Experts Hack Power Grid in Less Than a Day

bednarz writes "Cracking a power company network and gaining access that could shut down the grid is simple, a security expert told an RSA audience, and he has done so in less than a day. Ira Winkler, a penetration-testing consultant, says he and a team of other experts took a day to set up attack tools they needed then launched their attack, which paired social engineering with corrupting browsers on a power company's desktops. By the end of a full day of the attack, they had taken over several machines at the unnamed power company, giving the team the ability to hack into the control network overseeing power production and distribution."

Comments

I'm Shocked!

[ookabooka]

Not really though. A good team of social engineers (con men) and CS people can accomplish many many things...How can you prevent such things? Ridiculously strong security? Require the security guard at my place of employment to scan my ID each and every time I walk in the building? Is he supposed to also stop law enforcement from going in without clearance from HQ? I'm quite serious, what would be an effective way to stop these tactics? Everything I think of is either too impractical for most situations or prone to the same failures, but at different points.

Re:I'm Shocked!

[QuantumG]

Require the security guard at my place of employment to scan my ID each and every time I walk in the building? If you work with national infrastructure, they god damn better.

Re:I'm Shocked!

[teh moges]

Maybe don't go to the extremes of requiring everything to need high security (such as entering the building or doing everyday work), but things such as shutting down the power grid should require extra security. Access to the important controls should have extra security. With security, one size does not fit all.

Re:I'm Shocked!

[kestasjk]

Yup the terrorists could shut down the power grid; it'd be like 9/11 but with light bulbs instead of people!

Since OTT security costs OTT money I think they should stick with sane security checks, and not worry about headline grabbing pranks like these

Re:I'm Shocked!

[Yvanhoe]

Accessing to the crucial computers should require a training where computer security and social engineering are explained. Every user access should have different passwords easily revocable as soon as a flaw is detected. Of course, crucial computers should be on a different network than internet-connected systems.

Re:I'm Shocked!

[Anpheus]

Wait, guys, I have a fix!

*unplugs cat-5 from firewall between power control computer and local intranet*

Wait, you were saying something about prevention and deterrence and I rudely interrupted. Please, carry on.

Re:I'm Shocked!

[witherstaff]

After the '03 outage it made me wonder how safe all those high-rise electrical towers that run across the country are. A stick of dynamite on a tower itself, or even just a few shots with a rifle to the wires attached. Would just one tower lead to another blackout - scary considering those towers are of course everywhere.

I've wondered over the years what someone with a high powered rifle taking potshots at oil/propane/liquid hydrogen tankers on the interstates would do. Mainly this crosses my mind while driving alongside one of them and having seen too many Hollywood movies with things blowing up.

Re:I'm Shocked!

[dbIII]

I have to admit I have gained that sort of access just with a pair of overalls. It was one of those stupid catch22 situations where you had to do a one day safety course to be authorised to get through the gate and you had to get through the gate and walk through the middle of the turbine hall to get to where the course was held so you could get your ID. A similar thing happened at another power station but that time I actually had the company logo on the overalls - but yes I did just walk in and go right up to the control room that time. Oil refineries are a different story - the ones I visited had administrative buildings outside the gate so you didn't have to get full site access just to meet someone in the place.

Re:I'm Shocked!

[FireBreath]

I've wondered over the years what someone with a high powered rifle taking potshots at oil/propane/liquid hydrogen tankers on the interstates would do. Mainly this crosses my mind while driving alongside one of them and having seen too many Hollywood movies with things blowing up.

Don't you watch Mythbusters? They proved you can't just go blowing up canisters in huge firey explosions with rifles. It takes a fair bit of explosives to do that.

Now where did I leave that RPG...? :)

Re:I'm Shocked!

[Jessta]

Seperation of privileges is the best method. Social engineering tends to work because people who have privileges lack certain information and/or lack authority in the role of the privileges they have.

If you have full authority in your role and personally know everyone who is involved in your role then you can't be easily tricked by people outside your role in to doing things.

This requires education and a proper company structure, which requires good smart people in management.

Re:I'm Shocked!

[Anonymous Coward]

shutting down the power grid should require extra security

DANGER WILL ROBINSON!

CRITICAL FAILURE IS IMMINENT, YOU MUST SHUT DOWN THE REACTOR IMMEDIATELY

Please enter password:

Password is incorrect!
Password is incorrect!
Password is incorrect!

You have been locked out for 10 minutes.

Re:I'm Shocked!

[AB3A]

I don't know why you got modded insightful.

Here's the first clue:

Public utilities are public! They're not armed fortresses. They were originally created to be open institutions where people could see what is going on. They're supposed to share data and cooperate with each other.

Here's the second clue:

There are many who need the information about the utility's performance to do their day to day jobs. The volumes of information and the volumes of regulatory agencies, and other groups they need to inform increase every day. Securing these connections isn't for the faint of heart. I say this as a member of ISA-99, the international standards body for SCADA security.

That said, most companies have secured the distribution systems. However, these are highly customized systems. You can't bolt security on them after the fact. Replacing them is nothing like replacing or upgrading an information system. There is this little problem known as system validation. It is extremely expensive. Furthermore, the standards for securing these systems are still very much in development (I'm on one of those standards committees too).

