Slashdot Mirror


US Electricity Grid Reportedly Penetrated By Spies

phantomfive worries about a report in the Wall Street Journal ("Makes me want to move to the country and dig a well") that in recent years a number of cyber attacks against US infrastructure have been launched over the Internet: "Cyberspies have penetrated the US electrical grid and left behind software programs that could be used to disrupt the system, according to current and former national-security officials. The spies came from China, Russia, and other countries, these officials said, and were believed to be on a mission to navigate the US electrical system and its controls. The intruders haven't sought to damage the power grid or other key infrastructure, but officials warned they could try during a crisis or war."

328 comments

  1. Remember, folks... by Anonymous Coward · · Score: 5, Insightful

    ...you must live in perpetual fear. Whenever you're starting to focus on the reality of life, new fear WILL be injected into it to distract you. This is how the natural order sustains itself.

    1. Re:Remember, folks... by riskyrik · · Score: 1, Insightful

      Mod parent up plse. He refers correctly to the type of brainwashing the way the Bush administration has pursuid the last 8 years. Off course there are still a number of elements present that continue this style up to today.

      --
      less is more
    2. Re:Remember, folks... by oodaloop · · Score: 5, Insightful

      Uh, does that mean that there aren't real dangers for which we need to be prepared? Might want to check your bathwater for babies before tossing it out.

      --
      Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
    3. Re:Remember, folks... by Opportunist · · Score: 5, Insightful

      Are there real threats? Yes, of course there are. But when enough scaremongering is mixed into them, you get the reaction that the OP AC shows: Cry wolf once too often and people will ignore you.

      Also, there are a few things that I'd consider a lot more dangerous and worrysome that you don't hear about at all. Intentionally or not, your decision.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    4. Re:Remember, folks... by Thanshin · · Score: 4, Funny

      Whenever you're starting to focus on the reality of life, new fear WILL be injected into it to distract you.

      Oh god! I'm so afraid of the fear injecting big brother.

    5. Re:Remember, folks... by oodaloop · · Score: 4, Insightful

      How is a former official talking about a real threat scare-mongering? Should he have just kept quiet instead?

      --
      Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
    6. Re:Remember, folks... by afxgrin · · Score: 5, Insightful

      Not to mention the creation of an alien enemy. Obviously - OBVIOUSLY - the IP addresses come from Russia and China - and in no way could a proxy be used from those countries - by an American. No way that could ever happen.

      Obviously the spies are Russian or Chinese, because Americans would have no reason to hack into their own government's systems.

    7. Re:Remember, folks... by Opportunist · · Score: 3, Insightful

      There are many real threats (assuming this one is). Why do we get to hear about this one now? Is it coincidence that this surfaces at the 'right' time when security money is being redistributed?

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    8. Re:Remember, folks... by totally+bogus+dude · · Score: 5, Insightful

      Probably not coincidence, but that doesn't mean it's sinister or improper. If you knew of a significant threat that wasn't being addressed, and it was that time when the People In Charge were working out where to spend money (i.e. are actively seeking information and advice on the most effective use of their funds), wouldn't that seem like an ideal time to try to raise awareness of it?

      Or would you prefer to wait until there's no money to spend and nobody currently in a position to do anything about it before announcing it?

      Not saying it isn't all another scam to get free money, but just because it might be doesn't mean it is.

    9. Re:Remember, folks... by Opportunist · · Score: 1

      I guess I, too, have heard the cry about wolves at least once too often...

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    10. Re:Remember, folks... by cayenne8 · · Score: 4, Insightful
      I think the larger, basic question is:

      What the hell are systems like the electric grid doing hooked in any fashion to the publicly accessible internet?? These should be on their own network, separate and apart from anything that touches the public wan.

      Seems like that would have been a no brainer?!?!

      --
      Light travels faster than sound. This is why some people appear bright until you hear them speak.........
    11. Re:Remember, folks... by idji · · Score: 1

      just remember Bruce can handle just about anything

    12. Re:Remember, folks... by kbielefe · · Score: 2, Interesting

      Secretary Gates just announced that he is tripling the number of "cyber experts" trained per year. Since he was really picky about which programs actually got increases in funding among several cuts, I'm pretty sure I wasn't the only one who wondered why he felt cyberwarfare to be deserving, when we haven't heard much about it in the news. Apparently someone in the media wondered the same thing and set out to answer that question.

      --
      This space intentionally left blank.
    13. Re:Remember, folks... by Anonymous Coward · · Score: 0

      >Also, there are a few things that I'd consider a
      >lot more dangerous and worrysome that you don't
      >hear about at all. Intentionally or not, your
      >decision.

      Such as?

    14. Re:Remember, folks... by Anonymous Coward · · Score: 0

      Well, he kind of is. Without a name, he's just an "official." Gotta wonder if this story is true at all. Put a name on the source, and maybe I'll start to feel scared.

    15. Re:Remember, folks... by HangingChad · · Score: 4, Interesting

      In this case the parent is quite accurate. The truth is our electrical grid security has been dismal for decades. Hackers infiltrating control systems is only the latest discovery. If a foreign government wanted to sabotage our electrical grid it would be shockingly easy to do. 5 to 10 people working together with a few resources could black out the entire west coast for weeks if not months.

      Okay, so now they can disrupt control systems from the comfort of their data center. Whoopy do. Yes, fix the data security, but spend the money to make the needed improvements to physical security and redundant infrastructure. Our grid is routinely stretched to the breaking point. There's very little extra capacity. I think of people realized how vulnerable our electrical grid really is, they'd be terrified. The fact electricity is so reliable we take it for granted is testimony to the quality of the people working in the field.

      Imagine living in L.A. or San Francisco with no electricity for a week.

      --
      That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
    16. Re:Remember, folks... by Chabil+Ha' · · Score: 3, Insightful

      Not necessarily. One of the cornerstones of Marxism (gasp!, not in US!) is the concept of perpetual revolution. If there is always a target, always a crusade against the badies, the government can more easily legitimatize and perpetuate bad policy (ie domestic wiretapping). This is always advertised as being for the good (but always at the expense) of the whole of the people. The vain promise, the mirage on the horizon, is a safer, happier people. The world will be secure from the bad guys!

      --
      We're all hypocrites. We all have hidden parts, it's the contrast between them that make us more a hypocrite than others
    17. Re:Remember, folks... by furby076 · · Score: 2, Interesting

      You know, it's not fear mongering or paranoia if someone *IS* actually trying to get you. You don't think there are elements in Russia, China, Iraq, Iran, Afghanistan, North Korea and some other choice countries who are attempting to get us? You don't think any of them are in gov't and planning just in case? You don't think someone in China says "hmm we might fight America one day so lets hedge our bets. If we don't fight we don't activate the code, if we do fight BAM we got em".

      So your statement should be modded more /. then /insightful

      --

      I do not support "The Man". I also do not support your irrational stupidity
    18. Re:Remember, folks... by Curunir_wolf · · Score: 4, Insightful

      Mod parent up plse. He refers correctly to the type of brainwashing the way the Bush administration has pursuid the last 8 years. Off course there are still a number of elements present that continue this style up to today.

      You mean like the Obama elements?

      • "Profound economic emergency"
      • "[could] turn a crisis into an irreversible catastrophe"
      • "paralysis" and "disaster"
      • "the federal government is the only entity left with the resources to jolt our economy back to life."
      • "...but I can tell you with complete confidence that a failure to act will only deepen this crisis...."
      --
      "Somebody has to do something. It's just incredibly pathetic it has to be us."
      --- Jerry Garcia
    19. Re:Remember, folks... by ArcherB · · Score: 2

      I guess I, too, have heard the cry about wolves at least once too often...

      I agree. I too tire of hearing of a different threat every single day. However, if you ignore one of them, and it turns out to be a real threat, thousands or even millions could die and whoever is in charge gets beaten over the head with it for all of history for not taking action.

      Prime example. The President receives a Daily Briefing highlighting security issues. When I say, "Daily", I mean every single day, mentioning various security threats... EVERY DAY! Now, if you let one of them get by without acting, like say one that says, "Terrorists planning to fly planes into buildings", and something comes of it, you will be hounded forever as someone who failed to act. People will say that the blood of thousands is on YOUR hands.

      So, please, try to have some understand as to why these things are taken seriously. I know it's hard, but don't bitch about a President who failed to act and then complain when he does.

      --
      There is no "I disagree" mod for a reason. Flamebait, Troll, and Overrated are not substitutes.
    20. Re:Remember, folks... by wytcld · · Score: 3, Insightful

      If you have segregated networks, all the spy needs to do is find a single place to tap into your "secure" one, and you're toast. You thought it was secure, so you didn't lock it down properly. And somebody, somewhere left a way in, an unguarded terminal, or cheated and put a cross-connect to the public net for his own convenience, thinking it would never be found.

      If it's all on the public net, but thoroughly locked down with good security and encryption protocols, and tight firewalls, you may be in better shape. You know it's dangerous to let your guard down. And we're also pretty confident we have protocols which, when applied to spec, are truly cryptographically strong, and so forth.

      Plus it's a lot cheaper than building out a whole nother net, including access for your critical engineer who's off at a conference somewhere when the unpredicted crisis with the unique system in your plant that she's the genius about requires immediate attention. Sometimes making sure the right people have solid access from anywhere they are is also essential to security. The public net - with the right protocols - does that.

      --
      "with their freedom lost all virtue lose" - Milton
    21. Re:Remember, folks... by bbernard · · Score: 1

      Exactly. As a culture we seem to be almost compulsively obsessed with having everything on the Internet. And let's not forget that the Internet was designed with several assumptions about the basic "good" nature of the people on it (scientists, university students, and the always trustworthy US military) that somehow we figured we should just open up to everyone. So go figure that it is ill-equipped to act as a truly secure system.

      --
      ----- Connection reset by beer
    22. Re:Remember, folks... by Ioldanach · · Score: 1

      Of course, at the same time, does anyone believe we don't do this ourselves, to Russia, China, etc? What's news is their software got found.

    23. Re:Remember, folks... by ArcherB · · Score: 4, Insightful

      Mod parent up plse. He refers correctly to the type of brainwashing the way the Bush administration has pursuid the last 8 years. Off course there are still a number of elements present that continue this style up to today.

      You mean like the Obama elements?

      • "Profound economic emergency"
      • "[could] turn a crisis into an irreversible catastrophe"
      • "paralysis" and "disaster"
      • "the federal government is the only entity left with the resources to jolt our economy back to life."
      • "...but I can tell you with complete confidence that a failure to act will only deepen this crisis...."

      You have the "Create a crisis" part down, but you forgot the "Profit" line.

      "Never let a serious crisis go to waste." -- Rahm Emanuel (Obama's Rove)

      --
      There is no "I disagree" mod for a reason. Flamebait, Troll, and Overrated are not substitutes.
    24. Re:Remember, folks... by wisty · · Score: 3, Funny

      If "they" wanted to do real damage, wouldn't they invade the financial systems, rather than power grids?

      Or maybe they did, but were unable sabotage anything without making it better.

    25. Re:Remember, folks... by Idiomatick · · Score: 3, Interesting

      Followed by 10000 yes we cans. So at least he views the fear as something overcome-able. bush admin was like we are all to live in constant fear forever! Well not so much the bush admin as fox news and friends but then fox anchors get promoted directly into bush government. The whole thing is annoying, america needs to get over its teenage angst.

    26. Re:Remember, folks... by mea37 · · Score: 1

      If you watched any movies about computer security, you'd know... nobody thought they were accessible, but the spies hacked in through the power lines. HTH.

    27. Re:Remember, folks... by Rich0 · · Score: 4, Insightful

      Why not have both? Use the most secure protocols in existence to protect your network, and then as an added measure against zero-day exploits provide strong physical security to keep people out of this network.

      Such a piece of critical infrastructure shouldn't depend on any one human being who might be at a conference and need remote access. When a balistic missle submarine 1000 feet under the ocean is interpreting orders to nuke some foreign country do they depend on being able to reach some particular person to ask questions? Any system critical to national security must be engineered so that it is completely self-sufficient in a crisis.

      Electrical grids are very critical to national security. A well-planned attack could leave melted transmission lines, damaged generators and gearboxes, and a nationwide blackout in its wake. With the possibility of substantial physical damage it isn't like you could just repair from this kind of catastrophe in a few days - or even weeks. Power plants are physical machines that have a symphony of fast-moving parts with thousands of tons of force being transmitted - a well-engineered attack could result in major failures.

      Power grids should have as much security as any other piece of critical military infrastructure. They're going to be targets in any attack. The networks should be subject to routine penetration testing and auditing. Access needs to be the minimum needed to do any particular job. The system should be reasonably partitioned so that one spy getting a job in one office somewhere doesn't subject the entire system to compromise. Those who circumvent authorized procedures (rogue access points, bridges, etc) should be made public examples with criminal penalties. People should be given the funds needed to do their jobs right, and then should be expected to do them right.

      Security is just a matter of being thorough and not cutting corners. There is a lot at stake here. I don't really care who is behind these penetrations (Chinese, hackers, whatever) - the blame rests with the folks who should be protecting this infrastructure.

    28. Re:Remember, folks... by Anonymous Coward · · Score: 0

      hack into their own government's systems.

      Last time I checked, the electrical grid was owned by public and private companies, not the US government. But have no fear - Obama will find a way to take it over just like a good fascist.

    29. Re:Remember, folks... by Anonymous Coward · · Score: 1, Funny

      because Americans would have no reason to hack into their own government's systems.

      No they wouldn't. All of America's problems have been fixed. Your racism is blinding you to this fact.

    30. Re:Remember, folks... by PacoCheezdom · · Score: 0, Offtopic

      When a ballistic missle submarine 1000 feet under the ocean is interpreting orders to nuke some foreign country do they depend on being able to reach some particular person to ask questions?

      Yes, actually. He's called the President.

    31. Re:Remember, folks... by Opportunist · · Score: 5, Insightful

      I can well understand that. And I actually see the whole deal as an attempt to cover their butts to show that they "did something" concerning the threat. They'd be eaten alive by the media if something happened and nothing had been done.

      9/11 is a prime example. What was the first thing we heard? The FBI knew ages before the attack that something like this was planned. Sure they did. And they also heard about a thousand other things that never happened.

      You cannot prepare for everything. I do not expect that. I do expect reasonable preparations, at the most. My liberty is worth more than my life, and I do expect my government to primarily protect my freedom. If the solution to the terrorist craze is to eliminate all freedom then, well, why bother fighting? After all, a regime of terror, fear and total control is pretty much what the terrorists allegedly want to create for us. If we do that ourselves, do we really win?

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    32. Re:Remember, folks... by ch33zm0ng3r · · Score: 1

      Uhhh... how else are they going to install windows security updates. Duh.

    33. Re:Remember, folks... by Anonymous Coward · · Score: 0

      Agreed! I could see a modest exception for some outputs, such that you can monitor status. (Watch for various levels or alarms currently in the system.) But there should not be any means of input to such system from the public accessible side of the network. You should not be able to throw any switches, alter monitoring information, trigger remote alarms, or affect the functioning of related auxillary support equipment. All those type of operations should require physical access or operation from a completely internet-isolated network.

      Now if it's because some dumbass decided that it might be a good idea to outsource the operation of control systems related to vital U.S. infrastructure, that person needs to be brought before the public. And then while before the public, that person should have their gonads connected to an internet controled electrical power source. Afterall, they're putting the needs of the public into the same situation, it should be good enough for them too.

    34. Re:Remember, folks... by SirGeek · · Score: 4, Insightful

      If you have segregated networks, all the spy needs to do is find a single place to tap into your "secure" one, and you're toast. You thought it was secure, so you didn't lock it down properly. And somebody, somewhere left a way in, an unguarded terminal, or cheated and put a cross-connect to the public net for his own convenience, thinking it would never be found.

      Tha WOULD require them physical access to the facility. None of the control centers are going to just "allow" someone access to their network, let alone physical access to the facility. We are told to notify security (who will notify the police officer in the guard shack) if we see anyone who isn't badged.

      If it's all on the public net, but thoroughly locked down with good security and encryption protocols, and tight firewalls, you may be in better shape. You know it's dangerous to let your guard down. And we're also pretty confident we have protocols which, when applied to spec, are truly cryptographically strong, and so forth.

      The Control Centers aren't supposed to take that risk. Its separate the control centers from the company network AND from direct access to the internet.

