stability or reliability would be better words than safety. You talk about safety and people think that failures lead to trips to the hospital and morgue. I was pointing out, that from a safety perspective, designing the system to shut down when it fails is a good thing, because that means 'power workers aren't getting electrocuted', or even better, that non-power workers aren't getting electrocuted because that downed powerline was detected and rendered dead.

After you assure that, then you can worry about whether or not you can reroute power and stuff to keep outages down. And yes, they're working on it.

Imagine, for example, that some fool goes and fires a thick chain into a substation.

Didn't mention it in my parent post, but I did mention the potential for terrorists playing with a buss bar in much the same way. You don't need to hack computers to shut down the grid. Most substations are only protected by fencing. A few people get themselves killed each year by climbing over the fence and either trying to vandalize or steal something.

free electricity?

[suck_burners_rice]

Why shut down the grid? Get free electricity! Joking aside, this reminds me of a true story I once heard. It took place sometime in the late 1940's and involved the British energy company providing free electricity to a factory, due to someone's connections with employees of the energy company. This continued for many months, maybe even a few years. They were never caught, as far as I know, and the story was kept secret by all those involved for at least two decades.

Re:free electricity?

[Anonymous Coward]

An unknown someone in Great Britain got free power for an unknown factory for an unspecified amount of time, because they knew another unknown someone at the unnamed power company. Sometime in the late 1940s.

No-one was ever caught.

Cops probably didn't have much to go on, really.

That's a great story. Delivery could use a little work though.

Re:free electricity?

[DrSkwid]

Since de-regulation of the power here in the UK, I get free electricity. Some guy comes and reads my meter and all the competitors for my billing leave it to the other.

Must be 10 grand by now, now that's a knock on the door I fear !

penetration-testing?

[Anonymous Coward]

How do i get a job as a penetration tester? I wonder what that interview would be like?

Re:penetration-testing?

[Anonymous Coward]

If an applicant goes to an interview, then he cannot merit the job.

In penetration testing, the successful applicant hires himself.

Re:penetration-testing?

[mr_walrus]

does the interviewer provide the test bed ? :)
if i'm wearing protection, did i really penetrate?

Re:penetration-testing?

[gnud]

I wonder how that works as a pickup line.
Hey Baby, have you been with an professional penetrator before?

Re:penetration-testing?

[ch_rob]

"Ira Winkler, a penetration-testing consultant"... So, what is he, some kind of freelance fertility doctor?

Re:penetration-testing?

[Anne_Nonymous]

If you can get onto the interview panel for your own interview, then you can have the job.

Re:penetration-testing?

[DrSkwid]

"I'm a network penetrator" has got me laid a couple of times (out of about ten).

Re:penetration-testing?

[Anonymous Coward]

Good afternoon prisoner 35782. I understand you're here for a period of 5-15 years for hacking into a secure government site. Suppose I told you we might be able to have you released early. Just sign this contract.

Re:penetration-testing?

[Anonymous Coward]

Thank you for making me not feel so juvenile.

That is quite possibly the greatest job title I've ever heard of.

Re:penetration-testing?

[scotsghost]

a couple of times (out of about ten).

Is that 20% of your attempts to use that pickup line, or 20% of your total sexual encounters?

Re:penetration-testing?

[DrSkwid]

20% of that line, or rather it's the line my female colleague introduces me as to other females "he's our network penetrator", 20% it's worked out well :)

Pfft..

[dartarrow]

Trinity did it in 3 minutes.

In Leather

Re:Pfft..

[AeroIllini]

Yeah, but she already had the root password.

I'm still hazy on where they got that password... maybe it was just floating around in the Matrix and Neo reached out and caught it. That makes as much sense as everything else in that movie.

Social engineering

[JayTech]

Social engineering, eh? Kevin Mitnick would be proud...

Re:Social engineering

[Lovat]

I hope I'm taking it the wrong way but incase I'm not:

Mitnick used social engineering . . .

At least if I'm remember it right.

Re:Social engineering

[JayTech]

That rephrase please? ;-) Sometimes it's better to make sense than dollars...

Call me paranoid,

[pitchpipe]

but this is why we have one of our operator's desktops totally disconnected from regular TCP/IP networks. It communicates to the rest of the system through PROFIBUS, which would be difficult to hack. If we need to run and all hell is breaking loose (virii, hackers, etc.) we just disconnect from the rest of the world and run. We will lose historical data and remote access, but if we're running the rest is just gravy.

If real hackers had done it...

[retech]

it would have taken a an hour and had a helluva goatsee up for all to see. It only took a day 'cuz they were union and had a power lunch and a massage appt. at 3pm.

amateurs

Re:If real hackers had done it...

[Anonymous Coward]

Getting paid loads of money makes them amateurs?

Re:If real hackers had done it...

[Anonymous Coward]

I don't think you've watched War Games 2: The limits of the writers' understanding enough times today. You have a quota to fill, fanboy.

reflected xss in article

[Anonymous Coward]

If you are reporting on security topics you should really make sure your web app is secure.

http://www.networkworld.com/news/2008/040908-rsa-hack-power-grid.html?page=2-XSSHERE-

-EvilPacket

Fire Sale. Go, go, go!

[Anonymous Coward]

Time to Live Free or Die Hard.

By the power of Grayskull...

[Bob54321]

He better of said "I have the power!" when he finally had access to everything.

Re:By the power of Grayskull...

[trouser]

"of" is not a verb.

Re:By the power of Grayskull...

[Anonymous Coward]

He's right, have course.

Re:By the power of Grayskull...

[johannesg]

I believe the mafia thinks differently.

Re:By the power of Grayskull...

[Anonymous Coward]

better have said*

when you type this stuff, read it back to yourself with the definitions and usages of the words in the forefront of your mind

Re:By the power of Grayskull...

[Colonel Korn]

Have you ever tried to read Middle English? What about old English? Language will always change over time, but the more that people like you are sticklers for good grammar, the more likely it is that people in 600 years will be able to effortlessly read our very familiar language.

Kudos.

Re:By the power of Grayskull...

[trouser]

Most US Americans ..... like such as ..... the Iraq.

Re:By the power of Grayskull...

[pipingguy]

Yeah. "could of" is not a simple mispelling, it's fundamental ignorance of the language.

http://grammartips.homestead.com/couldof.html

Best Job Ever

[SmlFreshwaterBuffalo]

"Trust me baby, I'm a professional. See? It says so right here on my card -- Penetration-Testing Consultant."

Ira Winkler?

[drakyri]

There's a nice feature on Ira Winkler in attrition.org's charlatan file:

http://attrition.org/errata/charlatan.html#winkler

Re:Ira Winkler?

[SomeoneGotMyNick]

There's a nice feature on Ira Winkler in attrition.org's charlatan file:

http://attrition.org/errata/charlatan.html#winkler Yes, that about sums it up. I used to work with the guy about a decade ago. Or at least I reported to him on occasion. He does know a lot of stuff, but as the Attrition article states, you don't necessarily have to ask first to find that out.

Same problems since 1980

[Anonymous Coward]

I think the same problems exist that were around in the 1980's and nothing has been done about it, you could read all about them in text files on old school BBS systems.

I could do it in less than 1 minute with only a steel ladder. There is definitely a lot of room for security improvement in this industry...

(although thank you PG&E for the quick response times when people kept rupturing the gas lines near my house)

Security Measures

[Ihmhi]

I should hope that critical things like "TURN THE WHOLE POWER GRID OFF" are not even on a secure server. They should be on terminals that are not even connected to the Internet, much less networked to anywhere else in the building.

It's awfully difficult to hack something when it isn't connected to the Net. Even simple security like multiple checkpoints, a keycard, and several biometric scans (as well as regular, and often, virus and spyware scans) to get to a secure terminal would go well towards protecting the security of our power networks. Hell, post a guard nearby who isn't incompetent.

The one thing Social Engineers/Con Men fear most is challenges - and by challenges, I mean challenges of authority. PROVE you are who you say you are. Check their records against a secure terminal or a hard copy of an employee roster. If anything is remotely fishy, no matter how "important" they say the work is, don't let them past you.

Vigilance is the key, and far too many critical parts of our infrastructure still fail at it to this day.

Re:Security Measures

[IKILLEDTROTSKY]

agree competent guards is a must, but also workers too. As a guard for a ware house that let a ton of questionable things go through, it really comes down to what the guards incentive is. most violations seem to be that the guard doesn't care. he wont get a bonus for stopping someone and if the place blows he won't get blamed.

Re:Security Measures

[luciddr34m3r]

Unfortunately it is never practical to maintain an air gap. If you rely on an air gap for your digital security, you are going to get royally screwed when someone brings in a wireless router or something and bypasses your entire security mechanism. Even the government's classified computer network gets bridged with the normal tubes once in awhile.

Re:Security Measures

[HexaByte]

It's NOT just "TURN THE WHOLE POWER GRID OFF" that you have to worry about. The power grid automated when no one worried about computer security, and they still have that old infrastructure in place.

How would you like it if the hackers got into the grid control system and told the IP motors that control the floodgates on the big dams to open all the way, and then send them into a tizzy that burns them out, so they can't be used to shut the gates? How much damage would the downstream flooding cause?