SCADA systems are in the Ford Model T days. You want to bolt a seat-belt and airbags to it. These things may help, but if you really want things to be secure, we need to rethink the entire infrastructure. And that will not be cheap...

Re:I'm Shocked!

[6Yankee]

How can he? He was posting from that power control box, you insensitive clod!

Re:I'm Shocked!

[Oktober Sunset]

Just the same, bouncers outside a club don't prevent entry, they just deter brute forcing the door. If you really wanted to get in the club in a hurry you could walk up with a gun, mow them down, and walk in - wouldn't even have to break stride. Umm, yea, try that in a club in a real city, the bouncers will have bullet proof vests, there will be double barriers in front of the club that you have to jump over , by which time the bouncers will have retreated inside, closed the shutters and radioed for the police who are only 2 or 3 streets away and will be getting the submachines guns out of the boot of thier car. Armed police would be there in about 2 minutes to gun you down.

Clubs in citys with gang problems usualy have extremly well armoured entrances, thats why you go through those such narrow little doorways when you get inside, so they can lock it up real easy.

I've been in a club where someone pulled a gun at the door, we never even knew about it, untill cops and bouncers came down and told everyone the club was closing cos there had been an 'incident' outside, when we got outside, there were cops everywhere, but we didn't even notice anything inside, the bouncers inside just shut the doors and they couldn't do shit except wave thier gun about until they the police turned up and they ran away.


It's all a question of what you are expecting, if you expect a few drunken monkeys, you just hire a couple of big blokes, if you expect armed gang members, you hire a professional security team.

Likewise, if you expect your scallywag neighbour might be mooching your broadband, you turn on WEP. If you expect that determined saboteurs are going to shut down your power grid, you do what the guy in the last reply said, unplug the computer that controls the grid from the network.

Re:I'm Shocked!

[Sandbags]

I can't discuss which power company it is, due to contractual issues, but I can tell you that the power company around here would not be susceptable to such an attack.

The computer systems that control the grid are extremely secure. So secure in fact, they do not HAVE a network connection outside of their own server to server interaction.

The mainframes, UNIX systems, and other systems that operate the switcing grid are isolated in a section of the building that even their own network engineers can not enter without being padded down to ensure they carry no computer media of any kind.

When media does need to be brought in, say to patch the OS on a machine for a bug, or to update the backup server software, the media for that must pass through a several step security scan, including scans by not less than 3 AV applications, repeated on not less than 3 different PCs. All install media for machines in that area are kept in that area, seperate from all other company media.

You wouldn't believe the process we had to go through to bring a new backup system in there...

These systems are so isolated it is virtually impossible to infect them.

On the other hand, the PCs connected to the billing systems, yes, they could be infected. These systems however are backed up in many ways, and even if they had to roll back the database a few days, all they'd have to do is correlate the accounting records with meter readings, and they'll know exactly how much everyone owes or paid. They might have to type a few customer change orders back into the system, but all that is in hard copy anyway... It would be an inconvenience, but not that big of one. Of course, the billing system is only accessible via terminal session from PCs on a specific VLAN that are not used for any other purposes (no web browser, document creation, etc), so infecting it is not exactly easy, and I doubt is could be done with a bot without intimate network design knowledge, a few passwords, and a lot of attempts. It would have to be a targeted hack.

This particular power company is a locally owned co-op, small time company. If they can implement security like this, I'm sure others do as well.

I imaging the power grid itself, not so much the systems controlling them, could somehow be hacked, or fooled with conflicting signals that could cause issues, but I seriously doubt anyone let these people try...

Re:I'm Shocked!

[AB3A]

I have been working for a utility for more than 20 years.

The utility business has three tactical concerns: Safety, Availability, and Security --in that order of priority.

Utilities have been running for decades on old infrastructure. Using SCADA, we're managing the existing capacity in the original infrastructures built by our parents and grandparents. They invested monies that in today's economy would make your utility bills look ridiculously small.

Utilities aren't building infrastructure because the rate payers don't know there is a problem with it. Even when they do know, they may not realize how much it is going to cost to really build in the kind of capacity that previous generations were willing to commit to.

No, instead, we get leaders who slash staff, offer early buy outs, and then discover they don't have anyone who knows where anything is or how it works. Realizing they don't know how to hire people who know what they're doing, because they don't know what to look for, they contract the whole thing out to some private company that in theory could run a utility, but in practice is also understaffed.

And against that backdrop you'd have us invest in a tertiary concern called security? I mean, we are all interested, but there are higher priorities right now.

Is everything on the internet?

[Armon]

Why wouldn't the power company use a private network? Why is there EVER a need to have access to those systems over the internet?
Realistically, no part of a nations critical infrastructure should be networked (other than the internet itself). That seems pretty obvious.

Re:Is everything on the internet?

[jroysdon]

The problem is the layers. The Desktop PCs (you know, the ones you use to check email and surf the web) have access to the internet (probably just outbound), and access to the SCADA networks. While you cannot initiate an inbound connection to those Desktop PCs, all you have to do is get someone to click on a link and get infected with something that sits on their PC and maintains an outbound connection (think GoToMyPC). From there, the exploit team has access to their PCs and everything their PCs have access to.