      Plus it's a lot cheaper than building out a whole nother net, including access for your critical engineer who's off at a conference somewhere when the unpredicted crisis with the unique system in your plant that she's the genius about requires immediate attention. Sometimes making sure the right people have solid access from anywhere they are is also essential to security. The public net - with the right protocols - does that.

      Is it ? Can you honestly say that even the remote possiblity of a compromised system is worth the cost savings if it affects that existence of your company (as a control center) ?

      You have THAT room connected to specific routers that only allow "limited" access and ensure that the users can't install software that would compromise that system. You block their access to ANYTHING that they don't need for business reasons. PERIOD.

    35. Re:Remember, folks... by Anonymous Coward · · Score: 0

      Imagine living in L.A. or San Francisco with no electricity for a week.

      Well, some body enhancements can still be done without electricity, so I fail to see your point.

    36. Re:Remember, folks... by Anonymous Coward · · Score: 0

      Okay, just let me see...

      Oh, yeah, there it is. There's this unimportant conference going on over in Great Britain right now between some little countries over some really unimportant stuff that couldn't possibly require the US to have some sort of backing from its citizens. Yeah, you're right. just a coincidence.

      READ THE FSKING PAPERS.

    37. Re:Remember, folks... by cayenne8 · · Score: 2, Insightful
      "When a ballistic missle submarine 1000 feet under the ocean is interpreting orders to nuke some foreign country do they depend on being able to reach some particular person to ask questions?

      Yes, actually. He's called the President."

      Trust me...when those subs get their orders, and they are verified by the means they use. They do NOT resurface to radio in and ask the president "Are you really, really sure?"

      --
      Light travels faster than sound. This is why some people appear bright until you hear them speak.........
    38. Re:Remember, folks... by SoulRider · · Score: 1

      1). The "former official" didnt identity himself. So either he is just trying to conjure up fear or he messed up during his stint in homeland security and is trying to cover up. There is no accountability to the claims being made. A "former official" just makes him sound pissed off he lost his job and is looking to discredit his former employer.

      2). There is no real information as to what was installed, and what effect it would have on our electrical infrastructure. Basically the story says "Some random Chinese/Russian guys installed some program on a computer".

      3). If this was a real threat it would have been silently cleaned up and no one would have heard about it. Unless this person was incompetent and left these "security threats" in place just so he could make these claims at a later time, which is much scarier than the original threat.

      What is it with conservatives and fear? They just cant seem to go an entire day without having to scare themselves into a tizzy. I feel sorry for them.

    39. Re:Remember, folks... by Anonymous Coward · · Score: 1, Interesting

      The problem is that people are people, and once someone in a location that should be secure realizes that there is access to internet resources, you have wireless routers poping up like weeds. Then it becomes a matter of public perception of the people whom work at the location...Joe is a Hero because he has brought internet to the secure location, IT are EVIL because they removed the router giving us access to Pron, NPR, Stocks, ETC... If you can design drills of things failing after the connection to the internet has been established, then they may learn the lessons the hard way. (LAST TIME SOMEONE PLUGGED US INTO THE INTERNET, ALL OUR SYSTEMS WENT HAYWIRE AND WE SPENT A WHOLE DAY SORTING THINGS OUT...YOU CAN KEEP YOUR INTERNET)

    40. Re:Remember, folks... by furby076 · · Score: 1

      I am sure nobody on /. doubts it, well there is always one person on /. who doesn't own a tinfoil cap. Obviously we have trojans in other countries' computers. This is how we help ensure we win the digital war *IF* it happens. Then again not all of our enemies rely on computers like we do (e.g. Al Qaeda). I doubt there are many reporters out there who would choose to pass up a story like "This just in US military trojans found in Russian computer systems..." Then again, it may not have made news if Russia didn't leak it. Remember some countries are more tight lipped about their security breaches. Our government, compared to others, is REALLY open about their secrets. You think China or N. Korea is going to admit they got infiltrated by the weak and evil American empire? Hell right now N. Korea is stating their new satelite is beaming down music to their people...though nobody else has (that i've heard of).

      --

      I do not support "The Man". I also do not support your irrational stupidity
    41. Re:Remember, folks... by agent_blue · · Score: 0, Offtopic

      Unless you're Denzel Washington: http://www.imdb.com/title/tt0112740/

    42. Re:Remember, folks... by furby076 · · Score: 2, Insightful

      Are there real threats? Yes, of course there are. But when enough scaremongering is mixed into them, you get the reaction that the OP AC shows: Cry wolf once too often and people will ignore you. Also, there are a few things that I'd consider a lot more dangerous and worrysome that you don't hear about at all. Intentionally or not, your decision.

      I disagree with your cry wolf. Lets say someone says there is a threat and everyone needs to be prepared and we are going to invest tons of resources to stop the threat. Now we stopped the threat before anything happened. Does that mean we cried wolf? I am willing to bet you a lot of people, including a hell of a lot of people here, would say "CRY WOLF CRY WOLF" when in reality - the threat was stopped due to our efforts. Then again, if we didn't stop the threat people would say "why didn't you do anything? We had evidence this was going to happen and you ignored it. Shame on you" That situation could...oh wait, it did happen...9/11. Has anything like that happened since? No. Does that mean it can't ever happen again? No. Maybe part of the reason is due to our increased security, maybe just luck, and maybe because our gov't thwarted those events. We don't get to see the whole picture all the time. While this may hurt your feelings, it is necessary (I am sure there have been times in your life you avoided telling someone the whole truth for their own good).
      Is there fear mongering? Yes. Are there people who want to spend more money to line their pockets and nothing else? Obviously. Does that mean we should not take every possible precaution to help save people's lives? Hell no. I would rather spend too much money and potentially save a life then spend too little money and potentially lose a life.

      --

      I do not support "The Man". I also do not support your irrational stupidity
    43. Re:Remember, folks... by T.E.D. · · Score: 1

      When this comes out coincidental with a new administration publicly pondering how much money to cut from their budget, yes it smacks quite considerably of scare-mongering.

    44. Re:Remember, folks... by santiagodraco · · Score: 1

      Don't confuse the press's fearmongering to sell ad space and your own political conspiracy theories.

      These theats are real. Just because you want to believe that they are only public in order to distract us from other things....

      I wonder, how many of you are "distracted" by these things from the other troubles, like the economy? I bet none. So exactly what are we being distracted from anon? Book burnings?

    45. Re:Remember, folks... by LeafOnTheWind · · Score: 0, Offtopic

      Mods sure are dumb today. This is the stupidest thing I've ever heard.

    46. Re:Remember, folks... by Anonymous Coward · · Score: 1, Interesting

      Honestly? If there was no choice between US fascists and some foreign regime based on Islam, I'd pick the US fascists. At least I'd be able to live in the 1930's instead of the 14th Century.

      Even at its worst, the junk that the wingnuts in government keep throwing at us at least gives lip service to the concept of liberty and the ability to live in a modern age. Islamo-radicals are making no such promises.

    47. Re:Remember, folks... by red90tsi · · Score: 0

      Psh, you have never seen Ocean's 11 then... its so easy to obtain a fake badge and get physical access to something like a computer terminal.

    48. Re:Remember, folks... by oodaloop · · Score: 1

      The "former official" didnt identity himself...What is it with conservatives and fear?

      Uh, how did you determine his political affiliation if he didn't identify himself?

      --
      Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
    49. Re:Remember, folks... by Mr.+Firewall · · Score: 2, Insightful

      ...you must live in perpetual fear. Whenever you're starting to focus on the reality of life, new fear WILL be injected into it to distract you.

      Nice bit of cynicism, I like it. But as a former cybersecurity professional who has worked inside of electric power plants, let me remind you that there is a difference between scaremongering (ala Global Warming, mass extinction, and other such nonsense) and REAL threats such as that in TFA.

      I've known for years about this threat. It's nice to finally see someone in the mainstream press take notice.

      Unfortunately, I'm not optimistic that THE solution will ever be seriously considered: QUIT USING WINDOW$ ON CRITICAL INFRASTRUCTURE CONTROL SYSTEMS.

      --
      In times of universal deceit, telling the truth gets you modded -1 Troll
    50. Re:Remember, folks... by SoupGuru · · Score: 1

      It is amazing, isn't it, how our physical infrastructure just sits out in the open? Substations surrounded by chain link fences with those transformers just sitting there. Miles of transmission line in the middle of nowhere.

      Network security is important, don't get me wrong. We don't want to make it too easy, but seriously, the physical infrastructure is sitting right there in front of everyone and it doesn't take much of an imagination to see the weaknesses.

      --
      What doesn't kill you only delays the inevitable
    51. Re:Remember, folks... by Anonymous Coward · · Score: 0

      Remember, folks, you must live in perpetual fear. Whenever you're starting to focus on the reality of life, new fear WILL be injected into it to distract you. This is how the natural order sustains itself.

      The natural order... AKA Fox News.

      Fear!! Fear!!! There is nothing conservatives do not fear!!!

    52. Re:Remember, folks... by Tweezer · · Score: 1

      Because it is a business requirement. These systems are on isolated networks with firewalls and such, but due to utility deregulation and going to an energy market based system there is a need to get data out of the control systems into marketing systems. Any company that doesn't do that will be at an economic disadvantage to their competitors.

    53. Re:Remember, folks... by TheBig1 · · Score: 2, Informative

      I assume this was meant as a joke, but seriously, if you were able to take out a large portion of the power grid for any sustained length of time, it would have a huge economic impact. Just from the loss of money while businesses and industries are unable to function would add up to millions, if not billions. That's not even counting the looting and rioting (come on, you know it would happen!)

      Cheers

    54. Re:Remember, folks... by robertintexas · · Score: 1

      Balance young padawan. You must have balance. (And some common sense.) You point out a potentially extreme view concerning infrastructure security and in doing so, you find yourself at the opposite extremity. Aren't you watching 24 Season 7? That's exactly what the evil warlords of Sangala did! Man!! I can't believe you weren't aware of that. Wake up man! wake up!!! :)

    55. Re:Remember, folks... by ovu · · Score: 2, Funny

      +1 ugh for living in LA for a week even WITH the electricity!

    56. Re:Remember, folks... by vertinox · · Score: 1

      Tha WOULD require them physical access to the facility. None of the control centers are going to just "allow" someone access to their network, let alone physical access to the facility. We are told to notify security (who will notify the police officer in the guard shack) if we see anyone who isn't badged.

      If you haven't studied espionage in the USA, the majority of the spies caught (ie Aldrich Ames) were people who worked for the organizations in question, but were bribed by a foreign government.

      Your suggestion is made a moot point because the person would be allowed physical access to the facility with no question because they worked there.

      --
      "I am the king of the Romans, and am superior to rules of grammar!"
      -Sigismund, Holy Roman Emperor (1368-1437)
    57. Re:Remember, folks... by Anonymous Coward · · Score: 0

      What is it with conservatives and fear? They just cant seem to go an entire day without having to scare themselves into a tizzy. I feel sorry for them.

      Because they think it's the best way to get other citizens go along with their agenda of hating the 'Others' - foreigners, "the" terrorists, and anyone who doesn't share their religious, social, or economic views.

    58. Re:Remember, folks... by pixelpusher220 · · Score: 1

      The 'crying wolf' has been done for the last 6 years, piling on the fear of another 9/11.

      *IRAQ* - ZOMG Saddam has bad things! we must overthrow him (and label anyone who disagrees as unpatriotic) oops, he didn't have bad things and we made up stuff to look like he did.

      A story that is sourced based on 'unnamed *former* security professional' just doesn't cut it anymore as a reliable source.

      Another good indication this is fear mongering will be the proposed remedy. If they say we need all sorts of new safety measures and lots and lots of money, be warned. All they need to do is disconnect the damn control systems from the internet as others have posted. If its that critical, you don't put it on a publicly accessible network.

      --
      People in cars cause accidents....accidents in cars cause people :-D
    59. Re:Remember, folks... by yerktoader · · Score: 1

      They do NOT resurface to radio in and ask the president "Are you really, really sure?"

      Correct. The Windows based message drafting software does...

    60. Re:Remember, folks... by yerktoader · · Score: 1

      If the point were moot, wouldn't classified military networks would be connected to the public internet?

    61. Re:Remember, folks... by JWSmythe · · Score: 1

          You shouldn't have posted anonymously. Thats reserved for annoyances. :)

          You're actually right.

          This was a stupid assumption. First, why do they have the power grid systems available via the public internet?! Do you want Homer Simpson surfing the net from the reactor monitoring systems? I've always felt more comfortable with him just drinking coffee and eating doughnuts. :)

          Is every person who tries to get into a system from another country a spy? Hell, the spies are after my equipment too! Oh no! I see foreign IP's trying to connect to various access ports (like, telnet, SSH, FTP). Oh my gosh, the spys are after us. Oh wait, maybe they are people trying to get in, but I'm pretty sure none of my equipment is related to any critical infrastructure. :) They're just trying to get into anywhere they can. From what I've seen, they'll either try to deface websites, or run IRC bots, or stage to launch secondary attacks to do one of the previous two. Some will (oh my gosh) try to pull billing information, so they can use credit cards. Again, it's not an evil foreign nation doing it, it's someone trying to make (steal) a buck.

          Really, if you don't have a good look at what they're doing, you can't just assume that their attacks are to control or disrupt the service that you run. That is unless you have the firm belief that the world rotates around you.

          They only cite ONE incident where a power grid was taken control of, and extortion money was requested. Governments don't do extortion. Well, not blatantly. They could seize control preceding an attack. Has China or Russia staged for a ground attack on American soil? That's news to me. They could use it to destabilize a government or population. Who is to gain in China messes up America? They're well invested in America now, it's in their best interest to ensure America is a stable economic country so they can make their money selling us cheap imports. If the power grid becomes unstable, people are going to be concerned about that, not going to Walmart to buy more Chinese made crap.

          I'm really surprised that they'd do anything over the public Internet. Why isn't it all run over private loops? Internet based, sure, but not actually accessible via the public Internet.

          This is just scare tactics. Unfortunately, it's going to work for 99% of the American population. "Oh my gosh, the Communists are coming!" I know I'm preaching to the choir here though.

      --
      Serious? Seriousness is well above my pay grade.
    62. Re:Remember, folks... by Anonymous Coward · · Score: 0

      Imagine living in L.A. or San Francisco

      Oh, the torture!!!! I've been there, can't see how or why they do it.* (* but the weather sure is nice)

      with no electricity for a week.

      No air conditioning? Worse, no way to charge iPods! OMG! It would be like living in the ... 1980s.

    63. Re:Remember, folks... by ZFox · · Score: 1

      That's where the "grid" in electrical grid comes in.

    64. Re:Remember, folks... by Langalf · · Score: 1

      Unfortunately, I'm not optimistic that THE solution will ever be seriously considered: QUIT USING WINDOW$ ON CRITICAL INFRASTRUCTURE CONTROL SYSTEMS.

      I second that! I cringe every time a vendor comes in with yet another new Windows-based control system. Ye Flipping Gods! Windows should not be anywhere near a control environment.

    65. Re:Remember, folks... by cayenne8 · · Score: 1
      "Uhhh... how else are they going to install windows security updates. Duh."

      Easy...you download the updates on a machine hooked to the outside world. You burn it to some medium (CD, DVD, usb drive).

      YOu take it in...and of course...test it on your dev systems first (certainly you don't go straight to prod machines, right?).

      And you decide if and what updates are needed. Most of the security updates are for windows machines that ARE exposed to security risks on the outside. Not as much need for that if your boxes are never exposed to the 'outside'.

      --
      Light travels faster than sound. This is why some people appear bright until you hear them speak.........
    66. Re:Remember, folks... by cayenne8 · · Score: 1
      "The problem is that people are people, and once someone in a location that should be secure realizes that there is access to internet resources, you have wireless routers poping up like weeds."

      Hmm..I guess all the places I worked at, take security a little more seriously than that.

      If you get caught plugging in ANY unauthorized devices to our networks, it is detected, and you will be immediately escorted off the premise, fired...and no questions asked.

      On something important like a power grid, it is a secure item...and this type policy should be implemented if it isn't already. Some things, you just don't play with.

      I almost always work on secure systems like this, and I don't find it any type of impediment to getting my job done.