Or how about the test the DHS did, where they gave a generator a command to generate power out of phase with the network, causing it to physically self-destruct? It only takes a few tings like this to screw up the country big-time! And it doesn't have to be done on site, it can be comfortably done from the safety and security of your ChiCom hacker network (they've been walking all over our networks for years) or your zombie bot-net.

I've been sounding the alarm on this for years, (although many others have been doing a far better job, don't want to take credit for others work) and finally the industry is responding. It will take billions to correct it in the US, Europe and Far East, while some poor countries don't have the financial means to do it at all.

Re:Security Measures

[necro2607]

How would you like it if the hackers got into the grid control system and told the IP motors that control the floodgates on the big dams to open all the way, and then send them into a tizzy that burns them out, so they can't be used to shut the gates? How much damage would the downstream flooding cause? Yeah, no kidding. Imagine what would happen if that occured with the Three Gorges Dam in China... Woot, 39,300,000,000 cubic metres of water suddenly dropped on your cities! ...

Re:Security Measures

[PontifexPrimus]

The one thing Social Engineers/Con Men fear most is challenges - and by challenges, I mean challenges of authority.

Unfortunately, in the current climate of fear and obedience, it is very hard to get people to challenge authority - especially if even the government takes refuge in FUD and secrets. "On whose authority are you doing this?" "Sorry, can't tell you. Terrorism, you know. You could call the CIA, but they would deny ever having heard of me."

Re:Security Measures

[tetranz]

I'm told that if a power station is connected to the grid out of phase, the turbines remain stationary and the rest of the station rotates.

Re:Security Measures

[Critical Facilities]

Unfortunately it is never practical to maintain an air gap.

Bullshit. I've worked at several MAJOR data centers with fully integrated Building Automation Systems which were completely separated from the companies' intranets and from the internet. You must bear in mind that this type of security protects BOTH sides. That is, in addition to protecting the B.A.S./SCADA system from outside attack directly, it also prevents someone from being able to access the SCADA system and from there, hack into corporate intranets.

Re:Security Measures

[luciddr34m3r]

Well from the reports of penetration tests I've heard, many places do claim their systems are not connected to the internet, the gap has been bridged by someone, be it management or whomever. Someone above said he's heard of people bridging the networks with IR interfaces. When I interviewed computer security professionals at local power plants for me research on this topic, I was told people connect things to the network all the time that are supposed to be isolated. Even the government's classified network gets bridged to the internet from time to time, and there are strict regulations on the air gap for it. Maybe your companies actually maintained an air gap, but if your entire security method is compromised when someone accidentally plugs something into the wrong port on the wall, you've seriously failed in your duties for security. If you protect it like its on the internet, even when an accident happens and its plugged in you'll be protected.

Re:Security Measures

[Britz]

And again, why are those critical things controlled by a networked computer? A flood gate system controlled by a Windows 98 machine and the guy working there is surfing warez sites? Why? He can have a laptop to surf his warez sites.

Again: Why do computers that control critical functions need to be connected to the internet?

Re:Security Measures

[AK Marc]

Again: Why do computers that control critical functions need to be connected to the internet?

They need to be connected to a network. Generator A needs to know what Generator B is doing. They need remote connectivity. Power Plant A needs to know what Power Plant B is doing. They must be networked for proper operation. No one is saying that the critical computers are given public IPs and are unpatched consumer Windows 95 machines with no firewalls. But "Internet bad" isn't a useful directive. Does that include if they are networked and can get to the Internet via a firewall? How about if they are networked with a separate network and can't get to the Internet at all, but are on shared switches separated by VLANs? They are physically connected to the Internet, but can't get there, unless someone makes an error in configuration or an employee makes a simple change. If they are on dedicated hardware the whole way, then they can't physically get to the Internet and someone would have to lay cables or such to change that. Where do you draw the line? Physical connectivity through shared switches would be OK with you if they can't get traffic to or from the Internet? What do you do for the issues of interconnecting the plants together? Leased lines for everyone? Keep in mind, the number one manner of remote access is social engineering. Yes, a human is more likely to think when someone tells them over the phone "turn your plant off" but the computers can still be remotely controled by unauthorized people by calling and saying "do this" or "tell me that." If you want them isolated, employees should be banned from using the phone at work. Most people consider that silly, so there is some line to be drawn. The "even thinking of that is stupid" attidude is unproductive and often destructive. Solving problems takes more than listing what's bad. In fact, a list of what's bad often leads people away from solving problems and on to blaming and complaining that makes the problem harder to solve.

Prevention is easy, don't network the systems

[Anonymous Coward]

The subject says it all. Just don't network systems that are so damn important to the fucking Internet or networks you don't trust. Why is that so complicated for people to understand? Sure you lose the Internet's utility and access to some of your internal resources, but on the plus side, the power grid to thousands/millions of customers is secure. The only desktop that should have access to this kind of network should be the desktop of the engineer maintaining the system.

If they really wanted to protect the grid...

[Anonymous Coward]

They'd post armed patrols out in the mountains..even then good luck.

Why the hell would someone go to all the effort mucking around with computers and hacking and leaving evidence everywhere when they could just go buy a gas axe from the local hardware store and knockdown a few of the big towers and cause havoc for days...and have about 0% of getting caught to top it off.

I was 4wding up in the highcountry near my city the other weekend, driving along the maintenance tracks for the big lines that run from the hydro electricty plant to the city. A gas axe to a few of the supports and you could cut power to the city in an hour. Choose the right towers, remote and hard to get to and it could be out for days. The big lines run through the rugged and isolated mountains for about 100kms (60miles)...good luck stopping someone motivated doing that.

And yet, no one ever has..perhaps, just perhaps there isn't bogey men trying to get us hiding around ever corner?

These 'security experts' that seem to be cropping up left, right and centre these days crying about how unsafe and insecure everything is seem to be little more than a new incarnation of snake oil salesmen.

Rediculous.

Re:If they really wanted to protect the grid...

[Anonymous Coward]

4wding?
Gas axe?

What part of Oregon are you from?

Re:If they really wanted to protect the grid...

[Anonymous Coward]

These 'security experts' that seem to be cropping up left, right and centre these days crying about how unsafe and insecure everything is seem to be little more than a new incarnation of snake oil salesmen. So you're saying security systems are digital snakeoil? Wow, you have some balls. Just because there is a easier attack vector to achieve the same goal doesn't mean the other attack vectors do not deserve to be fixed.
Frankly you have more chance of capturing someone with and axe to a tower then you would with some Anonymous cracker from a country outside of your jurisdiction. At least it is legally possible to charge them if it's done on-site.

Re:If they really wanted to protect the grid...

[Tarantulas]

Earth First tried this back in the 1980s with the Palo Verde Nuclear Generating Station in Arizona. First they grounded out some of the transmission lines, and then a few years later they tried to topple a transmission tower. In the first case they forgot to ground out all of the lines, so power to the plant was still available and the event was little more than an inconvenience. In the second case their group was infiltrated by the FBI, who arrested them in the desert before they could do any damage. Even if they destroyed one transmission line, there are ways to route the power to the destination using alternate paths. The best thing for a terrorist to do...will not be posted here by me. They have too much help already.

Thats nothing

[timmarhy]

I hacked a kebab in less then 30 seconds.

How exactly did they do it?

[Bromskloss]

That would be the interesting info here. I don't really know why this gets published (on Slashdot!) when there is know specifics available.

Here is a "sane" security measure

[johannesg]

Disconnect the damn control network already. It will be much harder to break into when it is not physically connected to the internet.

Re:Here is a "sane" security measure

[robot_lords_of_tokyo]

There is no excuse for that. Incompetence on the design level, as well as the enforcement level...Probably worthless auditors as well...

Re:Here is a "sane" security measure

[chaoticgeek]

I'm kinda confused by this too, why is the power grid on the Internet? Seems like a very illogical thing to do in my opinion. I think they would have two networks in each building, one for the power grid computers and controls and one for anything that needs access to the Internet. If something has to be transmitted to another building either they need to lay down some sort of infrastructure or use SneakerNet...

Re:Here is a "sane" security measure

[kestasjk]

I'm sure they have a good reason for it; they're not stupid

Re:Here is a "sane" security measure

[Anonymous Coward]

Generous electricus requires this so they can sell data about power plant operations to the power company. They connect through a vpn.

Re:Here is a "sane" security measure

[somersault]

I'm sure they have a good reason for it; they're not stupid Haaaaaaaahahahahahahahahahaaaaahahahahaa! xD good one

Re:Here is a "sane" security measure

[Anonymous Coward]

SCADA is a classic case of an internal, insecure system being stuck on the net for convenience's sake and everyone pretty much just hoping it wouldn't get hacked. It's surprising there haven't been more compromises (that we know about at least), there are thought to be a lot of vulnerable systems out there. Only one I can recall offhand is when some disgruntled ex-employee of a water treatment plant drove up, accessed their open WiFi and dumped a load of sewage into the river.

Re:Here is a "sane" security measure

[borgboy]

Money. Why else? Private networks are more expensive than plugging into the ol' tubes.