In an ideal world, they'd have two PCs on each desktop. One on the internet, one on the SCADA network. The two should never be connected. That's how the military is suppoesd to do it between different levels of their networks (the two different levels are never to be connected).

But that costs you twice as much, and isn't convenient. But you'd never have a security breach.

Oh, and they buy and sell power over the internet between different power companies, so right there is a reason you'd need some SCADA system connected with internet access (but you could have those systems very, very locked down as to what and how they can access between things).

Re:Is everything on the internet?

[Anonymous Coward]

Connectness is transitive. It wasn't a private network if it can be accessed from the outside.

Re:Is everything on the internet?

[Anonymous Coward]

I don't understand "they did". Internet and SCADA where available on the same desktops:

"Individual desktops have Internet access and access to business servers as well as the SCADA network, making the control systems subject to Internet threats."

Re:Is everything on the internet?

[jroysdon]

Even still, you wouldn't have any way for someone to remotely control those systems. A virus/worm might get spread from the internet PCs to SCADA PCs at the worst, but there is no way to control them (short of sending another message via virus and long time delay via "sneakernet" USB storage device).

But safer than that would be a way to have a DMZ storage system (not internet DMZ, but DMZ between internal Internet-access PCs and SCADA system PCs) that each different type of PC can drop data off in, but that DMZ system has no access out to either side. So you can drop data off, and then go get it from the other side. So long as your data is just raw data (db info of some sort, I'd imagine), there isn't away you're ever going to push a virus/worm back and forth.

Re:Is everything on the internet?

[kitsunewarlock]

At this point its probably a money saver. They wanted the internet in the building, but didn't want to buy another set of computers when they already had internet capable computers probably (I'm guessing) as monitoring stations.

The short answer is: "Boss is cheap and employees will quit if they can't watch YouTube in one window as they watch the grid in the other."

Of course, they could be completely incompetant and simply be using the internet this way so they can monitor things from outside the building...which still doesn't make much sense to me. If anything, it should be one man's job to manually transfer the data via flash memory device to and from the non-networked computer and the networked computer every 15 minutes to ensure whoever was too lazy to come to work can get up to the minute information. or, you know, just connect it to the internet when its absolutely necessary. Its the same reason I don't keep my cell phone on all the time: I don't want people accessing it when I'm in the shower, class, driving, etc...

To continue your sentiments: if you don't want people accessing your device, turn it the hell off or snip the (many times, due to wireless technology, metaphorical) chord that connects it to everyone else. There is no shame in unplugging your Ethernet once in a while. If anything connect it with such a slow connection that by the time a virus got through, the connection would sever due to the person attempting to view two images at once (28.5 kbs moden FTW).

Re:Is everything on the internet?

[utunga]

I worked at a place that supposedly had two totally separate networks - one connected to the internet, one corporate wide, for news/data/intranet stuff.

So, sure, everybody has two desktops.. one for internal one for everything else. It was great in theory - really stupid in practice. Just doesn't work.

Reality is - there is an expectation that data from outside is available inside. In the power company case it might be everything from the latest gas pricing information to weather reports to who knows what else - and so in 'getting things done' this will inevitably require connections between the outside and the inside.

So, as a result of this 'blanket policy' contrasting with the 'real world' people would circumvent the rule - but do it in stupid, sneaky ways -- for example in one data center there was, literally, an infrared tunnel between two computers -- "see, they are not 'physically connected' !!" .. And try to keep it secret from the network ops guys, of course.

It would've made a lot more sense to supply a safe, heavily controlled/monitored firewall that connects outside to inside and let the network security people manage it. Otherwise your choices are (1.) actually enforece the rule and totally cripple the effectiveness of the internal system (with the result that nothing of any importance gets put there) or (2.) really lame hacks pretending to be secure and working around the blanket rule, when in actual fact they are invisible bridges that the network ops guys don't know about.

I saw the alternative 2. in real world practice. Lets consider option 1. - if they really did manage to make the SCADA network totally seperate **and enforce that**. In that case you'd probably just end up with the forecasting/power-station-scheduling app running on the 'outside' network - and just the final 'implement it' step on the internal SCADA. Since the scheduling app is the one where the real decisions are made - hacking into that would let you send signals and information that would look relatively harmless but would still, in effect shut down the power grid. You are still sending information - in this case mediated by human brains, but not in a way that the human brain can easily understand because its low level commands (turn this up, turn that down) - that could very effectively mess up the voltage balance or frequency timing or whatever, and causing rolling blackouts and thus achieving the same aim of shutting down the power grid. There is information flowing from outside to inside - whether it is via human or machine.

Security through dis-connectivity is a dangerous myth in most cases. In some cases, say military situations where you are willing to absorb the huge cost to re-implementing a complete replacement for just about every dang thing you might need on the inside (e.g. weather data, or radar data, say) then it may make sense. In just about every realistic corporate case - even power companies - its likely to only cause people to take their eye off the ball of implementing real security and proper firewalls etc.

Re:Is everything on the internet?

[1u3hr]

The problem is the layers.

The problem, as usual, is Windows. If you RTFA, they just set up a site and emailed the power station guys that there was a change to their pensions or health benefits, for more information.... so they clicked on the link and were pwned immediately. No specifics, but does anyone doubt this was Internet Explorer running on Windows?