      --
      Light travels faster than sound. This is why some people appear bright until you hear them speak.........
    67. Re:Remember, folks... by Fulcrum+of+Evil · · Score: 1

      if you let one of them get by without acting, like say one that says, "Terrorists planning to fly planes into buildings", and something comes of it, you will be hounded forever as someone who failed to act. People will say that the blood of thousands is on YOUR hands.

      Not really. You'd have to ignore the briefing and the warnings of the outgoing president about the guys suspected of planning the attack and also cut funding for monitoring of same said baddies. Then, when the attack happens, continue reading to schoolchildren while you desperately try to figure out what to do.

      But this is all purely hypothetical, right?

      --
      "We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
    68. Re:Remember, folks... by Anonymous Coward · · Score: 0

      I have managed dozens of routers and servers directly connected to the internet. I would guess that 90% of the password-guessing, brute force attempts to log in to my hosts via ssh and telnet come from inside China. Yes, those could be proxies and the login attempts could be coming from Jack Fucking Bauer himself. But I doubt it.

    69. Re:Remember, folks... by geminidomino · · Score: 1

      Even at its worst, the junk that the wingnuts in government keep throwing at us at least gives lip service to the concept of liberty and the ability to live in a modern age. Islamo-radicals are making no such promises.

      "Lie to me, as long as they're pretty lies..."

    70. Re:Remember, folks... by KnowledgeKeeper · · Score: 1

      ...you must live in perpetual fear. Whenever you're starting to focus on the reality of life, new fear WILL be injected into it to distract you. This is how the natural order sustains itself.

      Funny, though, hearing this from Anonymous Coward :D

      --
      It is always better to be a first grade version of yourself than a second grade version of someone else.
    71. Re:Remember, folks... by Anonymous Coward · · Score: 0

      If any significant portion of the grid went down for more than about 2 weeks, it would probably never come back online.

    72. Re:Remember, folks... by Anonymous Coward · · Score: 0

      Tha WOULD require them physical access to the facility. None of the control centers are going to just "allow" someone access to their network, let alone physical access to the facility. We are told to notify security (who will notify the police officer in the guard shack) if we see anyone who isn't badged.

      Is it easy to fake a badge? I attended a presentation where the presenter was hired as a whitehat, made a fake badge that looked legit, and walked in with a group of employees. He was then able to infiltrate the network.

    73. Re:Remember, folks... by sgt_doom · · Score: 1

      Given the Wall Street Jihad (you know, those Group of Thirty guys, operating through the Wolfsberg Group members, and their lower-level operational entities, InterContinental Exchange, TradeSpark, Markit and Markit Wire, etc., screwing us all to hell in their economic "meltdown") will anyone have any money left to afford any electrical grids????

      Yeah...I know...and I appreciate the sarcastic comment of your excellent remark, afxgrin, it was highly intelligent and highly appropriate.....

    74. Re:Remember, folks... by Anonymous Coward · · Score: 1, Funny

      5 to 10 people working together with a few resources could black out the entire west coast for weeks if not months.

      lucky for me i am on the east coast

    75. Re:Remember, folks... by sgt_doom · · Score: 1

      Obviously, so that novelists like John Sandford can write a novel (I forget whether it was the Empress File or the Devil's Code where the supporting character, a hacker, manipulated the electrical grid at where the bad guys were to shut them down.

    76. Re:Remember, folks... by actionbastard · · Score: 1

      That there are still public officials and CEOs of public utility companies, that are in charge of critical nationwide infrastructure, that think it's okay for these things to still be connected to the Internet.
      It's not the terrorists that you should be afraid of.

      --
      Sig this!
    77. Re:Remember, folks... by Fulcrum+of+Evil · · Score: 1

      The 'crying wolf' has been done for the last 6 years, piling on the fear of another 9/11.

      Try 20-30 - ever since reagan, there's always been some bogeyman to fear. We can't seem to shake the cold war.

      --
      "We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
    78. Re:Remember, folks... by Anonymous Coward · · Score: 0

      A lot of things you would think apply to the control centers and regional coordinators simply are not implemented that way in reality. I can simultaneously remotely log into at least three separate control networks from my home with full control authority. It's stupid in the extreme, but in the face of business justifications most of the "well duh" security questions wither and die in committee.

      I'm not at all surprised you can get into grid controls at numerous utilities. I'm willing to bet I know the default passwords to half of them, which will never be changed because the desire to keep reliability with minimal effort in a complex computer system is a more immediate and overriding than any impetus created so far to do it right.

      After 9/11 the utilities sector went into panic mode and took great strides to try and secure their systems, with varying levels of effectiveness. Idaho National Labs in particular has a fairly aggressive information security program. The sphincters have since relaxed and will remain relaxed, implementing NERC/FERC guidelines as loosely as possible, until the next major panic happens. This may be when the first multi-million dollar fines go out next year, but who knows.

    79. Re:Remember, folks... by Anonymous Coward · · Score: 0

      Not to mention the creation of an alien enemy. Obviously - OBVIOUSLY - the IP addresses come from Russia and China - and in no way could a proxy be used from those countries - by an American. No way that could ever happen.

      Obviously the spies are Russian or Chinese, because Americans would have no reason to hack into their own government's systems.

      "The spies came from China, Russia, and other countries." In that context, the USA is an "other country", i.e. not China or Russia. So it could still be here (there if you're somewhere else).

      "Makes me want to move to the country and dig a well." I live in the country and have a well. I still need electricity though (no generator, solar, wind).

    80. Re:Remember, folks... by Captain+Nitpick · · Score: 2, Informative

      I assume this was meant as a joke, but seriously, if you were able to take out a large portion of the power grid for any sustained length of time, it would have a huge economic impact. Just from the loss of money while businesses and industries are unable to function would add up to millions, if not billions. That's not even counting the looting and rioting (come on, you know it would happen!)

      Define sustained. Storm-related outages lasting a week or more are not rare, and do not lead to riots or widespread looting. This idea that power outages equal riots seems to stem from the 1977 NYC blackout, but that was a match in a fireworks factory. Most outages are just a bloody nuisance.

      --
      But then again, I could be wrong.
    81. Re:Remember, folks... by HiThere · · Score: 2, Insightful

      Actually, it's a lot more common than that, if you study history. Whenever one group feels unfairly suppressed, and the means of suppression is disabled more than temporarily, you're apt to have an, at least minor, uprising. It usually doesn't lead to anything more than worse oppression in the future, of course, but it is a predictable result. (Doesn't *always* happen, but it's the way to bet.)

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
    82. Re:Remember, folks... by Ashriel · · Score: 1

      That is a straw man argument. No nation on this earth has the power to invade and take over the U.S. Even if they could somehow get past the physical isolation of the country and it's ginormous military and move in a large occupying force, they'd find a hostile, technically capable, and armed populace who wouldn't stand for it.

      The choices we have are between U.S. fascism with some terrorist attacks, and U.S. liberty with slightly more terrorist attacks. Out of those two, which would you pick?

    83. Re:Remember, folks... by HiThere · · Score: 1

      No. The electrical control network was originally totally separate from the net. It should have been kept that way. If it wasn't, it was a bad decision.

      (I remember reading about a nuclear plant whose control network got connected to the net for the convenience of monitoring...so it isn't always beancounters making the boneheaded decision.)

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
    84. Re:Remember, folks... by Ashriel · · Score: 1

      Your suggestion is made a moot point because the person would be allowed physical access to the facility with no question because they worked there.

      In that situation, no amount of information security is going to help in any case.

    85. Re:Remember, folks... by HiThere · · Score: 1

      That wasn't Marxism, though it might have been Leninism...I've not read what he wrote.

      Marx got a lot of things wrong, but he was an academic (of a peculiar stripe, admittedly) and didn't worry a lot about how to motivate people. (Well, it's been a few decades, so he may have mentioned it, but it certainly wasn't anything near central to his writing.)

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
    86. Re:Remember, folks... by HiThere · · Score: 1

      On further contemplation I think you got that bit about "permanent revolution" from Orwell. I'm not going to re-read him and find out where, he was just too totally depressing. (Right more often than not, but still depressing.)

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
    87. Re:Remember, folks... by Anonymous Coward · · Score: 0

      Which is why I say we keep our guns. I'm in the U.S. and would rather pick liberty with a few more terrorist attacks.

    88. Re:Remember, folks... by freyyr890 · · Score: 1

      Don't be so sure of your bulletproof defense. While it is true no single nation can invade the states on its own, an alliance of multiple superpowers might be able to take it out.

      Ignoring the obvious political and ideological hurdles, a Russia/China alliance could pull it off. Hypothetically, if they had a few years isolation to build up a decent bluewater navy, they might be able to land troops on the mainland.

      Actually, if limited tactical nuclear war was fought, Russia might be able to pull it off on its own. The Soviets saw the US Carrier Strike Group doctrine as their chief obstacle to taking the states. As such they ensured the Red Fleet had nuclear naval superiority to outmatch US conventional naval superiority. At the end of the cold war it was projected that this nuclear superiority could overwhelm the carrier groups. I'm not sure how much it would take to resume that level of readiness.

      The point still stands, however, that there are foreign alliances that could take out the states given sufficient preparation.

    89. Re:Remember, folks... by Dextrously · · Score: 1

      From what I have been told, Military type defense practice "Defense in Depths". There are multiple layers of security. In other words, it is not enough to simply have encryption, or tight firewalls, or a secured facility with controlled access levels, or a private network. You can expect a good military controlled facility to have *all* of these things, and likely more.

      Secured Facility, Private isolated network, secured switching, end-to-end IPSEC encryption, tightly controlled network resources based on Access Levels, unscrupulous automated monitoring.

      Your best, and possibly only way into this sort of setup is through the users. However, I hear the military is researching a fix for this. I think they were calling it Skynet. It is supposed to remove the error prone human access from critical resources such as these with a more competent and logical artificial intelligence. Our salvation is nearly at hand! ;D

    90. Re:Remember, folks... by Walkingshark · · Score: 1

      Imagine living in L.A. or San Francisco with no electricity for a week.

      I think if you really want to motivate the people with enough power to matter, you have to put it in personal terms that they can understand:

      Imagine living in L.A. or San Fransisco with no Blackberry for a week.

      There, that should get things fixed in short order.

      --
      The world you experience is only a close approximation of reality.
    91. Re:Remember, folks... by Swave+An+deBwoner · · Score: 1

      It doesn't have to be "either/or". Just as we strive for "defense in depth", I'm sure that an attacker prefers "offense in depth". Hit the power grids, hit the financial systems, hit the communications networks. Then, when we are preoccupied, scrambling to fix all that, hit your real target without much resistance.

    92. Re:Remember, folks... by Anonymous Coward · · Score: 0

      thats funny, as I manage servers in China, and most of my hacking attempts come from the US, Brazil and Italy (in order of attacks).

      You damn americans...

    93. Re:Remember, folks... by cffrost · · Score: 1

      Imagine living in L.A.

      Hell no.

      --
      Thank you, Edward Snowden.

      "Arguments from authority are worthless." —Carl Sagan
    94. Re:Remember, folks... by toddestan · · Score: 1

      Storm-related outages are fairly well understood. You know what caused it (the weather), and you know how to fix it (find and repair the damaged parts). It's happened enough that we know about how long it's going to take to repair. They also are fairly localized - for all but the worst you're a short drive away from a place that has power, and people are willing to help out with supplies and such. In other words, things are under control, and people deal with it.

      Now, if you have computer hackers shutting down parts of the grid, people aren't going to know what (and who) knocked out their power, how to the problem is going to be fixed, and how long it's going to take. Outages could be more widespread, and those with supplies are going to be more likely to hoard them, given the unknowns. People are going to be on edge, and I could see riots happening if people don't see that things are under control and they aren't able to get supplies.

    95. Re:Remember, folks... by canadian_right · · Score: 1

      Yes, there are real threats, like driving your car to work which kills more people every year in the USA than all terrorist attacks against USA citizens combined.

      Of course you want your government to work to prevent terrorist criminals, but it isn't something the average person needs to fear for even one second.

      --
      Anarchists never rule
    96. Re:Remember, folks... by canadian_right · · Score: 1

      All well run utilities have the P&C (Protection and Control) networks completely seperate from the internet. Leased lines, private micro-wave, lines run specially for the utility, all are used. The internet is not. The only part of our IT infrastructure on the internet is the public facing web interface for bill paying, and information, and that has very effective firewalls isolating it fom the rest of the IT network. NONE of the IT and normal work/office networks even connect to the P&C network. You have to be in one the control stations which have limited access, and actual physical security since 9/11.

      Any utility that allows any part of its P&C network on the internet is insane, and should fire the person responible.

      --
      Anarchists never rule
    97. Re:Remember, folks... by akpoff · · Score: 1

      Imagine living in L.A. or San Francisco with no electricity for a week.

      Good point but not big enough. Immediately following Hurricane Ike most of Houston and surrounding the area were without electricity. Large swaths of the city were without electricity for a week. Many areas for more than a week. Some for several weeks. It was a pain but we got through it.

      We got through it, though, because Austin, Dallas and other nearby cities still had functioning infrastructure. Many people evacuated to those cities but more importantly, because of they were functioning and because businesses like Home Depot, HEB and Wal-Mart could pre-stage trucks in those cities, critical supplies could still get here...including gasoline which many, though still a very small percentage, used to run home generators.

      You need to talk in terms of the entire west coast and perhaps most of the southwest shutting down to really be talking catastrophe that would make living in LA or SF truly unbearable.

    98. Re:Remember, folks... by Anonymous Coward · · Score: 0

      ... they'd find a hostile, technically capable, and armed populace who wouldn't stand for it

      No, actually your fat is not going to stop the bullets not halt tanks, I know McDonalds tries but not, your fat can't do that. And by technically capable you mean those people that don't believe dinosaur ever existed, technically as in "I'm going to kill you chink with mai Ethernet cablez"?. Armed populace? Are you Mexican? WTF are you talking about?

    99. Re:Remember, folks... by Anonymous Coward · · Score: 0

      This is just another failure of the Libertarian- freak / no government / less goob'mint/ Ronald Raygun amphetamine popping, coke snorting private industry can do everything brigade.

      The private corporations aren't doing anything to secure against an obvious vulnerability. Private industry lives to make a buck this quarter- period. They're not here to protect you, be your mommy, make your life better or any other damn thing. They're here to make money. Stop.

      Comer on Libertarians, look up from your coke mirrors long enough to answer why I and my family have to die because you have an unconfirmed and unconfirmable theory about how everyone else should live?

      Look at the cock pit doors on 9-11. Before Raygun deregulated the airline industry, the doors had to be shut during flight and also able to withstand forced entry. After deregulation, the airline industry dropped that requirement. The rest is history.

      Just look around you at the disaster of the deregulated finance industry. I'm paying for that. Just like I paid for Long Term capital Management and their deregulated binge. Just like the S and L debacle of the 80s.

      Are you seriously telling me, oh Libertarian amphetamine addicts, that the security of our food water and infrastructure are left to private enterprise, the same animals that destroyed this economy?

      Libertarians and the Republican filth are the biggest threat to national security this country has ever faced. They want to stop us from protecting ourselves so their CEOs can go on snorting coke on their private planes and screwing 5,000 an hour whores.

      Revolution revolution revolution.

    100. Re:Remember, folks... by Rich0 · · Score: 1

      That's the thing I didn't like about that movie - I couldn't see the navy having that kind of ambiguity in its protocols. Certainly if that situation came up in real life the ambiguity would be resolved.

      That whole problem could be avoided if they had a few possible processes in place:

      1. Make fire orders unrevokable. Then once you get the order there is no need to verify/etc - and if you get a message fragment there is no concern over what it might be. Don't issue fire orders unless you REALLY want the missiles to fly.

      2. State that orders stand until authenticated counter-orders are confirmed. This prevents DOS attacks if an enemy floods the air with false traffic - you can't have ships sitting around trying to make sense of unauthenticated orders.

      In any case, orders to actually launch missles should not be issued if there is ANY chance you want to take them back. When you try to revoke such an order you're just banking on nothing having been launched yet. If one missile flies, they'll all fly eventually. The last thing you want is to launch exactly one missile - then you've invited massive retaliation without even doing an effective first strike.

      And, of course, the scenario for a nuclear launch should be in response to an opposing launch. ICBMs aren't really a good choice for anything short of killing every person on the planet...

    101. Re:Remember, folks... by Anonymous Coward · · Score: 0

      ...you must live in perpetual fear. Whenever you're starting to focus on the reality of life, new fear WILL be injected into it to distract you.