Doesn't make it right. I'm not defending, just pointing out the obvious reason.

Re:Here is a "sane" security measure

[Anonymous Coward]

No, it's not illogical, it's obvious. Connecting control computers over the internet - possibly via a VPN is easy and cheap, building separate infrastructure is expensive. Now tell me why a company that's in it for a profit should go with the latter?

Re:Here is a "sane" security measure

[knightri]

This is how it works. Redundant controllers with redundant ethernet/fiber connections integrate control for the power plant. New designs phase out the coaxial DCS highway for a more robust Cat5/6 one. All of these controllers, whether we have multiple turbines or a single one are tied together with normally Cisco branded network devices. The network is normally cut off from the rest of the world, obviously. However, the customers, IE the owners of the power plant, sometimes want access to data points and trending graphs from inside their corporate networks. In these cases a DMZ router is utilized to bridge the gap from the internal DCS to the outside world. So an attacker needs to penetrate the corporate security, then the DCS firewall to gain access to any information.

Re:Here is a "sane" security measure

[geminidomino]

Now tell me why a company that's in it for a profit should go with the latter? So that the control system can't be pwned by someone on AOL?

Re:Here is a "sane" security measure

[Anonymous Coward]

Any power company worth its salt has two completely physically separated networks, so that this exact type of situation is avoided. The one mentioned in the article is an utter failure in this department; there is *no* reason compelling enough to connect your SCADA network to your everyday network and risk a security breach.

Re:Here is a "sane" security measure

[Anonymous Coward]

the control network is not connected to any sort of internet at all. there is a data transfer system that uses a closed tunnel to report diagnostic information. anything done to the grid is done from within the control room and by at least 2 people. remember kids, the power grid was designed before the internet existed or was even thought of. the entire inner workings of the electrical system in the US today were designed with a 1950's era mentality. it takes 2 men on opposite sides of the room turning 2 keys simultaneously to open the hatch for the emergency shutoff switch. absolutely nothing is controlled by a computer thats connected to the internet. in fact, any computer that controls anything (even just machines that measure and pass along statistics) are custom hardware running custom software. and again, they are sandboxed and connected only to an internal network that's piped along secured physical lines.

there's no "hacking" the grid kids, sorry to disappoint. if you want the lights to go out for good you need to gain access to the control room and have detailed knowledge of electrical engineering and more than a little insight into that particular power company's setup--in short, it won't happen.

chock this whole thing up to yet another sensationalist article on /.

Re:Here is a "sane" security measure

[Sleepy]

>I'm kinda confused by this too, why is the power grid on the Internet?

Cost.

In a lot of cases, you have the power company desktops on the Internet and they have their own lan for desktops etc.
But then those computers CAN access the critical systems.
Then they slap a firewall or VPN inbetween the desktops and the critical systems... wow, it's magically OFF THE INTERNETS!

If you disconnect the two LANS, you're much more secure, but then Lazy McFatass has to WALK to a boring green screen to manage it.

It's much cheaper and employee friendly to just let these people access the secure systems from their desktop, using a remote terminal. Very sad, but true... and very risky.

Remember, it was poor desktop security and a WINDOWS VIRUS that knocked out the US Northeast power grid some 5 or 6 years ago.

Re:Here is a "sane" security measure

[dextromulous]

I've written code for SCADA (just the DA part, and mainly for substations) in electrical utility industry. In the customer sites I've had to deal with, the data goes through one of two channels:
1) Dialup modems straight to the substations
2) Leased lines + VPN, so only people inside the utility have access, even though it is on the Internet
In this case, it appears that either of those could have been breached, since it was a computer inside the utility that had been compromised. Physically disconnecting the boxes from the Internet would do no good, since you can't use them when you need to! Different lines at substations need to be connected/disconnected all the time, and it is not feasible or any more secure to have someone physically go out to the sites to deal with it. Not only that, but when something goes wrong, you need to have instant notification that there is a problem, as some of the sites may involve a 4 hour drive.

Re:Here is a "sane" security measure

[chaoticgeek]

I get the cost part but still does not give you very nice security. Anything on the internet is quite open to anyone who works enough and knows what they are doing. So the point of security over employee friendliness becomes an issue you should sit down and think well what would happen if this happened, or this or that?

All I'm saying is even for the cost and ease of use of having it connected to the Internet the security for something like a power grid still out weighs it.

Re:Here is a "sane" security measure

[IcyNeko]

or skynet.. :o

Re:Here is a "sane" security measure

[dpilot]

Recently I had the opportunity to talk with the sysadmin for a major power utility in my state, and to be honest I felt much better for having done so. I went into it with a very Slashdot-like unpatched-Win95-on-the-internet attitude, and came out with considerable respect. Everything the guy said was consistent, and gave a good, concerned, somewhat paranoid sysadmin attitude, the kind you'd like to see.

Our SCADA is almost entirely on private links, with the remainder on leased lines. None of it is routed over the Internet, VPN or no VPN. There is a related protocol, ICCP, which allows different companies to "talk" with each other. Some of that system does go over the Internet, all over VPN. But more important, the data itself is screened, so even if you found a MITM attack, you couldn't declare playtime. As for the Internet and the rest, they're carefully separated, and any common points are well secured.

OTOH, he talked of going on an audit trip of some other power facility. The audit team recommended running one of the links through a firewall system, among other things. Later he took a look at some of the implementations of the recommendations. The ethernet cable came into a hole on one side of the firewall system, and went out a hole on another side of that system. It "ran through a firewall."

Re:Here is a "sane" security measure

[jafac]

There can be only one explanation for why power grid control systems are accessible on the Internet.

A catastrophic failure of Requirements Analysis.

Re:Here is a "sane" security measure

[arminw]

..Disconnect the damn control network already...

Indeed, why does some secretary or even the CEO at the power company headquarters need to know how many amps some generator 100 miles away is currently generating? There should never be *any* conceivable electronic path from the Internet to the SCDA systems.

Re:Here is a "sane" security measure

[Anonymous Coward]

That is a little cynical. Control Systems are fairly complex. Maintenance personnel don't always have the skills to be able to fault find the PLCs, and the engineers aren't on site 24/7. So when there's a major problem, the electricians ring up the engineers who can diagnose and fix the problem from anywhere in the world. This saves a hell of a lot of downtime and is pretty safe when the corporate domains use SecureID or an equivalent for their VPNs. It jsut breaks down when Joe Schmuck decides he's a networking guru and installs his own Control System domain and firewall.

"corrupting browsers"

[Anonymous Coward]

corrupting browsers on a power company's desktops

No name mentioned, but I think I have a good idea ;-)

Machines run Windows

[pembo13]

Not that other operating systems are perfect, but from what I understand, some power grids are mandated to run Windows on as many of their systems as possible - ie. the technician/engineers are not allowed to evaluate what OS best meets their needs.

Re:Machines run Windows

[dave562]

That was my very limited experience with Honeywell and two seperate power plants. All of the Honeywell software only ran on Windows. It was ugly stuff. All DCOM based and installed by grey haired guys who didn't know anything about security and only cared about passing data back and forth to the sensors and controls.

I'm doing some research...

[luciddr34m3r]

I'm actually doing an undergraduate thesis on computer security and critical infrastructure. It really is shocking what kinds of things you can do on these "critical" systems. It's a big combination of things causing such a headache. The big problem is that these computer systems were not designed with the internet in mind. SCADA systems that control physical systems over a wide geographic area were built before the internet even existed. That means there's poor authentication, and little security at all (and no encryption to boot). This is all very bad, HOWEVER I have been quite pleased that everywhere I have been so far, apparently I'm on the heels of the DHS who are actively investigating these weaknesses, and lots of federal resources are being used to bring these standards up. Yes its bad. Yes its getting better. No its not ever going to be good enough.

Why so long?

[Anonymous Coward]

In 2000/2001 I took a look around the LAN of GE. General Electric had power substations(as well as several pieces of medical equipment, including an X-ray machine that could be calibrated remotely) with admin pages available over HTTP and vulnerable to null password authentication(and a few other misc things that didn't require any auth at all.). Here's the kicker: GE owns 3.0.0.0/8, and it was all visible to the world.

I don't know if this is the case now, or remember specific hosts that were vulnerable, but I can tell you that if you go looking on 3./8, you'll find interesting shit, and if you lift a laptop from a GE work vehicle(atleast a GEMS(General electric medical systems) laptop), VPN information is cached on an unnencrypted windows partition, and if you're on the VPN you can hit nearly every machine. I can also tell you GE laid off hundreds of techs responsible for managing GEMS, and they were already hurting... I can just imagine what it looks like now.


-AC to save myself from the lawyers.

Seperate networks?

[ludomancer]

Why do we keep critical networks connected to the rest of the net? Why don't resources like these, and the governments, set up proprietary networks that are inaccessible from the global internet base to prevent these sort of things? I never really understood that.

Re:Seperate networks?

[necro2607]

Actually, the particular machines that control the resources are very very probably not online. However, other machines with access to their intranet/LAN are. Get yourself control of one employee's machine and you are then effectively sitting inside the office, with the same level of LAN access as the person whose machine you've gained access to, theoretically...

yeah, where's the blackout

[davek]

unnamed this, coulda-done that... My problem with these grey hat hacks is this:

if you didn't actually take down the grid, how do you know with absolute certainty that you could have finished the job?