Solution: Others have pointed out the need to transfer information routinely via the Internet. How about the desktops run Ubuntu, or OSX or ANYTHING except Windows? Risks of an exploit of the desktop will be much reduced, and even if successful, there is a bigger barrier if it has to work across different OSs (sadly the power supply monitoring software apparently runs on Windows, and is unlikely to be rewritten).

Whatever the solution, it will have as Step 1: Get rid of Windows facing the Internet.

Re:Is everything on the internet?

[Tarwn]

In cases where buying and selling of power is happening at the plant level, it is not going to be the equipment operator that is buying and selling power. And the person selling power does not need access to SCADA systems, thats what the telephone is for and why they have operators at plants to run the equipment. if somewhere there is a plant that is small enough that one person is both buying and selling power AND running the equipment, I'm betting they barely have an internet connection, much less the money to keep up on annual maintenance for the equipment, etc.
In the power plants I have worked in (mostly gas turbine, only one nuclear), there was not any type of internet access from PC's on the controls network. For the most part these systems only ran some form of HMI software (WW, RS, WESstation, whatever) and occasionally something like MS Word or Excel for shift pass-down notes. Sure they had a browser (on the Windows systems) but it wouldn't get them anywhere because there was only one system that had any level of access to both the business intranet and the controls systems. This system (data historian) could only receive communications from the controls side (which had interface software that knew how to contact the historian) and communicates in a proprietary protocol.

Now, as far as the corporate office is concerned, pencil and paper are good enough to keep track of which plants are running which generators, which plants have which generators down for minors or majors, and which plants have generators idling (running with no load at very low levels, not on the grid - cheaper to idle them in most cases then to shut them down). However, in the case of at least one company I worked for, their historian had an interface that pushed data back to a corporate historian, then some reports and so on would run at corporate that drew data from the corporate historian and reported machine statuses, load level, etc up to the last few seconds. This is again using the same proprietary protocol (or heck, maybe a different one).

I don't know what power company this article is about, only that I didn't work there and didn't do any type of integration for them. Whoever setup their infrastructure hopefully learned a lesson and will do it right next time.

Don't do this for real.

[Profane MuthaFucka]

Google can help you pick your target.

http://www.google.com/search?q=%40ercot.com&btnG=Search&hl=en&safe=off&rlz=1B3GGGL_enUS264US264

That's a search for "@ercot.com", and if you don't know, ERCOT runs the Texas power grid market. There's another one for the East grid, and another for the West. You can find them yourself.

Re:I hate the term "Social Engineering"

[causality]

What's wrong with the good old fashioned "lying" or "scamming"? Fucking con-artists trying to sound legit. It's "social engineering" if you fell for it.

Oops.

[Renraku]

An attack on a control point of the power grid could cause millions in damage if properly executed, and possibly lives from extended loss of power. I'd like to think the power grid has built-in protections to keep a 'bad node' from ruining several others, but it just might not..seeing as how companies build for economy before they build for safety.

Even something as simple as opening a few junctions could cause fireworks..take a look at some online videos about 'opening hot' for example..now imagine if that arc caught other pieces of equipment because the line was still energized.

Simply put, the power industry needs to step up to the plate and harden both their network infrastructure and their meatspace infrastructure against malicious attack.

Re:Oops.

[Firethorn]

seeing as how companies build for economy before they build for safety.

I'd argue that building for safety is right up there, perhaps before economy even.

It's just that the power company's idea of safety != producing, delivery 100% of the time.

Electricity itself is dangerous. So the power companies do all sorts of things like install breakers to shut off the power if a potentially dangerous situation is detected. First is protect human life*, second is the expensive equipment. A fuse is cheap, even if it costs $100 because it's designed for 18KV@1KA compared to a switching station transformer.

Anyways, on 'possibly lives from extended loss of power.'

Anybody dependant on electricity for life should already have backups as necessary. If you're dependant on electricity to power a charger for your artificial heart, dialysis machine, breathing assistance device**, or whatever, you should have a generator, battery backup, whatever's needed. I mean, the way power delivery goes, local events can take out power to a house/business fairly easily, and are fairly common.

I think one guy with a medical problem requiring frequent access to electricity had the house hookup, a backup generator, and a 12V adaptar for cars.

*If nothing else, dead people tend to be REALLY expensive.
**Though I imagine simple pressurized O2 and an appropriately selected mechanical valve system should be able to eliminate the need for electricity for a good while.

penetration-testing?

[Anonymous Coward]

How do i get a job as a penetration tester? I wonder what that interview would be like?

Re:penetration-testing?

[Anonymous Coward]

If an applicant goes to an interview, then he cannot merit the job.

In penetration testing, the successful applicant hires himself.

Re:penetration-testing?

[gnud]

I wonder how that works as a pickup line.
Hey Baby, have you been with an professional penetrator before?

Pfft..

[dartarrow]

Trinity did it in 3 minutes.

In Leather

Call me paranoid,

[pitchpipe]

but this is why we have one of our operator's desktops totally disconnected from regular TCP/IP networks. It communicates to the rest of the system through PROFIBUS, which would be difficult to hack. If we need to run and all hell is breaking loose (virii, hackers, etc.) we just disconnect from the rest of the world and run. We will lose historical data and remote access, but if we're running the rest is just gravy.