      This is how the natural order sustains itself.

      Chinese hackers, government or not, hacking the Tibetanâ(TM)s computers, and the US electrical system? Hackers of the free world, I call on you to do the same to China! Destroy the great firewall of China! Corrupt the censorsâ(TM) computers! Free the internet!

    102. Re:Remember, folks... by Anonymous Coward · · Score: 0

      It is probably not neccessary/practical to have the whole of the electrical distribution network accessable/controllable from either

      the internet

      or

      certian controll centers

      Individual distribution operators can implement their own systems for control on their own network segments.

      We need to look at the deregulation of the electrical utility industry and find a way to allow investors to recoup investments they make in distribution.

      Idealy we would have a very robust redundant delivery network, just by virtue of "free market" type incentives. Similar to the situation with the interntet.

      Perhaps an interesting approach to helping these operators maintain security on their segments of the network, would be to allow competing operators permition to hack their competitors networks for their own gain.

      There may be a place for a "core" redundant distribution network operated by the DOD or something like that, although some thought would have to go into making sure it is not just an insecure moneysink.

    103. Re:Remember, folks... by RocketRabbit · · Score: 1

      All it takes is one executive putting a wifi router in his office. This happens probably a thousand times per day.

      I wish I was overestimating the threat.

  2. Jesus Christ. by Anonymous Coward · · Score: 1, Funny

    It's a fire sale.

  3. Kapitan, I believe ve have determined a pattern by BadAnalogyGuy · · Score: 0

    Watch zis zignal. It fluctuates betveen zero and vun at a constant rate. Yes, here it is. 60 Helmholtz.

    Vut could it mean?

  4. Big surprise by cdgeorge · · Score: 2, Insightful

    I'm sure China and Russia are having the same kind of problem.

    1. Re:Big surprise by AigariusDebian · · Score: 4, Insightful

      Nope, electrical grid computers in exUSSR region do not even have the theoretical capacity to be connected to the public Internet. I am amazed there is an actual data linkage between the public Internet and the computers even remotely related to the power control functionality.

    2. Re:Big surprise by m0rph3us0 · · Score: 1, Flamebait

      You do know that the US penetrated the Soviet pipeline system and has caused industrial accidents with that right?

    3. Re:Big surprise by Shrike82 · · Score: 0, Offtopic

      See, the fact that the parent post is modded flamebait epitomises bad modding.

      Shame on whoever considers this flaming. Get a dictionary.

      --
      You can advertise in this sig from as little as £99.99 a month!
    4. Re:Big surprise by Anonymous Coward · · Score: 2, Informative

      You do know that the US penetrated the Soviet pipeline system and has caused industrial accidents with that right?

      The US didn't "penetrate" the pipeline system. The Soviets did it to themselves by stealing software.

      Lesson to be learned: If you find pipeline control software inside a big wooden rabbit then don't take it and certainly don't run it.

    5. Re:Big surprise by jeffstar · · Score: 1

      how else is a power station operator on a remote plant supposed to work? You don't expect them to go to the plant if it is hours away from anything. Stay at the plant, away from families? Forget it. operators telecommute too!

      People always say these things aren't connected to the internet and there are supposed to be seperate control and communication and PC networks but I bet few plants actually have that. Maybe super critical ones like nuclear, but your average small hydro or peaking gas plant...

      Time, Budget, the need to get that sensor or remote control connected to something, anything, whatever is near by so we can talk to it *now* and then the temporary fix becomes permanent

    6. Re:Big surprise by Antique+Geekmeister · · Score: 1

      And don't forget fools with laptops who leave their wi-fi on when they are connected to the internal network, and fools who install 'PCAnywhere' on their desktop hooked to their desktop, and the spread of the littls 3G modems and VPN's so people can work on the train. Couple this with really, really stupid behavior like unlocked SSH keys in NFS shared home directories, or Subversion and CVS storing passwords in clear text in people's home directories on NFS servers, and you have a disaster begging to happen.

    7. Re:Big surprise by benjfowler · · Score: 2, Informative

      I seem to remember that the CIA planted a logic bomb in an shipped component; and it was nothing to do with the system getting hacked over a network.

    8. Re:Big surprise by Anonymous Coward · · Score: 2, Informative

      You do know that the US penetrated the Soviet pipeline system and has caused industrial accidents with that right?

      This is what I believe you are talking about: http://www.builderau.com.au/architect/work/soa/US-software-blew-up-Russian-gas-pipeline-/0,339024596,320283135,00.htm

      Russia tried to steal the software to control the pipelines. The US caught wind of the plan and planted bugs in there to cause problems. The US did NOT hack in and cause it.

    9. Re:Big surprise by SirGeek · · Score: 3, Informative

      how else is a power station operator on a remote plant supposed to work? You don't expect them to go to the plant if it is hours away from anything. Stay at the plant, away from families? Forget it. operators telecommute too!

      Do you REALLY think that a "properly" run allows "any" connections to their control units or SCADA systems ? I don't think so. I'm pretty sure that they have people there 24/7 to handle any type of contingencies.

      People always say these things aren't connected to the internet and there are supposed to be seperate control and communication and PC networks but I bet few plants actually have that. Maybe super critical ones like nuclear, but your average small hydro or peaking gas plant...

      They aren't the "power grid", they are power stations. The "power grid" are the master control centers (Like NYISO, CalISO, Midwest ISO, PJM, etc) and the local control centers. There are FERC requirements for how THEY must be configured/setup (like the control room's network must be separated from the rest of the companies network, etc).

      Time, Budget, the need to get that sensor or remote control connected to something, anything, whatever is near by so we can talk to it *now* and then the temporary fix becomes permanent

      Nope. Not likely. If anything it is a PRIVATE network managed by the local control center.

    10. Re:Big surprise by Anonymous Coward · · Score: 0

      Citation please.

    11. Re:Big surprise by Syberz · · Score: 1

      Ditto, why are critical systems STILL connected to the internet? What's wrong with having the critical systems on an intranet and give acces to the internet to workstations.

      If your mission critical system needs to send out an email to tell you it's dying, just find another way to get informed of the situation!

      --
      ~Syberz
    12. Re:Big surprise by hughk · · Score: 1

      Unlikely, the Soviets used to take a lot of interest in any imported equipment, first the customs and then later the people who had to work with it. Russians, in particular, are engineers and like to understand things so they can fix them.

      --
      See my journal, I write things there
    13. Re:Big surprise by Anonymous Coward · · Score: 1, Funny

      Citation please.

      Here.

    14. Re:Big surprise by medelliadegray · · Score: 1

      I agree,

      It seems foolish on so many levels to have this kind of crucial infrastructure on a non-isolated network.

      --
      Troll, Troll, go away and flame again some other day
    15. Re:Big surprise by Anonymous Coward · · Score: 0

      Perhaps, but is it part of the requirements that the network be virtually And Physically separate networks? Does the standard even recognize the difference?

    16. Re:Big surprise by Zerth · · Score: 1

      Do you REALLY think that a "properly" run allows "any" connections to their control units or SCADA systems ? I don't think so. I'm pretty sure that they have people there 24/7 to handle any type of contingencies.

      .

      And those people get bored and want to surf the internet from their monitoring station. So they bring in a bit of cat5(or a USB wireless dongle) and get themselves a connection to the outside world. 6 months later, someone gets paid to figure out why a computer with no internet connection has popups, trips over the cable and says "WTF".

      Hearing shit like that at work has nearly convinced me to buy a real generator.

    17. Re:Big surprise by icebrain · · Score: 1

      One-way fiberoptic cable? That is, have the net card on the critical system only able to transmit, with no receive equipment fitted.

      --
      The meek may inherit the earth, but the strong shall take the stars.
    18. Re:Big surprise by t0rkm3 · · Score: 1

      As a matter of fact it does. At least with oil and gas industry companies. Most refineries(and gas plants) have two redundant network for the controls, a separate network for monitoring, and a network for business level stuff.

      Actual Blend adjustments and stuff like that have to be sneaker net... virus scan etc.

    19. Re:Big surprise by SirGeek · · Score: 1

      And those people get bored and want to surf the internet from their monitoring station. So they bring in a bit of cat5(or a USB wireless dongle) and get themselves a connection to the outside world. 6 months later, someone gets paid to figure out why a computer with no internet connection has popups, trips over the cable and says "WTF".

      You want to bet ? They are in a montored room. DHCP in our company only allows registerd MAC's to get addresses. If they have a machine making requests, our IT team know what port the requests are on they investigate it. If someone did that they'd be walked out the nearest door before they could go "But ?"

      Hearing shit like that at work has nearly convinced me to buy a real generator.

      What type of work ? A general office or a Power Control Center ?

    20. Re:Big surprise by bperkins · · Score: 1
    21. Re:Big surprise by Anonymous Coward · · Score: 0

      Ahh, good old PipelineControlSoftware.jpg.exe

    22. Re:Big surprise by canadian_right · · Score: 1

      They have large teams of people at the control stations 24/7. If bad weather is coming up which often causes outages extra staff come in.

      All well run utilites do not have any connection to their P&C (Protection and Control) and the internet. None. Actually, lots of powerstation controls are centralized. Of course, each power station has staff for maintenance, etc...

      And yes, FERC, has very stringent rules that even power companies outside the USA must follow if they want to trade electrity with the USA.

      --
      Anarchists never rule
    23. Re:Big surprise by hughk · · Score: 1

      Line X, or whatever the Soviet technology transfer programme was called certainly existed but this is not some nice neat thing that can be acquired and transferred like a chip. My own suspicion is that the CIA side of this was just someone making money selling on substandard chips.

      The explosion may of been caused by code in the pump system itself (sourced from Canada), but it would have been very difficult with the main SCADA system which was sourced from the UK. Neither would have been 'clean' deliveries of turn-key systems as western engineers from the respective vendors would have been hopping around fixing things and this would have included messing with the code. Any dangerous mods would have been spotted very quickly as the engineers themselves may have been killed.

      You give references, but all the information comes out of the disinformation spread by a throw away paragraph in the memoirs of one retired cold warrior Thomas Reed which has been contradicted from the Russian side. The construction teams were local and the welds were of varying quality.

      The particular SCADA system had been first rolled out in the UK for monitoring a gas pipeline in around 1980. The company then acquired the contract to do the Trans-Sib pipeline. This is not off-the-shelf coding and everything needed lots of care and feeding to get it working. This is not like selling a dodgy engine management system for a car (closed box system).

      --
      See my journal, I write things there
  5. So once a while by microbee · · Score: 4, Insightful

    "Some officials" come forward and warn about threats from China, Russia, Iran and North Korea. "Ya know, Sir, we need funding for enhancing national security, so please make sure you get your budget right."

  6. Oh no... by Professeur+Shadoko · · Score: 2, Funny

    They must have the CIP module !

    1. Re:Oh no... by Anonymous Coward · · Score: 0

      Device... get it right.

  7. Former officials... by onion2k · · Score: 4, Funny

    former national-security officials

    Aren't these people just admitting that they were incompetent? That's refreshingly honest of them.

    1. Re:Former officials... by Antique+Geekmeister · · Score: 4, Interesting

      Not necessarily. I've been in the situation where security issues that I warned about, documented, and was refused resources or permission to secure were in fact used against my employer. The Morris Worm in 1988 was a particularly bad example: I had printouts of the management refusals to permit security updates in a locked cabinet to prevent tampering, and my goodness, was I glad I had those. I keep similar files to this day, as a matter of basic self-defense when layoffs are pending and managers are looking for things to blame on our technical people in order to fire them and avoid paying severance bundles.

    2. Re:Former officials... by testpoint · · Score: 1

      Yes, they are incompetent. And congress would like to apply this same standard of expertise to our medical records.

  8. Software programs? by gzipped_tar · · Score: 5, Insightful

    I thought mission critical computers should not be reachable from the Internet. So the spies walked to those computers and planted the software there???

    --
    Colorless green Cthulhu waits dreaming furiously.
    1. Re:Software programs? by MichaelSmith · · Score: 2, Insightful

      Maybe they got a job working on those systems. I have the internals of several major cities traffic signal systems in my head at the moment, and that is just what I was working on up to ten years ago.

    2. Re:Software programs? by margam_rhino · · Score: 2, Interesting

      Be careful if you live in the UK, this could be classed as material likely to be useful to a terrorist and get you arrested.

    3. Re:Software programs? by gzipped_tar · · Score: 1

      From the article it seems that the software could be activated whenever its masters behind the scenes wish so, which is not quite easy if it has to be manually triggered by insiders (workers could get fired, etc..). TFA also said "Intelligence officials worry about cyber attackers taking control of electrical facilities, a nuclear power plant or financial networks via the Internet."

      --
      Colorless green Cthulhu waits dreaming furiously.
    4. Re:Software programs? by MichaelSmith · · Score: 1

      From the article it seems that the software could be activated whenever its masters behind the scenes wish so, which is not quite easy if it has to be manually triggered by insiders (workers could get fired, etc..)

      Given control of the firmware and software at some point I can think of a way to do it on the traffic signal system. Just send it messages through its normal inputs. Send morse code in through a pedestrian signal button, look for feedback in the flashing walk signal.

      Maybe for the power system you could signal it through its fault database. A pylon on fire reported by a Mr A Cross of Smith street has a particular meaning to your hidden easter egg. If that system is not appropriate you could (ab)use other sensors like temperature and moisture sensors.

    5. Re:Software programs? by Opportunist · · Score: 1

      Duh! How do you outsource managing them to India or Whereverstan if they can't connect from there?

      Remember, today, nothing is as mission critical as it is cost critical...

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    6. Re:Software programs? by Shrike82 · · Score: 1

      TFA also said "Intelligence officials worry about cyber attackers taking control of electrical facilities, a nuclear power plant or financial networks via the Internet."

      You have to wonder at what point someone thought it would be a good idea to directly connect hardware responsible for the safe operation of a nuclear power plant to the Internet. Or do they mean "taking control" in terms of something slightly less sinister, like vandalising the plant's public web page and internal e-mail system?

      --
      You can advertise in this sig from as little as £99.99 a month!
    7. Re:Software programs? by gadget+junkie · · Score: 1

      I thought mission critical computers should not be reachable from the Internet. So the spies walked to those computers and planted the software there???

      that happens in the military, where there's a defined physical space between mission critical rigs, unconnected to the internet, and non mission critical rigs, and you must use physical media, "launder" it on a standalone computer, then transfer the data to the mission critical computers.

      I do think, tough, that in any event physical security built into the systems would block major damage; no sane engineer would avoid building that into the infrastructure. After all we do have circuit breakers at home, we do not rely on a computer chip.

      It might also be that this is a colossal scam, in that some federal agency is "phishing" these guys, which to me could be a perfectly legitimate ruse-de-guerre.

      --
      "If a boss demands loyalty, give him integrity. But if he demands integrity, give him loyalty." (John Boyd, 1927-1997)
    8. Re:Software programs? by giles+hogben · · Score: 2, Insightful

      USB Keys in car parks used by personel?

    9. Re:Software programs? by flonker · · Score: 1

      To be fair, internal email can be used to social engineer problems. "Take down the number 3 reactor for maintenance." Send similar messages to different people regarding different reactors. etc.

    10. Re:Software programs? by Shrike82 · · Score: 1

      True, but it's a lot less worrying than being able to remotely disable saftey systems, or remotely shut-down a reactor. People are stupid, but you'd hope there are checks in place to verify instructions sent via an e-mail are real.

      --
      You can advertise in this sig from as little as £99.99 a month!
    11. Re:Software programs? by number17 · · Score: 1

      If Jack Bauer has taught me anything, its that even the anti terrorist unit can be compromised again and again.

    12. Re:Software programs? by swrona · · Score: 1

      Back in my days workinig IT at a power company, the systems that controlled the grid WERE seperate from the internet. The operators had a 2nd PC for all "normal" usage, and could only use the control systems for that purpose. Either someone thought combining the systems would be a great way to save some cash, or this report isnt 100% accurate?

      --
      -=Steve
    13. Re:Software programs? by Fulcrum+of+Evil · · Score: 1

      It's pretty much the same thing - Enron already attacked our infrastructure for profit.

      --
      "We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
  9. Why are they on the internet? by jolyonr · · Score: 1

    While arpanet/the internet was originally designed for just these sorts of things, the modern reality is that critical infrastructure shouldn't really be attached to the internet. Shouldn't there be a private network entirely isolated from the public internet for these things?