From TFA, this is what we have:

the server downloaded malware that enabled the team to take command of the machines. "Then we had full system control," Winkler says sure, buddy. Right. How did you know? What did you try to do? What was the last step where you decided NOT to press "Enter"?

I'll wait until someone actually has the gonads to bring down the system, and then use the "I told you so" argument to prevent being totally raped by the authorities. In other words, we need a sacrificial lamb.

Any takers?

Re:yeah, where's the blackout

[necro2607]

It's a good point - perhaps if they had attempted to start some shutdown sequence, there would have been password prompts, or who knows what.

They might see the full interface that a full admin might have, but if the system was even half-decently-designed, the developers/designers would probably attempt to make it so sitting down at one of the control machines doesn't just give you the immediate ability to shut down everything...

So the Fuck What?

[EdIII]

Nobody would ever, ever, ever take down the power grid. Do you realize the implications of such an act? Screw 9/11 .... We are talking about PORN here. Hundreds of thousands of men that get off work everyday, all at different shifts, and have their pants around their ankles within 10 minutes of being home.

You turn the power off, you take away the porn, the air conditioning for the cold beer, the TV to distract you from your bullshit. You force men to deal with that and I predict a couple hundred thousand men rabidly searching for whoever was responsible for THAT.

Bin Laden has not been found yet, the idiot that takes out the power grid will be found in 30 minutes.....

Re:So the Fuck What?

[Anonymous Coward]

Although the above is funny I think it should be modded insightfull.

Re:So the Fuck What?

[imyy4u1]

"We are talking about PORN here. Hundreds of thousands of men that get off at work everyday"

Fixed it for you.

IMHO

[onion_joe]

apply similar tactics to Real Life situations as you would to computer to computer transictions.

Depending on the level of security required: a combination of all post, contextual transmissions, one time keypads, PGP encryption, ROT 13, plain text.

Yes, compputers and people are different. These are the best encryption techniques, in order of security, to date.

Security is not just computers, it is a constant in all possible 'power based' scenarios.

and thats my $0.02

I don't doubt it at all.

[necro2607]

I don't doubt it at all. Many, many businesses running important systems and infrastructure are no more secure than anywhere else. And that security "everywhere else" is basically a lack thereof.

When you think about it for a moment, these kind of key things could be successfully attacked and shut down no problem. It's never been otherwise. There are people that just love to break into systems, and it's obvious that some of those people inevitably have far more destructive intentions than simply "penetration testing". I mean, I guess it doesn't get a lot of attention because no one's really done a major attack that has had drastic immediate effects (like shutting down the power grid). Frankly I'm amazed something of a comparable scale hasn't happened - but I guess people with those intentions are probably pacified by the fear of being thrown in jail forever...

Dunno, just growing up in quite a high-tech age, I'm amazed electronic break-ins and destructive vandalism aren't happening notably regularly...

The kind of orchestrated attack mentioned in TFA is definitely not "rocket science". A few talented people could pull off major hacks with a pretty trivial level of effort, especially considering all of these networks that run just plain old Windows XP or 2000. Get some clueless data-entry person to "open the important security update i'm emailing you", whee, you're in, have fun. Even in places with pretty strong security policies, you can never really secure your network from weaknesses and variability of the human mind.

It's not even some action-thriller-cyberpunk movie, I'm sure it could happen at pretty much any time - and it doesn't have to be some foreign intelligence agency - it could just be a couple of teenagers who are super pissed about [whatever] and have the know-how and drive to do it.

Hilarious editorial problem

[Dekortage]

From the article: "In addition to consulting, Winkler is author of the books Spies Among Us and Zen and the Art of Information Security."

(italics in the original)

Spies Among Us and Zen? Can't wait to read that. And: "Hi, I'm Art. Art of Information Security." Or maybe that is a coffee-table book of famous paintings reimagined through security logs, Matrix-style.

die hard

[keirre23hu]

I'm not impressed, the bad guy in the last Die Hard took down the grid in a couple of minutes..

Re:die hard

[Anonymous Brave Guy]

Bah... If you can't do it in under a minute while a gorgeous girl is <ahem> distracting you and John Travolta is holding a gun to your head, you're no-one.

Re:die hard

[gnuman99]

Yippie-kai-ey, motherf****ers!

(if you don't get it, see last Die Hard!)

Unnecessary:The Cylons have been gone 40 years now

[boombaard]

Commander Adama: "It's an integrated compter network, and I will not have it
aboard this ship!"
Secretary Rosalyn: "I heard you're one of those people... you're actually
afraid of computers."
Commander Adama: "No... there are many computers on this ship. But they're
not networked!"
Secretary Rosalyn: "A computerized network would simply make it faster and
easier for the teacher's to be able to teach..."
Commander Adama: "Let me explain something to you...
Commander Adama: "... many good men and women lost their lives aboard this
ship, because someone wanted a faster computer to make life easier. I'm
sorry that I'm inconveniencing you or the teachers, but I will not allow...
a network computerized system to be placed on this ship while I'm in
command. Is that clear?"

I for one welcome our new power grid overlords

[yidele]

....but seriously, folks, what kind of a utility company would have NMS access and internet access on the same machine? Social engineering my ass, proper utilities wouldn't have internet access on a machine that controls anything that matters.

Re:I for one welcome our new power grid overlords

[Wuul]

Don't worry: Bruce Willis and Justin Long will soon get everything back online again...

Re:What kind of oversight do Loyal Bushies give???

[robot_lords_of_tokyo]

It's too easy to blame it on lack of oversight from regulators. The prime people that are responsible for this are the people that run the company, and to a lesser degree, the people that work there.

cripple the internal network?

[keirre23hu]

The SCADA network is not designed for browsing the internet. It should not be connected.

Security through dis-connectivity is a dangerous myth in most cases. In some cases, say military situations where you are willing to absorb the huge cost to re-implementing a complete replacement for just about every dang thing you might need on the inside (e.g. weather data, or radar data, say) then it may make sense. In just about every realistic corporate case - even power companies - its likely to only cause people to take their eye off the ball of implementing real security and proper firewalls etc. You make a good point here, but I'd argue that, for National Infrastructure Issues (including the power grid), the same security expected of the military should be required. These systems are just as critical. One of the primary diffrentiators between the modern world and the third world is the ability to provide reliable utilities. If the grid went down for any length of time on a national scale.. umm.. it would be a big problem.

Well...

[keirre23hu]

If they have access to the desktops, whats to stop them from installing a keylogger or screen monitoring application or network packet capture utility to grab passwords and all matter of other data.

willful negligence

[Anonymous Coward]

Because running Windows there is bad enough, it's willful negligence. So to cover their asses, they want to must be sure to really foul things up by connecting the whole compost pile to the public Internet so that when it goes down they can claim plausible deniability and blame 'evil hackers'. Everyone will then accept that it is an 'IT' problem not a power grid problem, the Microsoft Effect kicks in, and everyone agrees that nothing could or should be done and people get used to brown outs and blackouts.

revisit the question: why is the grid on the net?

[Anonymous Coward]

i don't work in the power industry but if i put myself into the very greedy, naive, stupid shoes of a corporate C.E.O., I would guess that most of the big wigs would be demanding network connectivity so that they could sell performance and distribution metrics to data collection agencies, or for statistics collection purposes. i'm thinking they retain this data for their own logistical accounting and tech support ... probably looking for power spikes, brownouts, etc ... i'm not sure of the types of agencies that would pay power companies for this information after the fact, but the general rule is if you can write it to disk, then it's probably worth something to someone somewhere. obviously, having said infrastructure available on a wide network is valuable to these people if for no other reason than the sheer convenience of ready access.

i do agree with the proposals to take power infrastructures off the net but you have to remember that all of their IT guys are sucking for some promotion telling their bosses how their cisco firewalls provide perfect security and that there's no way an intruder could possibly get through ... = \

Call us when you get into the billing system...

[jpellino]

...then you'll have our attention.

breaking news

[spaxxor]

Something is easily borken

Not Usually connected

[dj245]

This is the way it is in most power stations. In the two that I worked for, one was out in the sticks and didn't have DSL. The chief engineer had a shotgun in his office for copper theives and other troubles.

The other one I worked for had a wal-mart non-wireless router for the internet. All the control equipment was hooked up to redundant dedicated switches. The control computers were not connected to the internet router in any way.

Unfortunately, that level of skill wasn't *needed*

[Anonymous Coward]

Posting as an AC (can't login while I'm at work) this will probably never make the +mod list, but I couldn't let this comment pass...
        I used to work for a utility / distribution company as a business analyst. With a background in network and software security, I habitually notice security holes...with a background in being a "good guy" I habitually report them. while working at said utility company, I pointed out vulnerabilities in their tracking system, internal reporting system, and their internal problem resolution system.
        I brought up the issues to my manager as well as the IT director. Both of them basically said (and in one case literally said) "Have you told anyone else about this? Please don't, we can't fix it." In this case, I pointed out to my manager that his password was (insert password here), and that I could find out the password to anyone on the system, as could anyone who used the system. Ironically, I noted that he changed his password the next day.
        With utilities that big, they have such inertia, that it takes *forever* for any change to happen, to include technological innovation. On top of that, they promote based on longevity rather than merit (no bitterness here, this was *explicitly* stated to me at my time of hire), so any person in a field office has a shot at management...which doesn't always get you the most qualified people making the best decisions.
        I really don't see this changing any time soon, sadly.

not designed with the internet in mind ..