By the power of Grayskull...

[Bob54321]

He better of said "I have the power!" when he finally had access to everything.

Best Job Ever

[SmlFreshwaterBuffalo]

"Trust me baby, I'm a professional. See? It says so right here on my card -- Penetration-Testing Consultant."

Re:free electricity?

[Anonymous Coward]

An unknown someone in Great Britain got free power for an unknown factory for an unspecified amount of time, because they knew another unknown someone at the unnamed power company. Sometime in the late 1940s.

No-one was ever caught.

Cops probably didn't have much to go on, really.

That's a great story. Delivery could use a little work though.

Ira Winkler?

[drakyri]

There's a nice feature on Ira Winkler in attrition.org's charlatan file:

http://attrition.org/errata/charlatan.html#winkler

Security Measures

[Ihmhi]

I should hope that critical things like "TURN THE WHOLE POWER GRID OFF" are not even on a secure server. They should be on terminals that are not even connected to the Internet, much less networked to anywhere else in the building.

It's awfully difficult to hack something when it isn't connected to the Net. Even simple security like multiple checkpoints, a keycard, and several biometric scans (as well as regular, and often, virus and spyware scans) to get to a secure terminal would go well towards protecting the security of our power networks. Hell, post a guard nearby who isn't incompetent.

The one thing Social Engineers/Con Men fear most is challenges - and by challenges, I mean challenges of authority. PROVE you are who you say you are. Check their records against a secure terminal or a hard copy of an employee roster. If anything is remotely fishy, no matter how "important" they say the work is, don't let them past you.

Vigilance is the key, and far too many critical parts of our infrastructure still fail at it to this day.

Re:Security Measures

[HexaByte]

It's NOT just "TURN THE WHOLE POWER GRID OFF" that you have to worry about. The power grid automated when no one worried about computer security, and they still have that old infrastructure in place.

How would you like it if the hackers got into the grid control system and told the IP motors that control the floodgates on the big dams to open all the way, and then send them into a tizzy that burns them out, so they can't be used to shut the gates? How much damage would the downstream flooding cause?

Or how about the test the DHS did, where they gave a generator a command to generate power out of phase with the network, causing it to physically self-destruct? It only takes a few tings like this to screw up the country big-time! And it doesn't have to be done on site, it can be comfortably done from the safety and security of your ChiCom hacker network (they've been walking all over our networks for years) or your zombie bot-net.

I've been sounding the alarm on this for years, (although many others have been doing a far better job, don't want to take credit for others work) and finally the industry is responding. It will take billions to correct it in the US, Europe and Far East, while some poor countries don't have the financial means to do it at all.

Re:Security Measures

[Critical Facilities]

Unfortunately it is never practical to maintain an air gap.

Bullshit. I've worked at several MAJOR data centers with fully integrated Building Automation Systems which were completely separated from the companies' intranets and from the internet. You must bear in mind that this type of security protects BOTH sides. That is, in addition to protecting the B.A.S./SCADA system from outside attack directly, it also prevents someone from being able to access the SCADA system and from there, hack into corporate intranets.

Re:Security Measures

[luciddr34m3r]

Well from the reports of penetration tests I've heard, many places do claim their systems are not connected to the internet, the gap has been bridged by someone, be it management or whomever. Someone above said he's heard of people bridging the networks with IR interfaces. When I interviewed computer security professionals at local power plants for me research on this topic, I was told people connect things to the network all the time that are supposed to be isolated. Even the government's classified network gets bridged to the internet from time to time, and there are strict regulations on the air gap for it. Maybe your companies actually maintained an air gap, but if your entire security method is compromised when someone accidentally plugs something into the wrong port on the wall, you've seriously failed in your duties for security. If you protect it like its on the internet, even when an accident happens and its plugged in you'll be protected.

If they really wanted to protect the grid...

[Anonymous Coward]

They'd post armed patrols out in the mountains..even then good luck.

Why the hell would someone go to all the effort mucking around with computers and hacking and leaving evidence everywhere when they could just go buy a gas axe from the local hardware store and knockdown a few of the big towers and cause havoc for days...and have about 0% of getting caught to top it off.

I was 4wding up in the highcountry near my city the other weekend, driving along the maintenance tracks for the big lines that run from the hydro electricty plant to the city. A gas axe to a few of the supports and you could cut power to the city in an hour. Choose the right towers, remote and hard to get to and it could be out for days. The big lines run through the rugged and isolated mountains for about 100kms (60miles)...good luck stopping someone motivated doing that.

And yet, no one ever has..perhaps, just perhaps there isn't bogey men trying to get us hiding around ever corner?

These 'security experts' that seem to be cropping up left, right and centre these days crying about how unsafe and insecure everything is seem to be little more than a new incarnation of snake oil salesmen.

Rediculous.

Here is a "sane" security measure

[johannesg]

Disconnect the damn control network already. It will be much harder to break into when it is not physically connected to the internet.