    Yes it'd be more expensive and it make it less easy for private contractors to work on stuff from their offices, but the word 'critical' is a bit of a clue here.

    Not that even this would guarantee security, but it makes it a heap load harder for any would-be hacker.

    Jolyon

    --


    Please read my Canon EOS tech blog at http://www.everyothershot.com
    1. Re:Why are they on the internet? by MichaelSmith · · Score: 4, Informative

      The systems I work on are typically airgapped, but there is a constant push from users for some access to the internet. A user might need to access meteorological information, and the simplest way is to go online to get the data. Another user might need to refer to work instructions on the corporate intranet, but the intranet gets you to the internet anyway. Like it or not, the internet is working its way into many types of work and many people are starting to expect it to be available.

    2. Re:Why are they on the internet? by jolyonr · · Score: 4, Insightful

      Then I'd suggest they need two PCs.

      --


      Please read my Canon EOS tech blog at http://www.everyothershot.com
    3. Re:Why are they on the internet? by Yvanhoe · · Score: 1

      I am not sure that it would really help. It is just a matter of plugging on the good wire. If the protocols used aren't secure, it doesn't make much of a difference whether or not they are connected on the net. As soon as a network is necessary, internet is as good as any...

      --
      The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
    4. Re:Why are they on the internet? by drsmithy · · Score: 2, Insightful

      The systems I work on are typically airgapped, but there is a constant push from users for some access to the internet. A user might need to access meteorological information, and the simplest way is to go online to get the data. Another user might need to refer to work instructions on the corporate intranet, but the intranet gets you to the internet anyway. Like it or not, the internet is working its way into many types of work and many people are starting to expect it to be available.

      Then your users need two PCs and a KVM (or even two completely separate PCs - ideally on opposite ends of the desk - to properly drive the point home).

      There are some situations where security MUST override convenience.

    5. Re:Why are they on the internet? by Anonymous Coward · · Score: 4, Informative

      I actually do work with these exact systems. I have yet to install a system in a control room that had net access to the operator consoles or even the operational servers. These computers - yes, running Server 2003/8 or XP Pro - are patched to the latest and greatest before they leave our shop, but once on-site should never, ever, ever interact with the Internet.

      That being said, the PI data servers are designed to be a go-between for the internal secure network, and the rest of the world so the data logging can reach those who need it. Not only does the PI server have security protocols built in, but is required to be installed in a DMZ with full firewall protections, and in some cases a dedicated leased hard line to an off-site office.

      So, to summarize, no, the Op stations, the Op servers, should NEVER be connected to the Internet, and we do out best to disable any way of the operators even getting to the OS level, but there are times and reasons that you need to hook the internal network (through full security measures) to the outside world.

    6. Re:Why are they on the internet? by MichaelSmith · · Score: 1

      Then I'd suggest they need two PCs.

      Then you have a badly integrated UI. What if a user confused one with the other at a critical moment?

    7. Re:Why are they on the internet? by pjt33 · · Score: 1

      I've worked at a games company which had precisely that setup, so it's mind-boggling that major infrastructure companies wouldn't do it.

    8. Re:Why are they on the internet? by jolyonr · · Score: 4, Funny

      On one they're controlling the power station, on the other they're reading slashdot.

      Unless typing 'FIRST POST! LOL' on the wrong box causes a reactor meltdown, I think we'll be ok :)

      Jolyon

      --


      Please read my Canon EOS tech blog at http://www.everyothershot.com
    9. Re:Why are they on the internet? by Anonymous Coward · · Score: 0

      > The systems I work on are typically airgapped

    10. Re:Why are they on the internet? by MichaelSmith · · Score: 2, Interesting

      There are some situations where security MUST override convenience.

      Tell that to the union. Remember power industry operational environments are blue collar work places. I have seen people in similar environments go to any length to get a system they don't want to see shut down. They will play totally dumb, like not noticing they are using the wrong keyboard for hours at a time. Assume that your users are hostile to you. Then design a solution.

    11. Re:Why are they on the internet? by Thanshin · · Score: 1

      they need two PCs.

      What? No copy paste? You're talking crazy now.

    12. Re:Why are they on the internet? by Anonymous Coward · · Score: 0

      Bullshit.
      Mission critical means exactly that.
      Not nearly, not almost, or some exceptions.
      There was one HUGE blackout - and lessons have not been learnt.

      My old work had dedicated internet terminals, and the cost of wireless dongles and laptops means
      isolated can mean just that.

      I should say before internet, FSK radio and teleprinters worked fine. Newer, younger, more stupid and cocky is what we have here.

    13. Re:Why are they on the internet? by Jackie_Chan_Fan · · Score: 1

      So you have 1 computer on the internet, and the one siting next to it, is not and can not and will not ever access the internet :)

    14. Re:Why are they on the internet? by BLQWME · · Score: 2, Interesting

      Any system that needs to be secure should never be allowed access to any network that has public access. If remote systems "need" to communicate it should be done via dedicated leased lines. Even better since we are talking utility type SCADA systems here, why not have the utility lay fiber, line of sight microwave or what have you (as long as it is properly encrypted)? This way if the telco gets ganked, the leased lines can't be traversed.

      --
      "Nobody shoots anybody in the face unless you're a hit man or a video gamer"- Jack Thompson
    15. Re:Why are they on the internet? by Anonymous Coward · · Score: 0

      Thanks, I'll remember this as an easter egg when I'm writing my nuclear power plant control software.
      Also, Xyzzy opens up the portal to another world.

    16. Re:Why are they on the internet? by Lumpy · · Score: 5, Interesting

      Blowing all my moderation to reply to this.

      Let me make this clear. Putting a critical system on to the internet is pure, stupid, incompetence.

      ALL of your "situations" can be solved with a second $399.95 DELL sitting next to the critical workstation. Anyone saying that that is not practical is a blathering moron. I have seen MANY water filtration plants that the Supervisors in charge of the whole operation are so incompetent they put the entire plant's operation system on the corporate or city network. Then we have the low quality SCADA software called WonderWare that is so badly written that the company requests they have direct access to the machines so they can issue fixes faster.

      If any mission critical machines are on anything but a sealed private non connected network, the person that designed it is a incompetent idiot that should take the fall for any failures. Gitmo time for whoever approved or asked for interconnection.

      I have been appalled at the amount of interconnection I see in really important SCADA systems. I have seen this stupidity in major infrastructure control systems for 14 years now. Typically put here by some asshole manager that wants to "keep an eye" on his guys while he is at home. he get's a workstation (typically the one in his office) set up with a second network card and Pc anywhere or another Remote control system to interconnect the secure to the un-secure. and does it with a stupid windows box. Then the idiot uses it to check email, surf the net,etc... All installed by your friendly company IT slackie After the SCADA installation guys go home.

      Every system I looked at that was "secure" typically had one of these bridging computers on it the only way to find the is to do a hard audit of every computer, the rate of finding these security breaches goes up as the age of the installation increases.

      --
      Do not look at laser with remaining good eye.
    17. Re:Why are they on the internet? by MichaelSmith · · Score: 2, Interesting

      ALL of your "situations" can be solved with a second $399.95 DELL sitting next to the critical workstation. Anyone saying that that is not practical is a blathering moron.

      In all the control room environments I have worked in this approach is just not acceptable. The users expect to get a single, integrated UI environment.

    18. Re:Why are they on the internet? by Lumpy · · Score: 2, Informative

      If you were the designer, then you did not do your job educating them as to why they are not supposed to do that, and the repercussions for not following them

      It is the SCADA system designers job to inform the customer as to the incredible danger of their desire to be convenient.

      If you were a employee that worked at one of those stations, why did you never voice your concern about it? One word to the regulators and your bosses would have been screamed at and fined heavily for having an integrated UI for internet, SCADA, and email. Most regulatory commissions REQUIRE security and system separation.

      --
      Do not look at laser with remaining good eye.
    19. Re:Why are they on the internet? by number17 · · Score: 1

      Unfortunately that sounds oddly like management to me.

    20. Re:Why are they on the internet? by kabocox · · Score: 1

      The systems I work on are typically airgapped, but there is a constant push from users for some access to the internet. A user might need to access meteorological information, and the simplest way is to go online to get the data. Another user might need to refer to work instructions on the corporate intranet, but the intranet gets you to the internet anyway. Like it or not, the internet is working its way into many types of work and many people are starting to expect it to be available.

      Still sounds kinda of lazy to me. Where my dad works, their are two guys whose primary machines are pretty much always going to be stand alone boxes. These are the engineers boxes that store all the CAM stuff that has all their essential stuff on how to actually run their business. If those two guys need internet or something, they are more likely to get a laptop or a netbook just for that purpose. They know that their boxes will never be plugged up to the net.

      You know what. They've never been downed any internet viruses or what not. They've got 5 various backups of that stuff. Now if the place where my dad works can do that level of common sense protection, then you'd think that the folks that run our essential infrastructure would be smart enough to do the same.

    21. Re:Why are they on the internet? by Duradin · · Score: 1

      And the customer is always right.

    22. Re:Why are they on the internet? by boris111 · · Score: 1

      Sounds like our Professional Services consultants.

    23. Re:Why are they on the internet? by Rich0 · · Score: 2, Interesting

      The solution is oversight. Congress passes a law noting that major pieces of infrastructure are critical to national security. An oversight body is created to set policies for administration of such intrastructure. Violation of these policies carries criminal penalties.

      Then you have the Feds start busting control rooms. Manager in charge gets sent to prison.

      Let's see how fast those managers can arrange to have competent people on-duty 24x7 and not need to use pcAnywhere or whatever to get in.

      As much as I'm not a fan of a lot of military culture this is one thing they REALLY get right. The mission comes first. Just think about it - they manage to work out every process to something that some 20-year-old with two years experience can supervise with 18-year-olds doing the grunt work. The officers then stay on top of things. The captain of the ship sleeps on the ship and can be woken up at any time should the situation require it. Even the president can be woken up if the chain of command truly requires it.

      Manager too lazy to come in to work to see what is going on - no problem, just hire one for each shift.

      Not every business needs to be run like a ship. However, the power grid isn't just any business - it requires a much higher level of rigor.

      Some have pointed out labor relations issues. These sorts of issues should not impact national security - just look at the Air Traffic Controller strike. By all means the workers should be given proper time to complete their jobs in a secure way - if two computers slow them down then hire a few more people and give them time to do the job right. The solution isn't to cut corners.

    24. Re:Why are they on the internet? by AB3A · · Score: 4, Interesting

      I am a control systems engineer, a member of ISA-99, and a contributor to several other standards on industrial control system cyber security.

      The parent post is what SHOULD be done in a recently installed system. I can tell you from experience of dealing with other infrastructure (not the electric grid) that it isn't always that way. There were many systems installed around Y2k that are still in service. And most of you will remember that back then very few people took security seriously. Back then it was all about compatibility. Security wasn't even an issue. The big issue was SHARING the data.

      Control systems and SCADA have long working lives ranging from ten to twenty years. The reason for this is because the field I/O validation cost is significant. It dwarfs the cost of the software, the control center, and all that lovely flashy stuff you're so used to seeing. Updating a configuration is very expensive, not just in validation costs, but also training costs, for miscellaneous costs such as review of operating procedures, control system narratives, and so forth. This is why many are forced to keep their systems isolated in the hope that by doing so, things will somehow stay secure.

      But these days, that's no easy feat. Nearly every company has a contingent of data surfing desk jockeys with enough authority and enough dream-weaving synergy talk to push for interconnections. That's when things get very ugly.

      The problem isn't that they want the data. The problem is that they want the data IN REAL TIME. Most of the time these idiots say the term though they do not understand the implications or even what it means. And that's how the exploits get started.

      There are solutions. There are relatively secure methods for moving data in and out of a SCADA system. But they need careful review by people who know both the industrial side of things (to identify what is at risk) and the IT side of things (to know what the potential vectors could be). And the number of people with that kind of expertise is extremely small. We're talking about hundreds or maybe a thousand such people world-wide.

      There simply aren't enough people to train the trainers who will train the trainers. And so, we're stuck with the status quo until we can build a community of cross trained people who understand industrial processes, control systems, and IT large enough to handle this situation.

      I know many of you probably think you have it bad in the office IT business. And it is. Just know that there is far more truth in the Homer Simpson character than you'd ever dream of...

      --
      Nearly fifty percent of all graduates come from the bottom half of the class!
    25. Re:Why are they on the internet? by sjames · · Score: 2, Interesting

      Color codes can help a lot. Blue network is scada, green is public. Scada network has blue ports, blue cables and blue stripes on the devices. Public internet has same deal but in green.

      Plugging anything in the wrong color is a firing offense. Specially designated and signed off gateway machines might have a blue port and a green port and special markings that it is OK. Otherwise, any color mis-match or mixing is to be reported immediately.

      For extra paranoia, all blue network devices get the high octet set to non-zero (on the card's flash, not just setting it by the OS). The wrong MAC seen on either network is an emergency.

      Watch the union guys cheer when said asshole manager is escorted from the building for plugging a green cable into a blue workstation.

    26. Re:Why are they on the internet? by DavidTC · · Score: 1

      You don't need to do that, what you do need to do is make sure they can't get physical access to the secure computer. I.e., can't accidentally or purposefully plug in flash drives or whatever. Same with the network connection. Lock the box in a cabinet, monitor, keyboard, and mouse cables exit from the front, everything else exits inside the walls.(1)

      They're extremely unlikely to confuse the two while using them. As someone pointed out, on one you've got a web browser, and on the other you have a control interface. You can't get to the interface on the insecure one, and in the unlikely event they fire up a web browser on the secure one, they aren't getting anywhere. Just make sure they don't put insecure media in the secure one.

      I'd actually argue that this would be a perfect situation for thin clients. Don't give people a secure computer. Give them a secure dumb terminal.

      1) And while you're at it, use PS/2 mice and keyboards. Because guess what you can do with access to a plugged-in USB keyboard and enough time? Rig a USB port. And plug in a flash drive.

      --
      If corporations are people, aren't stockholders guilty of slavery?
    27. Re:Why are they on the internet? by Rogue974 · · Score: 1

      Bravo! You are exactly correct. I am a Controls Engineer, anyone not knowing what that is, I program the code that makes the equipment in the plant work. I program the operator interfaces the operators use to talk to their controls equipment. The site I am sitting at right now has 2 completely independant networks. The IT network and our Controls Network. We do not let the IT people TOUCH our network. We maintain all of our computers and the hardware and fiber used to talk to the controls network is completely seperate from the IT network.

      I have other customers that give us remote VPM access to computers on their controls network so we can log in from anywhere, but they have a specific computer they use to do that and they unplug the thing from the outside world unless they have called us for help. That still makes me a little leary.

      It is impossible to 100% secure any network because someone can always figure out what fence to cut through to get in. In order to 99% secure your network, you have to seperate it from the internet networks. If you have a connection between the internet and your critical controls networks, as you stated, you are a moron and are asking for someone, be it terrorist, or more likely a disgruntled employee, to come in from outside and sabotage things.

      Gotta keep the hardware seperate or you loose orders of magnitude of security if you do not. I will never design a controls network that has access to the outside world. Do as you said, run 2 sets of cables to the control room, 1 is the IT and that is connected to their email/web surfing PC and then one set that is connected to the controls network. You then also lock out their ability on the Operator interface to do anything except the MMI software. Any decent MMI software has those capabilites built in.

    28. Re:Why are they on the internet? by t0rkm3 · · Score: 1

      Wow. A person would get fired for even suggesting that a control system should be connected to the business network in the 2 of the top 5 oil companies that I have worked for...

      I'm sorry dude. God be with you.

    29. Re:Why are they on the internet? by moosesocks · · Score: 1

      I'm no expert in this field, but shouldn't it be possible (and relatively simple) to get data OUT of a system easily, without having to worry about security (assuming that the data itself isn't sensitive)?

      You would preferably want to do this in hardware, ie. with a transmit-only fiber interface that lacks the physical capability to receive data.

      Of course, you would want the monitoring system to be secure if you wanted to do anything useful with the data. However, it still does make a fair bit of sense to utilize a one-way data link when performing monitoring functions.

      --
      -- If you try to fail and succeed, which have you done? - Uli's moose
    30. Re:Why are they on the internet? by moosesocks · · Score: 1

      How about utilizing incompatible physical connectors and software protocols for the two networks?