[rs232]

"these computer systems were not designed with the internet in mind. SCADA systems that control physical systems over a wide geographic area were built before the internet even existed"

I assume you mean by 'these computers' Microsoft Windows, and Windows was most certanly designed for the Internet and security at the very least from Windows NT. Connecting these 'computers' through the Internt was an economic measure, designed to save on maintaining a private network. What's mind boggling is that they are still connecting such 'computers' to the Internet in 2008. Have these 'computer' professionals learned nothing since the Blackout of 2003. See also SQL virus takes down Nuclear Power Plant SPDS system.

Re:not designed with the internet in mind ..

[luciddr34m3r]

I mean SCADA systems and Digital Control Systems. Sure, now even more computers are controlling these things, like windows desktops, but they are interfacing with the old control system usually. If the control system had good security, it would be much less important that they sit on the internet. Maintaining an air gap and keeping the computers off the internet is a nice thought, but its just not going to stay isolated.

Re:not designed with the internet in mind ..

[rs232]

"now even more computers are controlling these things, like windows desktops, but they are interfacing with the old control system usually"

The problem isn't with the 'old control system' but with the 'computers', the one that was/is designed with Internet security in mind, that is precicly where the problem lies, as the main article so succinctly demonstrates. Where they had full effective control of the system within minutes.

"Maintaining an air gap and keeping the computers off the internet is a nice thought, but its just not going to stay isolated"

The main reason they *still* use the Interent to relay SCADA traffic is, that it is cheap. It is possible to connect to the Internet and have security, an embedded OS running on a private VPN is once way. That way you wouldn't have to worry when some 'virus' comes knocking on some port.

It's mind boggling that they *still* have Windows/SCADA units directly connected to the Internet. Considering the scare in the immediate aftermath of 9/11 and the blackout I previously mentioned. Has time stood still in the last eight years?

"What if the attackers were able to compromise systems monitoring the water supply for Manhattan?"

no guesses for what OS ..

[rs232]

'They sent the workers an e-mail about a plan to cut their benefits and included a link to a Web site where they could find out more'

'When employees clicked on the link, they were directed to a Web server set up by Winkler and his team. The employees' machines displayed an error message, but the server downloaded malware that enabled the team to take command of the machines.

"Then we had full system control," Winkler says.

"It was effective within minutes."'

Any guess as to which Operating System this malware runs on ..

Double Pfft..

[TubeSteak]

When she gets that down to 60 seconds,
with a gun pointed at her head,
while receiving oral sex,
you let me know.

Anecdote about tiger teams

[br00tus]

I know someone who worked as a consultant for a tiger team of a Big Four accounting firm. He also told me the batting average his particular team had - they batted 1000. They always got in, every time.

Even with that, he complained about how his hands were tied during these penetrations - the team had permission to probe the security of the said company, but he wasn't able to say break into Microsoft or Sun or IBM and learn about unpatched bugs, or break into the local Bell company and reroute or monitor calls and circuits of the company, things he had been able to do in days when his "hat" was less alabaster. Another friend of mine, who had also switched hats and was working for a large consulting company used to complain how what he was doing was cookie cutter - they would install vendor-approved patches and the like, but were not actually securing the systems from stuff floating around in the wild which had not been patched yet. He used to go against company policy and fix stuff not on his checklist anyhow.

Connected to the net? Why?

[BraksDad]

My company sells control systems to utilities for operating their power plants.
The system is sold with the hardware and... there is not connection to the internet.
It is a segregated system that stands on its own.

Why would you need to connect it to the internet or even a modem?

tape backups and/or DVDs of the operating data are moved from the control system to the back office, but it is a one way communication OUT of the control system.

Software upgrades happen rarely at best.

In order to support our customers we maintain copies of their systems down to the OS and patches. We have a mimic of their plant in our labs. Old operating systems and all. Why bother with security patches when your server and 4 PCs are not on a network?

Take it a step farther

[Gription]

Actually the USB drives don't even fall under the heading of 'Social Engineering'. Social engineering involves communicating with someone. The only way it could be social engineering is if you are interacting with your hardware on WAY to much of a personal level.

Re:Take it a step farther

[PitaBred]

Say what? Social engineering is taking advantage of social behaviors. People will look at a USB drive... it's exploiting their social behavior, whether it's curiosity or altruism or what, it's still social engineering if you use their behavior to accomplish your ends.

pr0n

[Vexor]

>>>>Ira Winkler, a penetration-testing consultant With a name and job title like that you'd think he worked in a different industry...

Finally!

[sxltrex]

Finally, someone states the obvious: it's a hell of a lot easier to physically attack the grid than it is to break into the network, figure out how to operate the custom SCADA system (and they're just about all custom), then figure out how to operate the grid in a way that will bypass all safeguards and cause a cascade event.

If I were a terrorist, I'd just lob a grenade over the chain link fence into a big substation.

Re:Finally!

[couchslug]

"If I were a terrorist, I'd just lob a grenade over the chain link fence into a big substation."

Grenades wouldn't take out much if anything, because they are small. "Wrecking" (the old Soviet term for such sabotage) is easily done with common tools, found chemicals, and found objects. Fiddling with explosives or conventional weapons is silly when the cheaper and unregulated alternatives would work much better.

Re:Unnecessary:The Cylons have been gone 40 years

[DavidTC]

I love how they think about computer security on BSG.

For those who haven't see it, on Battlestar Galatica, they're fighting an enemy they assume can near-instantly take over any computer, especially any network connected to the outside comms.

So they have plenty of computers, but none of them are connected to any others. (Although they can network them in an emergency...and the one time they did that to calculate something faster, they ended up having the computers almost taken over. Smartly, they only used non-critical computers.) They can reset and reload any of the computer in a few minutes. Their comm system appears to be some sort of analog switched and radio network, without any sort of 'modem' that would allow it to connect to any computer at all, and with hardware controls.

SCADA networks and the Internet

[knghtrider]

This is precisely why the SCADA (Control Systems) networks and the Business networks must be physically segregated. A utility I worked for until downsized early in 2003 opted for this route. Up until 9/11, there were compelling business reasons to interconnect the two networks for access to data for the GIS and other systems that could use the data. After 9/11, no reason existed that trumped the 'what if' security question.

Personally, I feel it is not only incompetent but also pridefully arrogant to think that you can secure interconnected control networks that ultimately have access to the outside world. The guidelines that were set down by Homeland Security are not exactly the strictest you would find, they're pretty lax IMHO; which is why this proof of concept could be successful.

The only solution is to physically segregate the two networks. If you need data, I would even venture to say that even Sneaker Net would be a hazard (think malicious software); but one that could be managed far easier than interconnected Control and Business networks.

Man who lies for s living

[geekoid]

makes claim he can't back, news at 11.

scada

[SCHecklerX]

scada networks are a scary mess. Luckily most of the systems they control are usually designed by an engineer and if someone were to take control, the safeguards will usually keep most bad things from happening. But still...

Probably Nonsense...

[mick_stockinger]

I'm not sure I believe the claims being made here. I've worked as a subcontractor in power plants all over North America and I've never seen a single plant where this would even be possible. Power plants have LANs with internet access like every other business, but plant operations, as controlled by the DCS, are completely isolated from the internet. It might indeed be trivial to compromise the LAN, but that is a far cry from actually gaining control of the power block. The DCS does have connections to the outside world in the form of frame relays (sometimes) to power marketing cooperatives (such as ERCOT in Texas...), or telephone access by analog router, but these are highly secure, isolated connections. The analog routers are usually disconnected when not explicitly required for remote support. This appears to me more media-inspired scaremongering.

Re:Probably Nonsense...

[mick_stockinger]

I just read the full article and realized that they aren't actually talking about power generation. Its certainly possible to compromise the SCADA, but one should understand that the level of control available through the SCADA is extremely limited. it is generally there to acquire custody transfer data. No doubt some mischief is possible, but it would require someone with a detailed knowledge of the RTUs connected to the SCADA, and that's pretty esoteric knowledge. There are also backup metering systems, so that if someone managed to breach the RTU and screw up the set points, the compromised data should be quickly discovered and the problem rectified. What's skimmed over in this story is that the hackers were contracted by management, which suggest that there is an active risk management assessment underway. That's a good thing.

Re:Probably Nonsense...

[pclminion]

You're missing the important point here, which is that the security breach was a combination of computer breaches and human breaches. You can have a completely secure computer system, not connected to any network at all, but if you can convince somebody to walk over to the secure console and push the big red button, then all your fancy security policies are for nothing.

I've heard it said that the only completely secure computer system is one which is locked in a vault and not plugged in. Even that isn't true, if you can convince somebody to open the vault and give you the computer.