Re:Here is a "sane" security measure

[chaoticgeek]

I'm kinda confused by this too, why is the power grid on the Internet? Seems like a very illogical thing to do in my opinion. I think they would have two networks in each building, one for the power grid computers and controls and one for anything that needs access to the Internet. If something has to be transmitted to another building either they need to lay down some sort of infrastructure or use SneakerNet...

Re:Here is a "sane" security measure

[kestasjk]

I'm sure they have a good reason for it; they're not stupid

Re:Here is a "sane" security measure

[somersault]

I'm sure they have a good reason for it; they're not stupid Haaaaaaaahahahahahahahahahaaaaahahahahaa! xD good one

Re:Here is a "sane" security measure

[Anonymous Coward]

SCADA is a classic case of an internal, insecure system being stuck on the net for convenience's sake and everyone pretty much just hoping it wouldn't get hacked. It's surprising there haven't been more compromises (that we know about at least), there are thought to be a lot of vulnerable systems out there. Only one I can recall offhand is when some disgruntled ex-employee of a water treatment plant drove up, accessed their open WiFi and dumped a load of sewage into the river.

Re:Here is a "sane" security measure

[borgboy]

Money. Why else? Private networks are more expensive than plugging into the ol' tubes.

Doesn't make it right. I'm not defending, just pointing out the obvious reason.

Re:Here is a "sane" security measure

[Sleepy]

>I'm kinda confused by this too, why is the power grid on the Internet?

Cost.

In a lot of cases, you have the power company desktops on the Internet and they have their own lan for desktops etc.
But then those computers CAN access the critical systems.
Then they slap a firewall or VPN inbetween the desktops and the critical systems... wow, it's magically OFF THE INTERNETS!

If you disconnect the two LANS, you're much more secure, but then Lazy McFatass has to WALK to a boring green screen to manage it.

It's much cheaper and employee friendly to just let these people access the secure systems from their desktop, using a remote terminal. Very sad, but true... and very risky.

Remember, it was poor desktop security and a WINDOWS VIRUS that knocked out the US Northeast power grid some 5 or 6 years ago.

Machines run Windows

[pembo13]

Not that other operating systems are perfect, but from what I understand, some power grids are mandated to run Windows on as many of their systems as possible - ie. the technician/engineers are not allowed to evaluate what OS best meets their needs.

Seperate networks?

[ludomancer]

Why do we keep critical networks connected to the rest of the net? Why don't resources like these, and the governments, set up proprietary networks that are inaccessible from the global internet base to prevent these sort of things? I never really understood that.

Re:Seperate networks?

[necro2607]

Actually, the particular machines that control the resources are very very probably not online. However, other machines with access to their intranet/LAN are. Get yourself control of one employee's machine and you are then effectively sitting inside the office, with the same level of LAN access as the person whose machine you've gained access to, theoretically...

Re:I hate the term "Social Engineering"

[IBBoard]

"Social Engineering" is using normal behaviour and expectations to get people to do what you want when they're not supposed to, without them noticing.

Lying is telling a falsehood as truth.

Scamming is offering something but never following up, or following up with less than was promised (e.g. bait and switch or fake companies that run off with money).

There's big differences in those definitions.

The most obvious example I know of is social engineering with USB pen drives. A penetration testing company was asked to test corporate security. They did it by leaving a number of USB pen drives around the office. With no lying or scamming, people took the drives, wondered whose it was, plugged it into the computer, and the drive automatically grabbed some data. At the end of the exercise the pen. testers listed the names of people who had connected the drives, even when its origin was unknown. No lying or scamming was involved, but there was a social norm that they exploited as social engineering, which is that people will look to see what is on it to see if they know whose it is. If it had been a virus/trojan then that simple social engineering could have taken down the network, been pumping out spam, or allowed someone access via a back door.

So the Fuck What?

[EdIII]

Nobody would ever, ever, ever take down the power grid. Do you realize the implications of such an act? Screw 9/11 .... We are talking about PORN here. Hundreds of thousands of men that get off work everyday, all at different shifts, and have their pants around their ankles within 10 minutes of being home.

You turn the power off, you take away the porn, the air conditioning for the cold beer, the TV to distract you from your bullshit. You force men to deal with that and I predict a couple hundred thousand men rabidly searching for whoever was responsible for THAT.

Bin Laden has not been found yet, the idiot that takes out the power grid will be found in 30 minutes.....

Re:I hate the term "Social Engineering"

[vux984]

The most obvious example I know of is social engineering with USB pen drives. A penetration testing company was asked to test corporate security. They did it by leaving a number of USB pen drives around the office. With no lying or scamming, people took the drives, wondered whose it was, plugged it into the computer, and the drive automatically grabbed some data.

That is probably the ONLY example I've seen that DOESN'T involve lying or scamming. Usually 'social engineering' refers to calling in to the receptionist, posing as the IT helpdesk, or something else, and then have them tell you their passwords...or type 'arcane things into a command line'...or run the attachment in an email you send them...and they do it without a 2nd thought. And that, would be a clear case of 'lying' or even 'scamming'.

Phishing sites, email spam from 'John' that says "Check out our Vacation Photos", etc also fall under the wide umbrella of 'social engineering'.