      It could even be as easy as using IPv4 for the blue network, and IPv6 for the green network. (Or foregoing the IP protocol entirely)

      Of course, you'd want to run MAC authentication in any event. However, this doesn't protect against an intruder with physical access to the network, as a foreign machine could very easily be introduced with a spoofed MAC address.

      --
      -- If you try to fail and succeed, which have you done? - Uli's moose
    31. Re:Why are they on the internet? by jayspec462 · · Score: 1
      FIRST POST!

      Fast-Initiating Reactor Safety Terminal performing Power On Self-Test in emergency mode, as requested. Control rods removed.

      LOL

      L-reactor now On-Line, as requested. WARNING: Control rods removed for self-test. Initiate emergency procedures!

      --
      $comment =~ s/($verb)\s+($noun)/IN SOVIET RUSSIA, $2 $1s YOU!/g;
    32. Re:Why are they on the internet? by AB3A · · Score: 2, Interesting

      Such products exist. The problem is that data often does need to go both ways.

      For example, load shed, distribution system models, and demand forecasts often go to servers and clients outside the distribution control center.

      These sorts of operations are near-real time processes.

      Likewise the outputs include run times, certain transient events, and hourly/daily total meter data often go in the other direction.

      As I said before, with careful consideration given to a DMZ between the office network and the control systems, with a sacrificial historian server, and with careful monitoring and alarming, it should be possible to safely set up a portal to the office network.

      People have written books on this subject, and I expect to be doing so before long. It is not something I can fit in to a nice pithy message here.

      --
      Nearly fifty percent of all graduates come from the bottom half of the class!
    33. Re:Why are they on the internet? by natoochtoniket · · Score: 1

      Many critical systems normally are accessible from the internet. They often are not isolated by much more than a vpn router.

      The reasons for this are obvious. Most of the accessibility is due to a genuine desire to allow the engineers who can fix it to be able to access it when it breaks. When the system crashes, and the one engineer who can fix it is a thousand miles away, the manager wants that engineer to have a laptop and the ability to get into the system to fix it.

      They try to do this in a reasonable way -- using VPN security, strong encrption, etc. But reasonable security one year is laughable security two or three years later.

      The real, operational question is: When your power goes out while the power companies chief systems engineer is on vacation a thousand miles away, do you want them to restore it in a couple hours, or do you want to wait till a week from Monday?

    34. Re:Why are they on the internet? by Fulcrum+of+Evil · · Score: 1

      not really practical - everything runs on TCPIP, and incompatible connectors are expensive. Setting the high bit in classified MACs means miswires can be handled immediately with a script that disables that port on the switch, which is really the sort of thing you want.

      --
      "We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
    35. Re:Why are they on the internet? by AMuse · · Score: 1

      Color coding is great, but you'll want to pick two colors which A) are easily distinguishable in low light situations (Blue/White) and B) are in combinations which people are unlikely to be color-blind (Red/White).

      Blue/Green is bad for both of those.

    36. Re:Why are they on the internet? by Anonymous Coward · · Score: 0

      I dont know what control room environments you have worked in, but in the one I work at(which is probably the biggest power company in the country) that is EXACTLY how it is done (having separate PC's to access the internet and corporate network). The users dont expect a 'single, integrated UI environment' at least on their SCADA terminals, and they dont seem to mind swivelling their chairs over to the 'unsecure' terminals when they need to open a corporate database or surf the web...

    37. Re:Why are they on the internet? by sjames · · Score: 1

      Incompatible connectors would be technically a good idea, but they'll have switch vendors cackling with glee knowing that they can sell a $300 switch for $10,000 if it has the different ports on it.

      Mac authentication is certainly necessary.

      Most of these ideas can be defeated by a sophisticate attacker with physical access (as is typical), but would prevent accidental, lazy, or stupid cross connections that make remote attacks possible without raising costs enough to make cheating a temptation.

    38. Re:Why are they on the internet? by Anonymous Coward · · Score: 0

      the users need to deal with it or get a new job.

    39. Re:Why are they on the internet? by Pandrake · · Score: 1

      My father-in-law is a retired Air Force Major, who now is a private contractor for the Air Force. Even tho he's civilian, in essence and in fact, he still uses two computers (tho they're both on the same machine). Everything is fine unless he forgets to switch to his "dot com" email before sending something to me or Mom. Once got an email where I found the DoD certificate his "dot mil" email uses, tho I doubt I could hack into the DoD merely because he forgot to switch or uses one machine to run two partitioned systems.

      Maybe. I could test it, but I'm not that type. Really.

  10. Very convenient ... by krou · · Score: 5, Insightful
    From the article:

    Under the Bush administration, Congress approved $17 billion in secret funds to protect government networks, according to people familiar with the budget. The Obama administration is weighing whether to expand the program to address vulnerabilities in private computer networks, which would cost billions of dollars more.

    So, the week before a review is due looking into whether or not they should increase the flow from the money pump, "current and former national-security officials" have come forward to draw attention to a network of spies in the power grid.

    Look, I'm not saying that cyber-attacks don't happen, or that there isn't a risk, but bloody hell, this article reads like a well-crafted piece of BS, designed to put the N back into FUDing.

    --
    'If Christ had tweeted the sermon on the mount, it might have lasted until nightfall.' - John Perry Barlow
    1. Re:Very convenient ... by microbee · · Score: 1

      While I was reading it (well I didn't really, but pretend you believed me RTFA), I had a hunch that these officials really got all the threat ideas from certain hot anti-terrorism show. Power grid attack? That sounds too familiar. What's next, I guess a bunch of armed terrorists are just going to break into the white house?

    2. Re:Very convenient ... by Thanshin · · Score: 2, Funny

      this article reads like a well-crafted piece of BS, designed to put the N back into FUDing.

      Nuding?

    3. Re:Very convenient ... by MichaelSmith · · Score: 1

      this article reads like a well-crafted piece of BS, designed to put the N back into FUDing.

      Nuding?

      Where?

    4. Re:Very convenient ... by Anonymous Coward · · Score: 0

      I could swear that these computers are primarily shielded from the Internet due to their incredibly important functions. And if they aren't at LEAST mostly shielded from the Internet, why is this? To say it's FUD seems to be a bit of an understatement.

      "LOOK, WE'RE SHOUTING ABOUT TECHNOLOGY; IT HAPPENS THE WAY WE SAY IT DOES BECAUSE IT'S MAGIC"

      We have bigger problems than the enemies if their security is this lax.

    5. Re:Very convenient ... by Fulcrum+of+Evil · · Score: 1

      this article reads like a well-crafted piece of BS, designed to put the N back into FUDing.

      Nuding?

      Where?

      Cheney. Avert your eyes, please.

      --
      "We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
  11. The Bush Regime by Anonymous Coward · · Score: 0

    and the Financial Terrorists were / are the biggest attackers on US infrastructure.

    1. Re:The Bush Regime by Anonymous Coward · · Score: 0

      and the Financial Terrorists were / are the biggest attackers on US infrastructure.

      Aren't the Financial Terrorist the Wall Street fat cats? They've done worse to this country's economy then any terrorist could have ever hoped for.

  12. California by Rob+Kaper · · Score: 0

    Based on what I hear from my friends, they're already testing the software in California?

  13. China and Russia? by Thanshin · · Score: 5, Funny

    China, Russia, and other countries,

    So you mean there are people capable of hacking the US energy grid but who can't start the attacks from a hacked box in Madagascar?

    "Who's attacking us?"
    "Sir, the attacks come from half a million infected machines all around the world."
    "From all coutries?"
    "Yes, sir."
    "So China and Russia too?"
    "Hmm, Yes, of course, sir"
    "Damn commies... We should've nuked them a long time ago."

    1. Re:China and Russia? by Zocalo · · Score: 2, Interesting

      So you mean there are people capable of hacking the US energy grid but who can't start the attacks from a hacked box in Madagascar?

      Maybe the attackers did start the attacks from the box in Madagascar or wherever, but if that box could be hacked by the attackers then I suppose it's possible that it was also hacked by those tracking these attacks who found evidence pointing back to the usual suspects. That becomes all the more likely if at least some of the hacked systems are parts of a honey net or monitoring of compromised systems in the US shows an abnormally high level of communication back to some countries and not others.

      What I find quite interesting about this though is that it's the older cold war opponents being singled out, and not the terrorists like all of those alleged Al Qaeda sympathisers in in quite well connected countries like Pakistan that we keep hearing about. If this were a FUD campaign, then which of those is Joe Public more likely to get worked up about, do you suppose?

      --
      UNIX? They're not even circumcised! Savages!
    2. Re:China and Russia? by kaaposc · · Score: 1

      [..] but if that box could be hacked by the attackers then I suppose it's possible that it was also hacked by those tracking these attacks who found evidence pointing back to the usual suspects.

      yeah, sure. hacked windows boxes keep bunch of log files for authorities to review.

    3. Re:China and Russia? by TheP4st · · Score: 1

      If this were a FUD campaign, then which of those is Joe Public more likely to get worked up about, do you suppose?

      I don't know about Joe Public. But, for Joe the Plumber terrorist and communist probably are synonyms.

      --
      "I have downloaded hundreds and hundreds of records, why would I care if somebody downloads ours?" Robin Pecknold
  14. This is the new war. by palegray.net · · Score: 3, Insightful

    Trust me folks, it's coming. It won't be pretty, either. The power to disrupt a nation's economy via information warfare measures represents a much clearer threat than people trying to get something through airport security.

    There's a reason the military is starting to get mighty interested in nerdy types, although most programs designed to leverage these skills are in their infancy. We need to get serious about this fast; other nations certainly are.

    1. Re:This is the new war. by Thanshin · · Score: 1

      The power to disrupt a nation's economy via information warfare measures represents a much clearer threat than people trying to get something through airport security.

      Unless... They're bringing the virus by plane!

      From now on, all computers will have to be formatted to pass security.

      Don't worry, the stewardesses will give you a Windows CD to reinstall the internet in your portable during flight.

    2. Re:This is the new war. by palegray.net · · Score: 1

      As amusing as your post may be, the scary thing is how you might be right on some ways. I'd love to belief Homeland Security couldn't possibly be that idiotic, but they've pulled some pretty dumb crap in the past.

      That said, I'm delighted to know that Microsoft is finally giving up on further Windows development and just putting the Internet right onto XP discs. I've always wanted my very own copy of the Internet.

    3. Re:This is the new war. by palegray.net · · Score: 1

      s/belief/believe/

      Gimme a break; it's early on the east coast :).

    4. Re:This is the new war. by Opportunist · · Score: 2, Insightful

      The threat is actually in consumer PCs, insecure and filled with malware. My fear is that, if we do not get those boxes secure soon, the Powers That Be will see them as a threat and, instead of requiring you, the user, to take responsibility for your box, demand that all boxes have to be made "secure", i.e. have some kind of mandatory surveillance available to them, or that you may only install whatever is approved and seen as ok by whatever entity your country may put in that place. All in the name of national security, of course. And while we're at it, a few kickbacks here or there may 'encourage' said entity to ensure some monopolies are set in stone.

      Not a good thing if you ask me. I'd call for responsibility for your box. Because in the long run, either you're responsible what happens with your box, or that responsibility is taken out of your hands. And given the current political climate, where personal responsibility is shunned in favor of governmental meddling, I'm pretty sure we'd see the latter happening.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    5. Re:This is the new war. by LingNoi · · Score: 1

      Sounds like Johnny Mnemonic.

    6. Re:This is the new war. by X_Bones · · Score: 1

      There's a reason the military is starting to get mighty interested in nerdy types, although most programs designed to leverage these skills are in their infancy. We need to get serious about this fast; other nations certainly are.

      I hope we do; maybe it'll help fix the sorry state of math and science education in this country. For better or for worse, as goes the military so goes our money.

    7. Re:This is the new war. by MacTenchi · · Score: 1

      If 9/11 has taught us anything, it's that a lot of damage can be done with very basic tools. It's a lot easier to have some guy with a truck-load of fertilizer park next to a substation than it is to find or train someone to hack into that power grid.

      Sure, networks should be more secure, but there's almost always an easier way in meat-space.

    8. Re:This is the new war. by palegray.net · · Score: 1

      It's a lot easier to have some guy with a truck-load of fertilizer park next to a substation than it is to find or train someone to hack into that power grid.

      From direct experience in these matters, I wholeheartedly disagree with you.

  15. No control structure is on internet by aepervius · · Score: 3, Insightful

    AFAIK the whole remotely controlled stuff is not on internet or anything but on modem and similar box (can't remember their name) to which you have to directly dial in (non routable), and is separately powered from the power grid. If not I would fire the ass of the guy in responsibility: who in their right mind would put the control structure for a power grid, on something which can only be accessed when the same power grid is functioning. Also there are local control which override any possible remote control anyway.

    --
    C. Sagan : A demon haunted world:
    http://www.amazon.com/gp/product/0345409469/
    visit randi.org
    1. Re:No control structure is on internet by fluch · · Score: 1

      Now somewehere in the depths of the US power grid somebody reads the above comment and thinks silently ... "d'oh!"

    2. Re:No control structure is on internet by TapeCutter · · Score: 1

      Thanks, I was looking for someone with a clue.

      Re your sig; I first learnt the philosophy of science not from HS (which I dropped out of in '76) but from reading a book by Randi ~30yrs ago so I checked out your amazon link and lo and behold it's Sagan's masterpiece.

      Seriously, genuine skeptcisim is a SKILL that needs constant practice but will serve you well in all aspects of daily life, I highly recommend the authors in aepervius' sig.

      --
      And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
    3. Re:No control structure is on internet by MichaelSmith · · Score: 1

      Now somewehere in the depths of the US power grid somebody reads the above comment and thinks silently ... "d'oh!"

      Finally an appropriate Simpsons reference.

    4. Re:No control structure is on internet by keeegan · · Score: 1
      who in their right mind would put the control structure for a power grid, on something which can only be accessed when the same power grid is functioning

      Well if it is using a modem, the lights don't matter. Now, if they'd make some way to power a laptop computer off of batteries, we'd be in business!

    5. Re:No control structure is on internet by sjames · · Score: 1

      Stuff happens. I remember reading about a redundant diesel power system for a building. Everything was checked and re-checked. Every month, they cut power at the mains to verify that the UPS + generator would take over without an issue. Each time, all was well.

      One day the power failed for real. A couple hours later, so did the generator. It seems there was an electric fuel transfer pump that was on grid power through a separate feed in an external shed. Cutting the mains left it powered. Everyone had assumed it was operating in the tests from generator+UPS power. OOPS.

  16. joe public by Anonymous Coward · · Score: 0

    It's not rocket science. It called an air gap.
    Why do people (invariably those in authority who have no idea of the consequences) have a perverse desire to hook everything up to the Internet? Iâ(TM)m not talking about John/Jane middle manager, I mean the muppets at the top âoedriving down costsâ. Was it so poorly managed prior to internet? Was there no cost effective alternative to internet connectivity? Will it in reality, after all these âoecyberâ hacks, have cost less in the long run using internet connectivity? Security through obscurity is no answer, but using networks that cannot be accessed by joe public does make life easier in the securing of national critical infrastructure. Those in authority keep banging on about how these systems are so important to US life, yet seem to do so little in enforcing the security

    Why have they not hook up the Shuttle launch control system to the internet? Its simple. That answer is also not rocket science.

    1. Re:joe public by Anonymous Coward · · Score: 0

      The Shuttle isn't rocket science?

    2. Re:joe public by happy_place · · Score: 1

      there are some networks like that. Other networks require data transfers to occur via CD-R's, banning the use of USB devices, for example. (Because USB devices are notorious for carrying and picking up unwanted self-loading malware) the problem is that now with the reliance upon COTS all drivers, programs and a lot of information required to do the job is found on the internet... somewhere. It's a huge cost savings not to have to custom design every component of your infrastructure. The parts are more reliable and you don't worry about them becoming unavailable (because there's competition among providers) due to things like economic downturns. if everyone went to air-gaps there would be no point in having an internet...

      --
      http://www.beanleafpress.com
  17. Nation states responsible? by Britz · · Score: 1

    I always thought that nation states would be much more careful than to leave anything behind and would also limit their activities very much in order not to be detected and possibly embarrass their government (diplomacy and all). Also this kind of actitvity could be considered as an act of war.
    But since this kind of activity could very well be conducted by other entities than nation states. And they are. All the time. They are also very hard to trace.
    Given those facts maybe nation states use this excuse and acutally conduct this kind of activity.