Re:Probably Nonsense...

[mick_stockinger]

I'm afraid that a rather superficial perspective. The human breaches reflect the relatively low security risk that the SCADA represents to the system. I've called technicians and gave them plausible identification over the phone and asked them to do various things, and they did them--within limits. If you ask a technician to do something clearly foolish, they will call the supervisor for confirmation. For a power generation DCS, the human security is much, much, much tighter. Every action in the plant has to be coordinated with the control room operator, including all access, mechanical work and DCS control software access--even by the plant's own software guy! In many places there are two control room operators checking each other. The bottom line is that the vault was in this case, more like Geraldo Rivera's Al Capone vault than Citibanks.

Re:Probably Nonsense...

[rholland356]

Even your faith in the effectiveness of social engineering doesn't make sense. Taking over the desktop computers in the business operation is a far cry from gaining access to the actual control systems or gaining access to the information you would need to override the intense training and long experience of the people who actually do the operations.

I think management is gearing up to roll out a more-restrictive PC policy for the office employees. You know, to cut down on random surfing to increase productivity and reduce headcount.

Re:Probably Nonsense...

[pclminion]

Even your faith in the effectiveness of social engineering doesn't make sense. Taking over the desktop computers in the business operation is a far cry from gaining access to the actual control systems or gaining access to the information you would need to override the intense training and long experience of the people who actually do the operations.

Overriding the training and experience of the people involved is easy -- threaten to kill them or their families. I doubt some technician is going to risk death just to prevent a power outage.

Re:Probably Nonsense...

[dave562]

I second this. I've setup two networks for power plants in central California and the LAN network was completely isolated from the control systems for the plant. The servers themselves are completely redundant, mirrored on the hardware and software level. My initial plan was to just put the control system network in the DMZ on the firewall but I wasn't completely comfortable that the firewall itself couldn't be compromised.

Re:Probably Nonsense...

[rholland356]

Overriding the training and experience of the people involved is easy -- threaten to kill them or their families. I doubt some technician is going to risk death just to prevent a power outage.

Gosh, if it is so easy and effective, why doesn't this ever happen? Social engineering -- or "lying" in old-school terms -- isn't much more than sneaking off with some information.

How does taking over an office PC get you access to the operations staff whom you intend to threaten? And how serious could threats be when they are of the nature of "I am in your base, killing your Birthday Celebration spreadsheet"?

There isn't a big red "TURN OFF POWER" button

[Anonymous Coward]

It's not like getting into the desktop machines was all that had to be done. There is no magic button that turns it all off. They had send settings and data to protective relays throughout the network to simulate some failure and relay that to SCADA to bring anything down.

In some cases it takes in-depth knowledge of not only Power Engineering, but the devices and schema of the system. You will be hard pressed to find anyone outside the company that has all of the pieces to actually do it.

The easy way to take down a large chunk of power distribution in the United States is to drive a couple trucks into substations. It's just a matter of picking the right ones.

Incorrect

[geekoid]

"..and the drive automatically grabbed some data."
Whats?that work?

I blame the cold medicine

[geekoid]

for that sentence.

How about:

How does a program on the pen drive work without someone running it?

Re:I blame the cold medicine

[COMON$]

Same way autorun works from a CD :) enjoy!

Re:I blame the cold medicine

[arminw]

....Same way autorun works from a CD....

Of course this works only in Windows! There you have another reason to use a Mac or Linux. Why, oh WHY does MS program their OS to automatically run whatever crap is on a data storage device?

Re:I blame the cold medicine

[COMON$]

Because much like Mac users, windows users dont want to know how things work they just want automation.

Re:I blame the cold medicine

[arminw]

....Because much like Mac users....

Yes and just like car drivers don't much care what is under the hood. They just want to go from place to place without stopping at too many gas stations and repair shops along the way.

Macs are safer and more consistent for the vast majority of users who rightly don't and should not have to care what makes it go. For those who like to tinker with the innards of the computer software, Linux is far better. For those who like to play games and run and anti-virus software, Windows is the way to go. For everybody else, Macs are the equivalent of a Honda. Our Hondas just run and run and run without missing a beat and without visiting neither the repair shop nor the gas station too often. Macs really are the computers for the "rest of us".

Re:I blame the cold medicine

[COMON$]

You are either young or new to the debate. Macs are no longer safer than MS products sorry to say. Linux fan here, I use Windows corporately because it, and it hurts me to say this, is just the best enterprise OS out there. Home user? Definately would be a much better world if linux and its various flavors would take over the home environment where people are much more careless with their security.

Problem with Macs are,when they break your support options are limited, tinkering is out of the question, upgrading will cost you an arm and a leg. Unlike my good ol honda which anyone can work on, parts are readily available, and if I want to, can swap things out myself with no penalty.

Re:I blame the cold medicine

[arminw]

...Macs are no longer safer than MS products sorry to say...

So how many viruses, trojans spyware etc. are there out on the net for Windows? Tens of thousands? How many for Macs? Like my sig. says; it's the practice, not the gray theory that counts. The Windows market share argument is empty also. I really don't care WHY my Mac house doesn't get burgled. The fact is Macs out there in the real world seem to get bypassed by all the malware. How many botnets of Macs are out there spewing spam and other digital pollution forth into cyberspace?

You are obviously a do-it-yourselfer in cars also. I am not averse to cracking open a computer, Mac or PC and tinkering with it. However your mother, like most people out there would be terrified at worst or baffled at best, looking in the guts of a computer. Just two days ago I rescued a HD out of a 2001 vintage Mac laptop someone had spilled a can of soda pop into. That ended the poor thing's life, (blew the power supply) but I was able to extract the data.

Like most /. readers we LIKE computers and enjoy tinkering with them. Since the deep software insides of Macs are open, just like Linux, they can be tinkered with many of the same commands that all UNIX heritage computers understand.

Re:I blame the cold medicine

[COMON$]

Oh I am definately not a do-it-yourselfer in cars :) I am very good at Network Engineering, but I have a mechanic for a reason ;) I was just pointing out the bad comparison you made with honda.

For a eye opening experience for you read this article, I think it may have been linked on /. or roundabouts not too long ago.Hard numbers for you, not theory or personal bias. http://blogs.zdnet.com/security/?p=758

As for the botnets, well that is another debate for another day, but suffice to say, the same thing that makes windows wonderful for networking is why worms slide in so easily.

Personally I run most major platforms at home, not to mention the 100+ networks I support. My parents run a Cheesegrater G5 and a windows Inspiron laptop. I personally run BSD, XP, Vista, FC5 (up to about a week ago), and one lonely mac computer at home. I have contemplated purchasing an up to date mac for a while. While I believe OSX to be a work of art for an OS, it is still just an OS and is flawed.

Each PC has its issues, linux is not user friendly to non-tinkers (Ubuntu has made great gains in this area though). Windows leaves to many services unguarded. Macs are difficult to support, also now that they are x86 their hardware is just as flawed as Windows architecture. In fact I have a HD coming in today to fix where windows will boot on the HD but OSX wont and cant be repaired. (Not a fault of OSX just happened to be on the part of the platter that got destroyed). Windows with all its flaws, has a lot of exposure and doesn't install on proprietary hardware which makes it more versatile but less stable, something like 29% of Vista crashes were due to NVIDIA.

But Mac and windows in the long run are about even security wise. Ease of use? OSX hands down. Supportability, WIndows. Stability? Linux by far.

No I am not bigoted towards anything, maybe I hate windows a bit more cause I have no choice but to work with it :) Each OS has its niche that makes wonderful sense.

Re:I blame the cold medicine

[arminw]

....Hard numbers...

Yes indeed, your link gives lots of THEORETICAL flaws for the Mac OSX. Even so, there are no practical computer vermin for Macs out in the wild taking advantage of the many supposed flaws. I wonder why not.

Apple has a good thing going in that they seem to be able to support OSX or a selected subset thereof on most any hardware they want. It runs on PPC, x86 and ARM processors as in the iPhones. I have Win2K, XP and VISTA all installed and running as a VM file on my Intel Mac under OSX. VISTA is the slowest of all, but runs just fine. I tried Linux and it ran OK also, but I erased that again since it is very similar to OSX itself.

I think that eventually, virtualization is the future of computing, where a given hardware will be able to run any OS and its attendant applications. The real OS will be a simple VM manager that talks to the physical hardware. Aside from legal issues, even OSX could be run this way on any physical hardware that the VM can control.

Re:I blame the cold medicine

[COMON$]

THEORETICAL flaws jaw drops... Excuse me these are very real flaws, just not highly exploited ones. But your inability to distinguish between Theory and Reality is forgivable.

no practical computer vermin for Macs out in the wild taking advantage of the many supposed flaws.

a simple google search pulls up: http://antivirus.about.com/od/macintoshresource/Macintosh_Viruses_and_Mac_Virus_Resources.htm

As your knowledge of technology matures you will find that different situations call for different OS's.

Yes virtualization is the future, but not in the way you think, already the next release of windows server is implementing near to full VM environments. Apple will continue to push OSX but hopefully they will not open it up to multiple hardware environments, or we are going to say goodbye to our beloved stable Mac. Broad sweeping statements, inability to distinguish between BSD and Linux, I see now that I am talking to a fanboy.