Re:I hate the term "Social Engineering"

[IBBoard]

It's the only well known one I can think of, but "check out our vacation photos" is more social engineering than scamming. You're not exactly lying (you can argue you are because you're not actually giving them the photos, or they're not really John, but that's not necessarily the case - they could put the photos up anyway to make it look more legit) and you're not scamming by offering something of value and taking something away from the victim, you're relying on 'normal' human behaviour to go "I don't know who this is, but I'll check out the link anyway in case I can tell from the photos".

Similarly, wearing a fluorescent jacket and working on an exchange box or other equipment isn't lying or scamming anyone, but through social engineering and societal training you'll get away with what you're doing because people go "oh, he's a contractor, he must be doing some contract work".

Ditto for walking in to buildings - we've got guards at the main gates, but once you're in then you can get in to a lot of buildings without question just by looking like you belong and having something pass-like hung around your neck. You're using people's social expectations of "he is on site, has a pass and knows what he is doing so must be allowed here" to get you in to places where your swipe card won't work.

Hilarious editorial problem

[Dekortage]

From the article: "In addition to consulting, Winkler is author of the books Spies Among Us and Zen and the Art of Information Security."

(italics in the original)

Spies Among Us and Zen? Can't wait to read that. And: "Hi, I'm Art. Art of Information Security." Or maybe that is a coffee-table book of famous paintings reimagined through security logs, Matrix-style.

Re:I hate the term "Social Engineering"

[somersault]

If it's an accident then it's a mistake. If it's purposely tring to make someone believe, or knowingly let someone believe something you know to be a lie, then it's deceit.

Re:I hate the term "Social Engineering"

[vux984]

"You're not exactly lying (you can argue you are because you're not actually giving them the photos, or they're not really John, but that's not necessarily the case - they could put the photos up anyway to make it look more legit).

Lying by omission is when an important fact is omitted, deliberately leaving another person with a misconception. This includes failures to correct pre-existing misconceptions. One may by careful speaking contrive to give correct but only partial answers to questions.

Even my 4 year old has no difficulty understanding that weaseling like this is a form of lying. :)

I agree you can engage in social engineering without lying, but its an important and ubiquitous tool of the trade.

As for your uniformed workers, while they don't by definition have to communicate with anyone, odds are they will. And odds are they'll at the very least have a prepared lie to go along with their outfit. Whether or not they use it. Hell, even the guys that went around leaving usb drives probably had a cover story in case someone had confronted them. "I'm just returning it." or "Its got some marketing materials for the new yadda yadda..." or whatever.

die hard

[keirre23hu]

I'm not impressed, the bad guy in the last Die Hard took down the grid in a couple of minutes..

Unnecessary:The Cylons have been gone 40 years now

[boombaard]

Commander Adama: "It's an integrated compter network, and I will not have it
aboard this ship!"
Secretary Rosalyn: "I heard you're one of those people... you're actually
afraid of computers."
Commander Adama: "No... there are many computers on this ship. But they're
not networked!"
Secretary Rosalyn: "A computerized network would simply make it faster and
easier for the teacher's to be able to teach..."
Commander Adama: "Let me explain something to you...
Commander Adama: "... many good men and women lost their lives aboard this
ship, because someone wanted a faster computer to make life easier. I'm
sorry that I'm inconveniencing you or the teachers, but I will not allow...
a network computerized system to be placed on this ship while I'm in
command. Is that clear?"

Re:What kind of oversight do Loyal Bushies give???

[robot_lords_of_tokyo]

It's too easy to blame it on lack of oversight from regulators. The prime people that are responsible for this are the people that run the company, and to a lesser degree, the people that work there.

Re:I hate the term "Social Engineering"

[famebait]

What's wrong with the good old fashioned "lying" or "scamming"?

The problem with them is that they do not denote the subject at hand with the precision required in a serious discussion of security.

Sure, lying and scamming may tools of social engineering, but there are social engineering attacks that do not use those, and there are plenty of lies and scams that do not qualify as social engineering.
I.e. there is an overlap but not congruence. Draw your own Venn diagram if you have to.

They are simply different concepts. Get over it.

cripple the internal network?

[keirre23hu]

The SCADA network is not designed for browsing the internet. It should not be connected.

Security through dis-connectivity is a dangerous myth in most cases. In some cases, say military situations where you are willing to absorb the huge cost to re-implementing a complete replacement for just about every dang thing you might need on the inside (e.g. weather data, or radar data, say) then it may make sense. In just about every realistic corporate case - even power companies - its likely to only cause people to take their eye off the ball of implementing real security and proper firewalls etc. You make a good point here, but I'd argue that, for National Infrastructure Issues (including the power grid), the same security expected of the military should be required. These systems are just as critical. One of the primary diffrentiators between the modern world and the third world is the ability to provide reliable utilities. If the grid went down for any length of time on a national scale.. umm.. it would be a big problem.

Re:I hate the term "Social Engineering"

[IBBoard]

Still, lying or omissions are just an (optional) part of a social engineering "attack", so social engineering cannot be covered by just "scamming" and "lying" - it's a more complex act of sociology and human behaviour.

Besides, are you actually lying when you only tell truths and never say a false word? It is deceit by omission because you're giving a wrong impression by missing out information, but is that lying or is it just deceit as no untruth has been spoken?