    Anyone got a clue?

  18. I couldn't resist... by Anonymous Coward · · Score: 1, Funny

    In Soviet Russia... the Grid penetrates the Spies!

    Sorry

  19. Yea good luck... by Anonymous Coward · · Score: 0

    Maybe they can figure out the tangled mess that is the US electrical grid.

  20. Remember folks, by Anonymous Coward · · Score: 0

    ..internet is BAAAAD!!! We have to REGULATE it, internet access is like having a gun, we have to identify every single person on the net! ..except those hackers, who.. oh.. damn.

    In other news: standing in cold weather with too little clothes on too long may result in death! Planet earth is attacking us!!!

  21. Ya not a real surprise by Sycraft-fu · · Score: 4, Interesting

    Everyone wants money for their projects. Part of getting it is knowing what to sell in your given field. Well, as of late with federal government dollars, national security has been the name of the game. Was more narrow to anti-terror but they are kind losing focus on that. So, it is also no surprise that is what people use to try and get the money, even if what they want really has fuck all to do with it.

    For example Consolidated Edison wants to install a super conducting core in for New York's power grid. Reason is the existing grid has load problems and this looks like the best way to handle it, rather than massive amounts of more copper. This is expensive, of course. To the best of my knowledge when this is deployed, it'll be the first super conductor used for commercial power delivery. Means plenty of R&D in addition to the actual costs. Well, sure would be nice if the government would help pay for that... So they got them to.

    How? Well they sold it to DHS as an "anti-terror" deal. No idea how this is supposed to be more terror resistant, but DHS bought it and that's what's important. They gave ConEd something like half the money they need for the project.

    Now you know that ConEd isn't really doing this as an anti-terror measure, they are doing it as a "grid is overloaded" measure. However, they put that spin on it to get government funding, and it worked. I'm betting this is a similar money grab.

    1. Re:Ya not a real surprise by dave562 · · Score: 1
      Now you know that ConEd isn't really doing this as an anti-terror measure, they are doing it as a "grid is overloaded" measure. However, they put that spin on it to get government funding, and it worked. I'm betting this is a similar money grab.

      You are right on the money. I work at an institution (non-profit 503c3) that relies on grants for a lot of our funding. From what I've been able to tell, the process of writing a grant is all about just wording the request in the right way to relate what you want to do, with what the grant provides money to do. Based on my limited knowledge of the subject, grants are created out of the legislative process when Congress mandates that money gets spent a certain way. They make grants available to try to focus the spending of the funds. Companies then apply for the grants and then theoretically spend the money in ways that are in line with the grant.

  22. Quite so... by denzacar · · Score: 2, Interesting

    From TFA:

    But protecting the electrical grid and other infrastructure is a key part of the Obama administration's cybersecurity review, which is to be completed next week.
    Under the Bush administration, Congress approved $17 billion in secret funds to protect government networks, according to people familiar with the budget.
    The Obama administration is weighing whether to expand the program to address vulnerabilities in private computer networks, which would cost billions of dollars more.
    A senior Pentagon official said Tuesday the Pentagon has spent $100 million in the past six months repairing cyber damage.

    Sounds a lot like someone is making up excuses and drumming up support to ask for more government money.

    --
    Mit der Dummheit kämpfen Götter selbst vergebens
    1. Re:Quite so... by gclef · · Score: 4, Informative

      Close, they're drumming up support for S.773 and S.778. These bills are designed to give the executive the power to control the security of vital parts of the internet. If they can show that these vital parts of the net are compromised, and therefore risking America, they have an easy talking point when lobbying congress members.

    2. Re:Quite so... by Anonymous Coward · · Score: 2, Interesting

      Don't forget an easy way to shut down the internet when some whistleblower decides it's time to disseminate those files he has before the government removes him... Only instead of in the movies where he gets away with it, because the internet is 'free' and routes around damage. The whole damn thing suddenly goes dark because our glorious and incorruptable administrators decided it's 'better for all involved' this way.

    3. Re:Quite so... by Anonymous Coward · · Score: 0

      Exactly, and obviously there need to be kill-switches on all Internet routers so the new cybersecurity czar can shut down the net to protect systems not connected to it. All legislators know that their unwashed constituents all believe that computers network by telepathy or magic, if they don't believe that themselves.

      See how FUD builds on top of old FUD? Mix in outrage over selling GM and Mopar to the Chinese, and you've got instant appropriations and new powers that will be used on behalf of, guess who, China, and whoever else holds American notes.

      Suckers!

      --rgb

  23. Had to be done by TechnoFrood · · Score: 3, Funny

    Spy sappin' my generator.

    1. Re:Had to be done by Anonymous Coward · · Score: 0

      That generator is a spy!

  24. Air conditioners... by VinylRecords · · Score: 1, Flamebait

    The time that power goes out most frequently where I live (New York City, Hudson Valley, Syracuse all year round) is during the summer on the hottest days. What is straining the electrical grid so much? Air conditioners. On the hottest days of the summer you will always experience brownouts, and sometimes, the days get to hot that a large section of our part of the country loses power.

    Millions of New Yorkers depend on electricity in their daily lives. Prolonged power outages are not only a nuisance -- they are also potentially life-threatening and can cause major economic losses.

    Power outages occur most often during the summer months, when residents run air conditioners and power usage is at its peak.

    http://www.nyc.gov/html/oem/html/hazards/utilities_power.shtml
    - - -
    http://en.wikipedia.org/wiki/Northeast_Blackout_of_2003#Causes
    The 2003 Northeast blackout was caused by urban sprawl interacting with silvan areas. On hot days, wires can cause fires, especially when tree branches are resting on the electrical wires because we decided running power lines through wooded areas was good decision.

    http://en.wikipedia.org/wiki/New_york_blackout#Cause
    Lightning can also cause fires, especially on hot days, resulting in damage so great that major areas like NYC lose power for an entire day. For this blackout there were three lightning strikes that took out power lines causing major damage to NYC's power supply.
    - - - - -
    The Wall Street Journal should be ashamed for printing such ridiculous and manipulating propaganda. Major power outages happen entirely because of over consumption of electricity during the hottest days of the years. There is no global anti-American electrical conspiracy that is possibly going to be more damaging than mother nature (lightning, fire) and human nature (needing to be cool on hot days aka mass air conditioner use).

    Last year, a senior Central Intelligence Agency official, Tom Donohue, told a meeting of utility company representatives in New Orleans that a cyberattack had taken out power equipment in multiple regions outside the U.S. The outage was followed with extortion demands, he said.

    In a chilling scenario reminiscent of James Bond and other action spy movies, the CIA has confirmed that Internet attackers have succeeded in compromising power grids outside the US in order to hold entire populations to ransom while make extortion demands. The utilities infrastructure security meeting was organized by information security training, certification and research group the SANS Institute and was held in New Orleans last week.

    US Central Intelligence Agency senior analyst Tom Donohue told a gathering of 300 US, UK, Swedish, and Dutch government officials and engineers and security managers from electric, water, oil & gas and other critical industry asset owners from all across North America, that "We have information, from multiple regions outside the United States, of cyber intrusions into utilities, followed by extortion demands." Mr Donohoe was not explicit as to whether the extortionist cyber attackers, which had brought down the power of entire cities, were terrorists with political motives or were criminals attempting to extort financial ransom. He also did not name the regions that had suffered attacks other than to say they were outside the US. "We suspect, but cannot confirm, that some of these attackers had the benefit of inside knowledge," said Mr Donohue. "We have information that cyber attacks have been used to disrupt power equipment in several regions outside the United States.

    In at least one case, the disruption caused a power outage affecting multiple cities. We do not know who executed these attacks or why, but all i

    1. Re:Air conditioners... by MichaelSmith · · Score: 1

      We should require aircon systems to incorporate photovoltaic power supplies.

    2. Re:Air conditioners... by Anonymous Coward · · Score: 0

      I left Syracuse for many reasons. The weather was just one of them. I moved away; came back, and moved away again. Currently I reside in San Diego. Before I had to pay $200 plus to heat my apartment( it was shitty ventilation ). Here in San Diego; I pay 60 the most even in the summer time. National Grid is a racket! I have no plans to ever come back. Besides there are jobs here. can't say that about Upstates depressed economy. It'll never get better. Take the risk and leave. I did! And it payed off. God bless.

    3. Re:Air conditioners... by Fujisawa+Sensei · · Score: 1

      Its just more propaganda from Ruppert Murdock.

      --
      If someone is passing you on the right, you are an asshole for driving in the wrong lane.
    4. Re:Air conditioners... by ZorinLynx · · Score: 1

      What we need is mandatory load control for everyone in areas that make heavy use of air conditioning or electric heat. We've had voluntary load control down here in Miami for decades now, and it works well.

      When loads start to reach the peak of the grid capacity, they send signals out over the grid to shut off the air conditioners of large swaths of customers for a couple hours at a time. You don't really notice it if they do it right, and they save several gigawatts of load in the process.

      Unfortunately, the republican conservative types are against any measure where control is taken away from them. Even if it means blackouts. They don't care and would rather sit in the dark than implement mandatory load control.

    5. Re:Air conditioners... by snspdaarf · · Score: 1

      It wouldn't be 1.21 gigawatts, would it?

      --
      Why, without your clothes, you're naked, Miss Dudley!
    6. Re:Air conditioners... by Fulcrum+of+Evil · · Score: 1

      then you get to run the AC for longer and pay more because the electric company shut off your AC for the hot part of the day. Bite the bullet and go nuclear.

      --
      "We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
  25. Well, so much for all those electric cars . . . by PolygamousRanchKid+ · · Score: 1

    I'd better stick to a gasoline powered vehicle, those damn foreign Cyberspies with be monkeying around which the electricity switch

    . . . and wow, does the Internet need electricity to run? I hope those foreign Cyberspies now what they will be starting, when they cut off the US supply of porn.

    It ain't gonna be pretty. Maybe we can convert the Internet to run on gasoline?

    --
    Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
  26. Why they don't kill the Electric Grid by Danathar · · Score: 1

    Cause they hold all our debt and killing our economy means we can't pay them back....

    1. Re:Why they don't kill the Electric Grid by Hognoxious · · Score: 1

      Then I hope they don't get the idea that we couldn't (or wouldn't) anyway.

      If I couldn't get my money back, at least I'd like a bit of entertainment.

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    2. Re:Why they don't kill the Electric Grid by Missing_dc · · Score: 1

      That is perhaps part of the plan,
      if your economy is destroyed,
      what do you pay a country back with?
      your resources?
      your people?
      your land?
      your sovereignty?

      might they attempt to "repo" or seize assets?

      But then, the US is not exactly innocent here either,
      didn't we do something similar to the USSR to destroy it?

      --
      How amazed would you be to suddenly find that you just forgot what I wrote and you needed to reread my post.... again.
    3. Re:Why they don't kill the Electric Grid by maxume · · Score: 1

      In economic terms, the U.S. could get out of debt fairly easily, even with today's economy.

      There isn't anything resembling the political will necessary to do it (one immediate effect would be an enormous negative impact on standard of living, for nearly everyone). It will happen anyway, as the cost of borrowing goes up, making it less and less attractive to borrow.

      --
      Nerd rage is the funniest rage.
  27. This story is 100% false flag OPS by cheekyboy · · Score: 1

    1. these systems are NOT new, and arent connected directly to the net except incoming emails.

    2. control stations arent controlled by users desktop systems.

    3. gambling networks are more secure, and older.

    4. this is an excuse to create a mass event, so they can find a reason to 'SECURE THE NET' via EVIL means, ie, only authorized webservers, all ports but 80 blocked, everything logged.

    --
    Liberty freedom are no1, not dicks in suits.
    1. Re:This story is 100% false flag OPS by OolimPhon · · Score: 1

      ...except incoming emails.

      Well, there ya go. Prime transport method for viruses, worms, trojans...

    2. Re:This story is 100% false flag OPS by Anonymous Coward · · Score: 0

      ZOMG Conspiracy Theory

    3. Re:This story is 100% false flag OPS by Ashriel · · Score: 1

      4. this is an excuse to create a mass event, so they can find a reason to 'SECURE THE NET' via EVIL means, ie, only authorized webservers, all ports but 80 blocked, everything logged.

      Precisely.

      I'll even go one step further and name the evil means: the new cybersecurity bill

      After the news has its fun with the "cyberterrorist threat" for a few days, how many people do you think will oppose this ridiculously overbroad bill? What do you think the majority will say to/about those few who still have the sense to object?

  28. Who needs EMP? by Anonymous Coward · · Score: 0

    If you can knock out the power grid via software, who needs the expense and difficulty of designing nuclear weapons to deliver an EMP?

    You won't get as much disruption but the cost and ability to do it with less detection is much better.

  29. I have my doublts. by w0mprat · · Score: 1

    I'm doubting the veracity of these claims. We lack the technology to send spies down mains wires.

    --
    After logging in slashdot still does not take you back to the page you were on. It's been that way for 20 years.
  30. From The Internet by dword · · Score: 1

    It sounds to me like someone needs to try and grab more control over that Internet thing. First pedophiles, then terrorists, it seems that you can start whole revolutions (linked in case anyone missed yesterday's news) using it and now THIS? The government must find a way to control it or we're all doomed! AAAaaaaaaaaaaaaaaaa!!!!!!!!!!

  31. Old news - real, but old by keraneuology · · Score: 1
    From time to time they have conducted mock attacks and it has been demonstrated more than once that an external agent could destroy various pieces of equipment by ordering them to perform out of spec. And there are other weak points as well - hack into the railroads and instruct the train to deliver the coal to the wrong place, for example. But here's a story from August 13 2001 in the LA Times

    For two weeks last spring, hackers wormed their way inside a computer system that plays a key role in moving electrical power where it is needed around the state. The computers belong to the California Independent Service Operator, an agency that oversees much of the state's electricity transmission grid--including the massive complex of power plants and transmission lines. Cal-ISO patched the flaw that allowed hackers to roam through portions of its network before power supplies were affected. But the episode sent shock waves throughout the energy industry.
    The crux of the issue is that the system is vulnerable - recall 2003 when a single tree branch killed power across several states for a week? That is not indicative of a healthy and robust grid system. And if the system is that vulnerable to an accident what would happen if somebody with malice aforethought (and a degree in EE) decided to spice things up a bit?
    Unless the utility companies make explicit plans to correct things a macro-catastrophe is inevitable. Personally I think that a solar storm is more likely than a terrorist attack but it *WILL* happen and tens of millions of people will lose their grid indefinitely (probably several years to restore full access). (I further predict that the system will be rebuilt to the old specs because it will be cheaper and easier to do it that way, flushing an opportunity to build a hardened grid).
    This is your transformer. (note that this company claims to be able to repair your transformer in less than 30 weeks - that means that)
    This is your transformer after a solar storm. Yes, the sun did this.
    This is the transformer with which most geeks are more familiar.

    --
    If the g'vt kept the data on you that google does you'd better believe you'd be calling it "doing evil"
  32. Why is this stuff connected to the Internet? by dpbsmith · · Score: 1

    I don't get it.

    Why is this stuff connected to the Internet?

    Who decided to connect it to the Internet?

    When did they start connecting it to the Internet? They always used to tell us not to worry, because it wasn't.

    Can't these guys afford a few leased lines?

    1. Re:Why is this stuff connected to the Internet? by MichaelSmith · · Score: 1

      Can't these guys afford a few leased lines?

      Leased lines may actually be less secure than a VPN because of the tendency to run insecure protocols over them.

  33. False panic spreading... by Anonymous Coward · · Score: 0

    This is not news, this is crap.

    It comes from unnamed sources, reflects unspecified incidents, and reveals a danger that seems obvious, if you know how to use your brain, that is. I didn't know Wall Street Journal was a tabloid.

    I just got seriously annoyed and had to write something.. Will my comment, in the end, just help this piece of trash stay on the main page list? :/

  34. American government is so pridictable by Anonymous Coward · · Score: 0

    I guess it's another 'coincidence' this FUD comes to us on the heels of legislation seking to install a 'Cybersecurity Czar'.

    1. Re:American government is so pridictable by Jackie_Chan_Fan · · Score: 1

      B I N G O... and Bingo was his name Oh.

  35. Shocking! by MeNotU · · Score: 1

    Just absolutely Shocking!

    1. Re:Shocking! by MeNotU · · Score: 1

      Hey, I didn't say that! You must be a Chinese-Russian who hacked my account to post that!