And for cryin out loud, dont run vista in a VM, what are you? A glutton for punishment?

Take it from a guy who has implemented Macs, *n*x, and Windows in many many many different environments. Been there done that, they are pretty much all equal. I am just as comfortable giving someone a windows box as long as it is behind a firewall and Firefox, as I am giving them a MAC. My reluctance on macs is generally pointed to the difficulty in supporting them, increasing downtime when a failure does happen. What I do like is that MAC users tend to be considerably more tech savvy than Windows users. Of course I have good money that OS.5 is going to kick ass as it gets tested in the real world. I think we will se great market share increases for OSX here in the next 5 years, especially with the disappointment of vista.

Re:I blame the cold medicine

[arminw]

....A glutton for punishment...

Ha, funny! Actually, VISTA runs acceptably well, once it boots that is, which seems to take forever. It does want plenty of RAM however. I use it mostly experimentally to test some apps, and learn about the OS itself and its networking peculiarities. Someone used to XP or older has quite a bit of learning to do, in order to use VISTA to its full capability.

I only have ONE Windows program left which I absolutely must have. That one runs well on Wink2k and needs no network access. So that's what I use, since it requires only 256M of RAM for the VM.

Re:I blame the cold medicine

[COMON$]

I guess if you turn aero off you should be fine. Now that we are on a more edifying topic; Being a VM mac user have you had much success with Fusion helping run your windows app? I used it with my clients and Outlook cause we all know the Mac users feelings on Entourage :)

Re:I blame the cold medicine

[arminw]

...have you had much success with Fusion ...

No, I use Parallels 3.0 with something they call Coherence. Coherence makes the Windows desktop disappear. The Windows app then runs on the Mac desktop in its own Window(s) next to any normal Mac program. After a while the fact that the program is a Windows program seems to become unnoticed, although of course it still looks like a Windows program, including whatever color theme I originally set up. I can even run two programs, one under XP and the other under Win2k, together with normal Mac apps

I have explored the Windows-Mac integration just for interest sake with various versions of Windows, but I actually still regularly use only one program under Win2K. I can also open the virtual VM disks in OSX, without running Windows at all. The Win disk files mount in OSX like normal Mac disk images. This is handy to transfer files.

Re:I blame the cold medicine

[COMON$]

Yes Parallels does the same thing as fusion Unity. Haven't played much with parallels coherence, fusion makes the Windows desktop disappear as well. Since it is considerably newer on the mac market I haven't gotten much feedback on it.

MCCLAINE!!!!!

[kangman]

I thought the Die Hard 4 plot was ludicrous. Apple guy: Jesus Christ. It's a fire sale. Bald Actor: What? Apple guy: It's a fire sale. Deputy Director Miguel Bowman: Hey! We don't know that yet. Token Asian Chick: And it's a myth anyway. It can't be done. Apple guy: Oh, it's a myth? Really? Please tell me she's only here for show and she's actually not in charge of anything. Bald Actor: What's a fire sale? Apple guy: It's a three-step... it's a three-step systematic attack on the entire national infrastructure. Okay, step one: take out all the transportation. Step two: the financial base and telecoms. Step three: You get rid of all the utilities. Gas, water, electric, nuclear. Pretty much anything that's run by computers which... which today is almost everything. So that's why they call it a fire sale, because everything must go. //taken from imdb with some... modifications

Re:What kind of oversight do Loyal Bushies give???

[Anonymous Coward]

i'd like to point out once more time that it's impossible to "hack the grid." you can compromise machines inside the control room, but never anything that controls the flow of electrons.

the hardware doing the dirty work is custom-spec stuff running on a completely custom OS. keep in mind this hardware merely guides the engineers, rather than controlling the grid. most power grids in the US are about the same as they were in 1950. in other words, it's controlled by manpower. lots of it. the engineers in charge of the control room have volumes and volumes of binders with step-by-step procedures for each and every adjustment they could possibly make to the flow of power. switching operations, etc are all done by manpower, NOT cpu cycles.

basically, when someone says "you can hack the power grid" it's like they are saying "you can hack a wwII battleship." of course you can't. it pre-dates internet technologies by so much that even the upgraded re-serviced ships have nothing but custom hardware and software sandboxed from any kind of network.

the entire electrical grid's infrastructure is pretty close to being what it was in the 1950's. and when i say "pretty close" i mean that the only real upgrades made to it were in diagnostics and capacity. in other words, they added more transmission lines, and more little gadgets to sense and log data that could be helpful to keeping things flowing smoothly. in actuality the entire system is so antiquated that if network technology as we know it were to be erased, the grid would work just fine. keep in mind the systems the power companies use were developed in-house and custom-tailored to their needs. much like the upgraded wwII battleships the US was using until recently, if all the tech were stripped from it, it would still work fine. instead of accessing the custom-built touchscreen diagnostic panel, you'd pick up the secure internal-only telephone and ask the engineer for readings.

p.s. robot lords: i'm assuming that name is a Clutch reference, and i'm a rabid fan, so hats off to you. (i must have muttered "smile, taste kittens" at least 10 times while writing this)

Penetration-Testing Consultant

[denmarkw00t]

Now thats a job title!

A day?

[imyy4u1]

Pfft...only took me 2 minutes to hack into ComEd. Amateurs.

Note to ComEd: don't run Microsoft Remote Desktop on your servers with admin as the Administrator password :-D

Or possibly, Ridiculous.

[Anonymous Coward]

I don't think I've ever seen the term gas axe before. Ya learn something new every day... but nobody on the internet ever seems to learn how to spell.

Looser, n. (from Internet Jargon) A native English speaker who spells the word "lose" as "loose" or "ridiculous" with an "e".

Take Ira only with a huge pile of salt

[Anonymous Coward]

Ira...? Wow. I've worked with Ira, or more accurately, I've made a very good living cleaning up from him and his team. However, I've got to say, his publicity and self-aggrandizement skills are second to none.

Now, I don't mean this as a pure ad-hominem attack. Ira used to have technical skills that were worth something. But like many others who *used* to work for the NSA and don't any longer mostly because they're unable to keep their mouths shut, Ira has a tendency to gather a team of folks who say bombastic things, find some minor vuln and blow it all out of proportion. To say he and his crew are rusty these days is an wild understatement.

This is no lie: A couple years ago, one of Ira's gigs concluded with a report that indicated one of his subcontractors "researched" the local liquor store, the proprietor of which claimed to be ex-KGB and posed a wireless security threat. Needless to say, Ira's client looked elsewhere for help in remediation (which is nice for me).

Even worse: who wants to deal with a guy who goes public with organizational vulns after being retained by the org? The details here aren't clear, but I'm surprised he hasn't been sued into oblivion for afore-mentioned blabbering. If he were a lawyer, he would have been disbarred long ago for conduct and disclosure problems.

That "Spy Files" crap he was writing for Computer World before they booted him makes good reading for anyone contemplating hiring him and his team. You can still google some of it: First, find the one-technical-error-per-paragraph. Then imagine your organization's name in place of whomever he was busy embarrassing. If you're not considering using someone else, repeat the previous steps.

But I'll give the guy credit for raising awareness and making a good living from an inflated reputation. I wish I could market myself that well.

"Public" utilities

[jabber]

Nuclear plants are part of the "public" utilities that feed the power grid.

You cannot just stroll into a nuclear plant to see how things work.

After your smug and false assertion that you can, everything else you have to say, no matter how "insightful" is may seem to some, is suspect.

Re:"Public" utilities

[AB3A]

Yes, but the information on how they're doing IS public. That's the point most people don't understand about this business. There are legions of people who have nothing better to do than oversee the various activities a utility does. They need reports. There are legal requirements for many of these reports.

There are two utility plants known for good physical security: Nuclear Energy and Water Filtration. And there are two utility plants known for some of the very worst industrial cyber-security: Nuclear and Water.

The reason is because they're the ones with some of the most stringent oversight.

It's not about the physical security...

Re:"Public" utilities

[jabber]

Having worked in Nuclear software development, I can't see how it can be called worst in terms of cyber security.

All the control systems I've worked on, SCADA and monitoring as well as balance of plant, has always been isolated from the externally accessible computers via air-gap.

The only connection to the outside world from these systems is a dedicated phone line to the NRC - with specialized out-only protocols.

Yes, the control, monitoring and BoP systems are networked, but only within their function, not even to one another, never mind the outside world.

Not only that, but each system is implemented on different hardware and OS specifically to avoid a common point of failure.

So while someone can very likely get into the out-facing network in a plant - due to bad IT practices - and can probably get reporting data that is processed on those systems, they cannot affect the functioning of the plant without either being physically on-site or somehow manipulating an operator to tweak operational safety setpoints on the SCADA system.

Re:"Public" utilities

[AB3A]

...and I work for a water utility. And I have said much of the same stuff that you're saying.

Physical presence is often required simply because the controls don't exist outside the plant. --At least, that's what everyone thinks.

What you may not realize is that new equipment is already including an awful lot of wireless gear in their designs by default. We're talking not just about ISA-100 stuff, but 802.11, Bluetooth(!), and so on.