Re:I hate the term "Social Engineering"

[Anonymous Coward]

Social engineering IS used by bad guiys, but not everyone who uses it is a bad guy. These sorts of security professionals ARE legitamate, and though they lie to front-line workers, they have (and MUST have) agreements with managment to do it. Otherwise, they're legally liable and can be sued. Part of this agreement, I'm sure, involves "first, do no harm." That's what makes these guys bettert than phishers and hackers.

In order to immunize you from certain diseases a doctor injects you with a vaccine, which is pretty much the same thing but unable to do real harm. once your body knows what the threat is, it can react appropriately when it encounters the actual thing.

Re:I hate the term "Social Engineering"

[g0bshiTe]

I can vouch for this one. I used to do contract work at a military hospital, Portsmouth Naval not that it matters. The work I did was washing windows, still had to have a hard hat. I went through areas of the hospital that I probably shouldn't have, as a shortcut to get to somewhere I needed to be. Radiology, even went through an empty surgery once. Because I was wearing a hard hat, no one ever questioned or asked me to leave or even show ID, or even asked so much as what company I was with. This was all pre 9/11 though so one would hope things are not this lax now.

Call us when you get into the billing system...

[jpellino]

...then you'll have our attention.

Re:I hate the term "Social Engineering"

[aproposofwhat]

That's 'scamming', not spamming, dufus!

Re:I hate the term "Social Engineering"

[DavidTC]

Because, dumbass, it's easy to have walk-in escorted access to most offices on some pretense or another. But they tend to stop you if they see you carrying things out, or even if they see you typing on their computer.

Dropping flash drives, OTOH, is easy.

Take it a step farther

[Gription]

Actually the USB drives don't even fall under the heading of 'Social Engineering'. Social engineering involves communicating with someone. The only way it could be social engineering is if you are interacting with your hardware on WAY to much of a personal level.

Re:I hate the term "Social Engineering"

[FredFredrickson]

Do we need a venn diagram? Come on folks, they're not exclusive! Certain subsets of lying and scamming intersect some subsets of Social Engineering.

Father, I have my foot in your bedroom and also in the hallway. As you can see from my diagram I am not only in the bedroom, I am also in the hallway. - Eddie Izzard

Probably Nonsense...

[mick_stockinger]

I'm not sure I believe the claims being made here. I've worked as a subcontractor in power plants all over North America and I've never seen a single plant where this would even be possible. Power plants have LANs with internet access like every other business, but plant operations, as controlled by the DCS, are completely isolated from the internet. It might indeed be trivial to compromise the LAN, but that is a far cry from actually gaining control of the power block. The DCS does have connections to the outside world in the form of frame relays (sometimes) to power marketing cooperatives (such as ERCOT in Texas...), or telephone access by analog router, but these are highly secure, isolated connections. The analog routers are usually disconnected when not explicitly required for remote support. This appears to me more media-inspired scaremongering.

Re:What kind of oversight do Loyal Bushies give???

[Anonymous Coward]

i'd like to point out once more time that it's impossible to "hack the grid." you can compromise machines inside the control room, but never anything that controls the flow of electrons.

the hardware doing the dirty work is custom-spec stuff running on a completely custom OS. keep in mind this hardware merely guides the engineers, rather than controlling the grid. most power grids in the US are about the same as they were in 1950. in other words, it's controlled by manpower. lots of it. the engineers in charge of the control room have volumes and volumes of binders with step-by-step procedures for each and every adjustment they could possibly make to the flow of power. switching operations, etc are all done by manpower, NOT cpu cycles.

basically, when someone says "you can hack the power grid" it's like they are saying "you can hack a wwII battleship." of course you can't. it pre-dates internet technologies by so much that even the upgraded re-serviced ships have nothing but custom hardware and software sandboxed from any kind of network.

the entire electrical grid's infrastructure is pretty close to being what it was in the 1950's. and when i say "pretty close" i mean that the only real upgrades made to it were in diagnostics and capacity. in other words, they added more transmission lines, and more little gadgets to sense and log data that could be helpful to keeping things flowing smoothly. in actuality the entire system is so antiquated that if network technology as we know it were to be erased, the grid would work just fine. keep in mind the systems the power companies use were developed in-house and custom-tailored to their needs. much like the upgraded wwII battleships the US was using until recently, if all the tech were stripped from it, it would still work fine. instead of accessing the custom-built touchscreen diagnostic panel, you'd pick up the secure internal-only telephone and ask the engineer for readings.

p.s. robot lords: i'm assuming that name is a Clutch reference, and i'm a rabid fan, so hats off to you. (i must have muttered "smile, taste kittens" at least 10 times while writing this)

Re:I blame the cold medicine

[COMON$]

Same way autorun works from a CD :) enjoy!

"Public" utilities

[jabber]

Nuclear plants are part of the "public" utilities that feed the power grid.

You cannot just stroll into a nuclear plant to see how things work.

After your smug and false assertion that you can, everything else you have to say, no matter how "insightful" is may seem to some, is suspect.

Re:I blame the cold medicine

[arminw]

....Same way autorun works from a CD....

Of course this works only in Windows! There you have another reason to use a Mac or Linux. Why, oh WHY does MS program their OS to automatically run whatever crap is on a data storage device?