You also may not know what people hook up behind your back. Purchase a steam turbine from one notable manufacturer and they'll insist in the contract on a dial-up modem that they can call at any hour of day or night to interrogate and update the control system.

I've talked to many security researchers. They all tell me the same thing: Whenever a utility says to them that they have no connections to the outside, they're invariably proved wrong. Whenever people say the information flows only one way, they discover that it is often bidirectional.

I work hard to secure our systems. I'm sure you worked pretty hard on the systems you had too. But at the end of the day, you have to contend with some nitwit who thinks that he knows more than everyone else, who runs off to the local computer emporium so that he can stick an extra unmanaged switch in the plant to "do some diagnostics."

I work not only in the design and integration, but also in the field. Yes, I've said the sorts of things I just disparaged, and seen our careful work subverted by ignoramuses. I've seen what happens when people hand out free flash drives.

The difference between design and practice is the same gulf as the difference between theory and reality. I work with both. I'm not looking to blame. I'm merely stating that nobody is as secure as they'd like to think they are.

Security woes

[Datamonstar]

I've been telling my bosses about the threats that our browsers and unpatched machines pose. There are countless machines that are not patched on our network and our data center did not have access to XP SP2 for some two years after it was released because the machines weren't allowed to install it under our super user account, but field services never came to install it for us because it's too much of a hassle for them to get physical access to the data center. So we couldn't install it, and they wouldn't. I actually hacked the install to my machine with an admin account I had access to, but even after demonstrating to my boss a malware infection and how the patched machine was NOT vulnerable to it he didn't think it was much of a big deal. As long as management (manglement) doesn't understand the threats posed to their networks, then they will likely stay vulnerable. In the end no one cares until they loose data and of course, by then it's too late. Maybe if they lost some MONEY they'd listen. This case was a power grid, something is important for a great number of people. But most companies won't listen until you tell them they are loosing money.

Security only after proven need

[Anonymous Coward]

I doubt there will be serious inquiry into fixing this until someone actually causes a lot of damage.
And even then, the only thing that will be done about will be an invasion of some random middle-eastern country and possibly full-body searches of suspicious (read: busty female) looking people near power plants.

It's...

[Anonymous Coward]

Windows.

Did they get into the EMS firewall or not?

[argent]

The article does not say that they were able to get behind the energy management system firewall or not. Depending on the firewall and server architecture getting inside that firewall may be easy or it may be impractically hard.

By the end of a full day of the attack, they had taken over several machines, giving the team the ability to hack into the control network overseeing power production and distribution.

That could mean they had compromised systems on the EMS LAN, or it could mean that they had access to desktops on the corporate LAN that had been given some kind of operator access to the EMS LAN. Best practices in the industry include restricting operator access to systems behind the EMS firewall, restricting those systems access to the Internet, and requiring the operator access Internet resources from physically separate computers on a separate physical LAN than the dispatcher and operator consoles, and corporate LAN access limited to an EMS DMZ hosting reports "pushed" from the EMS LAN.

Safety without security?

[pyrr]

I'm not sure such a thing exists.

I used to be an operator for a water works, their security was a complete joke. Under their system, the municipal water supply was only safe as long as nobody wanted to poison it. The plant grounds weren't secure (there was a gaping hole under the perimeter fence due to terrain, nobody cared), the fence wasn't topped with barbed-wire as I recall, and while the proper doors on the plant were secured with locks, the assorted access hatches, some at ground level, were completely unlocked. There was no intrusion alert system of any sort, and the location wasn't staffed 24/7. Well, it should've been staffed 24/7, but the district manager was a kook who maintained a hard line that "nobody should ever have to work a graveyard shift!", even when we all volunteered for it and desperately wanted to improve operations by doing so during summer when we ran over our rated capacity for 18 hours a day. But I digress.

That was just the pathetic security picture at the water works plant itself. Neither of the two ~300k gallon water tanks off-grounds had their main hatches secured with more than a flimsy padlock (there were no 'hatch open' alarms or anything, not that it would've mattered with nobody working overnight anyway and the district being so technologically incompetent that there simply was no technology), and they weren't in visible locations.

I'm sure things have gotten a little better since I worked there, 9/11 happened in the meantime. This water district served a suburb of one of the larger US cities, so it could well have been a target. There was no excuse for even the simplest security measures not being taken. All it would've taken was someone with a twisted mission from God to wreak havoc, and the water supply for tens of thousands of people would've been tainted and unsafe.

Ira is a weasel

[Anonymous Coward]

I work for a power company, heard the presentation. Ira is an idiot - there's no nice or better way to say it. Get up on stage and spew a lot of generalizations with no proof, no permission from the organization you did the work for and you too can get quoted by all the (clueless) news wires.

Bah!

All Hail the Bruce.

[Anonymous Coward]

And you people thought Die Hard 4 was bullshit. Bruce Willis > Chuck Norris.

Re:What kind of oversight do Loyal Bushies give???

[master_twig]

custom OS? Not sure what you got in the US, but down under its just a plain jane windows box (win 98, nt, 2000, xp.. depending on age and enthusiasm of engineer responsible) running a SCADA package such as Citect, interfacing to some PLC's and/or RTU's.

Or if its not a SCADA system, it'll be a DCS of some sort... but nothing custom per se.

Off topic

[whitehatlurker]

Following links, I found this article, which says of 7.2M random sites, the highest single group was "adult content". Using 3.3M sites known to host malware, adult content was ranked 9th.

The moral: pr0n sites are safer!! Remember this when you surf.

Don't need to access SCADA from Internet

[cusco]

SCADA systems communicate with equipment scattered all over the freaking place. Frequently the power company can turn off an individual electrical meter from the central office. Think about that for just a moment, and you'll realize that this means there is a communication channel into the power grid **FROM YOUR HOUSE** that doesn't cross the Internet and probably has very little security built into it.

I worked at a local utility for three years in the IT department, and there is nowhere that their SCADA system touches the rest of the corporate network. They sneakernet tapes and disks from one machine to the other when they need data transfers. They're far more worried about someone getting into one of the rural substations and tapping into the sytem from there.

A Physical Attack is FAR more destrutive

[cusco]

Even if someone gets into the SCADA system, let's say by tapping into a connection at a rural substation, they can only do temporary damage. Like you said, they'll just restore from backup.

A person with a deer rifle, on the other hand, could take out an entire substation in a couple minutes, drive to the next and take it out, and then bring down a third before the police could even come to the conclusion that they need to post guards. Few utilities have more than two of the largest transformers or relay sets in stock, since they cost so damn much, and the backorder times on most of them are 3 to 18 months. In addition, Federal regulations will make most damaged substations into chemical hazard sites for weeks or months.

Utility security directors are a lot more worried about people with rifles than they are about hackers.

Re:A Physical Attack is FAR more destrutive

[Sandbags]

I'm even more worried about coordinated strikes. Our power grid has very little redundancy. there are about 20 sites in the USA that is more than a few were taken out at the same time, we'd be looking at nearly nationwide blackouts, and weeks to repair the grid.

Strap a whole bunch of C4 to a few super toewrs, bring em down, blow up a few regional transforming stations, etc, we'd by up shit creek...

Some of these are guarded, but they're are not enough guards to stop a large pack of determined terrorists... People who are willing to die don't fear rent-a-cops...

It's a miracle this hasn't happened yet.

Gaining control of the mainframe coul,d cause a lot more damage (forced oversurges, frying transformers, etc), and it's a BIG concern, but there certainly are other worries.

granted, water systems, even sewer systems, are nearly as vulnerable...

They don't WANT to attack us

[cusco]

Twenty guys coming across the Mexican border, distributing to random cities across the country, washing dishes or mowing lawns like any other illegal, are essentially invisible. If they all buy used deer rifles out of the Classified Ads and at a specific date/time all take out the largest substation in their area (conveniently marked on many hiking maps) the resulting chaos would take down the entire North American grid. It would take days to bring the whole thing back up, and then they could just do it again. And again.

If you want a demonstration of what an unreliable power grid does to a country's economy just look at the difference in Peru's economy before and after the Sendero Luminoso were taken down (yes, I realize there were other factors as well). Additionally, the big equipment has delivery times ranging from 3 to 18 months because it's all essentially custom made and it's so expensive that no one carries more than the absolute minimum of spares. The factories don't have the ability to rapidly ramp up production or delivery either.

This stuff isn't rocket science. If the US isn't being attacked right now, it's because they don't WANT to attack us. And that's a very, very scary thought to most people, since their whole world view says otherwise.

Disgusted...

[Anonymous Coward]

...it is insane to have any kind of physical connection to the power control grid and the Internet. And to have access thru a Microsoft system is just ASKING for trouble, with a captial "T" and that is TERRIBLE.

Those involved need to find other works.

Uh social?

[Gription]

Check out "social" on dictionary.com: http://dictionary.reference.com/browse/social

Social engineering requires some sort of social interaction. Just because it is a human involved with an action it doesn't make it a social action.

If a guy accidentally drops a $5 bill so I can pick it up off the street there is no social component. If someone distracts him so he drops the 5 then there is a social component. Looking at an inanimate object is not a social behavior.