  36. Since when by Exitar · · Score: 1

    counterespionage information became public domain and discussed on /.?

    1. Re:Since when by JoeBuck · · Score: 1

      Since the NSA decided that they want to run cyber-security for everyone, not just the government. First they have to scare us before we turn over the Internet to them. The wingnuts at the Wall Street Journal are happy to get their story out. You did notice that there are no specifics about which facilities were attacked?

  37. Why are these even connected to the internet? by DJRumpy · · Score: 1

    Hell, even a dial-up modem/cell system would be more secure and 'off the grid'. Why in the world would they want to put a permanent link to these onto the internet where people can randomly poke holes in the security?

    1. Re :Why are these even connected to the internet? by rs232 · · Score: 1

      "Why in the world would they want to put a permanent link to these onto the internet where people can randomly poke holes in the security?"

      To save money, cause it's cheaper than leased lines. Same with ATM machine. Put ATM machines running Windows on the Internet and you end up with this and this.

      --
      davecb5620@gmail.com
    2. Re:Why are these even connected to the internet? by argent · · Score: 1

      In some cases they're not directly connected to the Internet. The systems I worked on had an EMS (Energy Management System) network, an inner firewall, a DMZ containing database servers with data pushed from the EMS network, another firewall between the DMZ network and the corporate network, and then whatever corporate firewall was in place outside that. Direct connection from the Internet even to the DMZ network was not recommended.

      Then they decided they needed the dispatchers to be able to use Internet services, so they set up separate Windows desktops for them, then to save money they used the same desktops instead of the original UNIX Workstations. Then regulatory agencies started putting data up on the Internet so we had to grab that (in most cases using web scraping, because they never bothered with an API). Then the companies started complaining about leased line costs between control centers, so we obliged them with VPN connections...

      But when they started adding control access from the Internet, bypassing the DMZ, I don't know, it's been a few years since I've been involved in EMS. But I can't say I'm surprised.

  38. So let's spy on Chinese and Russian Immigrants... by tjstork · · Score: 1

    Problem solved. Someone starts sending messages back to father China and mother Russia, well, round them up. If they start using encrypted communications, then, you might need to rescrict their movements away from infrastructure areas.

    --
    This is my sig.
  39. Do you believe this crap by rs232 · · Score: 1

    ' Cyberspies have penetrated the U.S. electrical grid and left behind software programs that could be used to disrupt the system, according to current and former national-security officials'

    "There are intrusions, and they are growing .. There were a lot last year"

    'Many of the intrusions were detected not by the companies in charge of the infrastructure but by U.S. intelligence agencies, officials said. Intelligence officials worry about cyber attackers taking control of electrical facilities, a nuclear power plant or financial networks via the Internet'

    Given the great Northeast Blackout of Aug 14 2003 and a similar incident at a Davis-Besse nuclear power plant the previous January, why is the US still using the Internet to control the power grid? And that's assuming that any of the above is even true.
    -------

    PROTHERO: Do you believe this crap, Dascombe?

    DASCOMBE: It's not our job to believe it, Lewis. Our job is to tell the people --

    PROTHERO: "Exactly what they tell us." I Know but do you think that people will believe it?

    DASCOMBE: They will if it's you that's telling it to them. Now let's try it again.

    --
    davecb5620@gmail.com
  40. That's the SMART Grid by tjstork · · Score: 1

    They put the stuff on the grid so they can do real time monitoring of the health of the grid. Such monitoring is a prerequisite to the "smart grid", and it includes things like determining in greater detail who will need power and at what time, aligning contracts with greater granularity. From there, you can get the most efficient generation and purchased power stack for the given power profile.

    You really are going to need to do this too, to have your windmill future.

    --
    This is my sig.
  41. This is how the news controls us by Orion+Blastar · · Score: 1

    better let us give up more of our rights and freedoms for domestic wiretappings of the Internet near the IPs of the power grid. Just so we can be safe from our enemies shutting it down.

    The USA is so dependent on technology now that all it will take to bring us down are a few angry hacker/crackers from a foreign nation to disrupt our Internet or Electric grid. Then we all panic as it is a cyber 9/11 attack.

    How will we know every time the power goes out that hackers/crackers didn't do it instead of a tree falling on a power line or something?

    --
    Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
    1. Re:This is how the news controls us by JoeBuck · · Score: 1

      This is great. When power systems go down because of poorly designed software, we can blame Chinese superhackers instead of incompetence.

  42. Laptop with dial up? by Pinky's+Brain · · Score: 1

    A single purpose laptop running only the control software (can in theory be subverted by the operator, but you have to trust him anyway) with a good old dial up modem seems pretty secure and workable to me.

  43. translation: by nimbius · · Score: 1

    spying on a country is not just a privilege of the USA.

    unless theyre willing to cite information regarding the attacks and some credible proof, i dont care to go insane over the fact that someone nmapped a fistful of government IP ranges that are routinely published in places like phrack.

    didnt we do the same kind of fingerpointing before we went to iraq??

    --
    Good people go to bed earlier.
  44. Follow-up article by MobyDisk · · Score: 1

    I'm sure this has something to do with the "smart grid worm" reported a few weeks ago

  45. It's okay by psnyder · · Score: 3, Funny

    The module that allows outsiders to do this is called the CIP device. I hacks into the governments firewall. Who knew they had just one layer of protection over every bit of US infrastructure, that it's all linked together, and that it could be so easily circumvented by a genius hostage in a matter of hours?

    But it's okay. A man by the name of Jack Bauer has been alerted to the situation. And knowing his previous record I'm confident that he will deal with the crisis, because all of the bad people operate within driving distance to him.

    1. Re:It's okay by Anonymous Coward · · Score: 0

      Dear Lord! Thanks! and since you posted this about 12 hours ago, I'm pretty sure by tomorrow morning this issue will be fixed!

  46. Wolf! by jandersen · · Score: 2, Interesting

    It is rather stupid to keep crying wolf, when there is little to nothing to raise the alarm about. Or, alternatively, it is very clever, if you want people to not take security warnings seriously; only, I can't see why anybody in America would wan't to achieve that.

    Don't we hear these allegations all too often? It's "the Chinese and Russians" they say, and apparently it comes from the CIA or something, so we can't get to see any documentation. Perhaps some would like to think they can poison China's or Russia's reputations with this kind of stories, but as I point out, all they achieve is to weaken America's defence by undermining public trust in the agencies that are supposed to help protect them - it seems idiotic to me.

    And objectively, why should China or Russia want to harm America? Like it or not, they are no longer likely to be enemies of America in a future, global conflict, which will probably be between the industrialised and developing nations. To my mind it seems more believable that the culprits are international criminal gangs; multinational companies have grown to almost nation-like power, and it seems almost unthinkable that international gangs haven't grown proportionally, especially since the introduction of the internet. They would certainly have an interest in staking out as much of the public infrastructure as they can. And, of course they might also see an interest in people not believing public security warnings.

  47. refusals to permit security updates... by rs232 · · Score: 1

    "I had printouts of the management refusals to permit security updates in a locked cabinet to prevent tampering, and my goodness, was I glad I had those"

    Do you mind producing the originals here, for posterity. What exactly did you warn them about. iirc The Morris Worm worked partly due to a default debug password being accidentally compiled into sendmail, an open secret at the time ...

    --
    davecb5620@gmail.com
    1. Re:refusals to permit security updates... by Antique+Geekmeister · · Score: 2, Informative

      I'm afraid not, that was 20 years ago: I no longer have the originals. There were a set of published security updates for telnet and sendmail at the time, which the Morris Worm probably exploited on my systems: the vendors had not revealed all the exploit details. (Few vendors do.) We frankly didn't bother to do extensive analysis at the time, we had critical work to do and a lot of systems to rebuild, very painfully, from bootstrap systems that hadn't been tested in years and backup policies that I'd also written about as being badly scheduled and incomplete.

      Having the "I told you so" documents on paper can be critical: they have much more power than mere verbal testimony. The fact that I'd kept them under lock and key and wouldn't let the originals out of my hands were an interesting source of internal strife, and revealed some other bureaucratic issues when other documents were somehow "lost" by the people assessing the situation.

    2. Re:refusals to permit security updates... by eldorel · · Score: 1

      Seems fairly obvious to me. He notified them of a "required" update to the software, but worked for a company that needs full approval to roll said updates onto production systems. If the manager says no, the updates don't get applied. Fairly common practice in some sectors (small financial comes to mind).

      Emergency patches get looked at, and someone has to make a judgment call on which is more likely. Will the patch have a better chance of breaking something than the virus. Can we stop the virus at the firewall level, etc.

      When the person makes the wrong call, someone gets blamed.
      Often it's the engineer who originally brought up the issue who get hung out to dry.
      Often a middle manager will state that the engineer/network admin/etc failed to explain how large the threat was.

      Having records on hand that show that you clearly stated, in advance, exactly what the consequences were is just basic cya.

  48. Re:Re :Why are these even connected to the interne by DJRumpy · · Score: 1

    Yes, but aren't there systems available where they can use simple Cell systems? My alarm system uses a cell phone instead of a land line. You would think the hardware for such a setup would be reasonably cheap and allow for decent speed for any telecommuting work needed. They could use certificates as well as passwords for authentication. This just seems insane to me.

  49. do not buy anything with IT in it from US by kubitus · · Score: 1
    and also not from any other country. The US do it, the French do it, the Brits do it: they leave their little brothers and e-moles in the software of the product.

    You do not do as they wish - poops it goes.

    Especially weapons systems have a remote operated switch the original manufacturer can switch off.

    IT users of the world enjoy your router operations and therefore the Internet

    as long as Uncle SAM allows you to!

  50. Homer Simpson says blame it on guy who can't speak by Joe+The+Dragon · · Score: 1

    As homer Simpson says blame it on guy who can't speak English. Also it is Mr burns fault for cutting corners so he can make more money.

  51. Still April Fool's day? by flyingfsck · · Score: 1

    These ridiculous jokes is getting old now.

    --
    Excuse me, but please get off my Pennisetum Clandestinum, eh!
  52. The Attention is Healthy by anorlunda · · Score: 4, Informative

    The WSJ article was apparently triggered by a letter sent by NERC (North American Electric Reliability Council) to its members. I think it shows a healthy development of security digging down to yet another layer of depth.

    Forget the major computers in the major control centers. That's what everyone thinks of first. At that level it is becoming like the Indians and athropologists in the Grand Canyon. For every utility cyber worker there seems to be 30 government gumshoes and overseers looking over their shoulders. One would expect no aspects of security to be neglected at that level.

    The NERC letter refers to devices at a lower level. Primarily, what the industry calls "protective relays" in substations. From 1888 to a few years ago these functions were really done with electromechanical relays. Now, many of them have been replaced by digital equivalents on a one-by-one basis. In a household analogy, it is like the difference between a central electric control computer for the house, as compared to a "smart" digital LED light bulb. One worries about the central computer being hacked, but at first blush, not the light bulb.

    The problem is that the engineers who deal with this level of equipment aren't used to thinking of these devices like the light bulb instead of like computers in a network. They have not identified many of these low-level devices as "cyber critical". The NERC letter urges utilities to change that culture.

    This is an industry that owns and maintains hundreds of millions of diverse pieces of equipment. Every day, some fraction of them are converted to digital. No single study, no single policy can change this infrastructure overnight. I think they are approaching cybersecurity thoroughly and methodically, but it will take time.

    Remember Y2K? Roughly the same collection of hundreds of millions of devices were threatened by a common-mode failure (Y2K). It was very analogous to an external cyber attack. The utility industry tackled Y2K, thoroughly reviewed all those devices, and performed flawlessly on the morning of 1/1/2000.

    My point? Sure we should worry about cyber attacks on critical infrastructure, but don't jump to the conclusion that no security exists or that nothing competent is being done about it.

    1. Re:The Attention is Healthy by Anonymous Coward · · Score: 0

      Mod parent up. See http://www.nerc.com/page.php?cid=2|20

      Specifically, CIP-005 and 006. Most Californian power-related companies require NERC-CIP compliance for new substation projects.

      Don't believe everything you read in the news, kiddies.

      There are a lot of competent people working in this area that really do care about, and understand the need for, the security of these systems.

      It's unfortunate that we don't hear more about what is being done to bullet-proof our infrastructure.

  53. tag:Shocking! by Anonymous Coward · · Score: 0

    tag:Shocking!

  54. Remember 2003 Blackout from Worm by woodsrunner · · Score: 1

    Remember the blackout in 2003? There was talk that the computers that failed were hit by a particularly nasty worm going around that week. I think it was the Sasser. Can't remember. But I do remember working as a tech and the worm was really crescendoing at the point the grid went down. The talk of a virus being the cause was put out there and quickly replaced with some excuse less scary. But from my vantage point it seemed to really coincide with the worm.

    1. Re:Remember 2003 Blackout from Worm by RobBebop · · Score: 1

      The 2003 blackout had nothing to do with any computer virus. I studied this in a Software Reliability course a few years ago and recall that it was caused by cascading failures that originated from a software bug and a tree following onto a wire somewhere in Ohio.

      --
      Support the 30 Hour Work Week!!!
    2. Re:Remember 2003 Blackout from Worm by woodsrunner · · Score: 2, Interesting

      I think that software bug was unpatched windows machines in Ohio. But I was too close to it all and may just be making an erroneous jump for correlation to causation. The network storm caused by that virus was pretty horrendous.

      As the story unfolded the early reports said the machines were unpatched. Then that story seemed to be brushed for reasons I can only guess with tinfoil hat securely fastened.

      I imagine there were many factors that met on that day contributing to the blackout. And I doubt the virus was designed to take down the grid. But the lesson I took from it is that there are many critical machines that are hooked up to the internet or networks that hook up to the internet that aren't properly maintained and these sort of events will be more common. Also that if a non-specific virus can do that much harm I shudder to think what a well designed attack would unleash.

    3. Re:Remember 2003 Blackout from Worm by Anonymous Coward · · Score: 0

      http://en.wikipedia.org/wiki/Northeast_Blackout_of_2003#Findings
      Nothing to do with Windows patching at all

    4. Re:Remember 2003 Blackout from Worm by charlesnw · · Score: 1

      Completely unrelated. See https://reports.energy.gov/ for a very thorough analysis of what happened.

      --
      Charles Wyble System Engineer
  55. This is disturbingly not new by sirwired · · Score: 1

    These same vulnerabilities have been known for more than a decade. Google "Eligible Receiver" for details.

    SirWired

    1. Re:This is disturbingly not new by Anonymous Coward · · Score: 0

      All I got were obscure rules about the NFL.

  56. Right as Obama is asking for emergency powers to c by SirBitBucket · · Score: 2, Insightful

    Interesting timing for this report to come out right as Obama is asking for draconian emergency powers to be able to shut off the internet and other private networks at will without regard for any law. http://www.tomshardware.com/news/obama-shut-down-internet-legislation,7478.html

  57. Yer wrong by Anonymous Coward · · Score: 0

    Nope, electrical grid computers in exUSSR region do not even have the theoretical capacity to be connected to the public Internet. I am amazed there is an actual data linkage between the public Internet and the computers even remotely related to the power control functionality.

    Geek who works at power station owns a laptop, inevitable consequences ensue.

    There's this thing called "The Real World" [tm] that does not conform to legislation.

  58. This is why we need a distributed system by Presence1 · · Score: 1

    The electrical system needs to be redesigned in the same way as the Interstate Highway System was redesigned in the 1950s -- Designed from a defense perspective, with a variety of beneficial side effects.

    The electrical system should have 30-50% of the power generated where it is used, not almost 100% at central stations. Yes, large generation stations have economies of scale, but they also have major systemic weaknesses. With a significant minority of the power requirement generated locally, the system will become extremely robust, and even if the central system fails for some reason, the core functions continue uninterrupted.

    Whether or not this particular computer infiltration issue is hyped, there are a wide variety of threats to the grid, from simple overloads, solar flares (one took out all of Quebec and some of the Northeast in the 1980s). In wartime, it is simple to take out the grid with a single high-altitude nuclear burst; zero casualties, zero physical damage, and half the grid is toast from the EMP.

    Once power is out, for a few hours it is a bit of a holiday, but after a few days, there are serious problems. Communications are mostly out after the backup power runs out, frozen food rots, fuel is unavailable because pumps have no power, and even water is a problem without pumps. In the northern tier in winter, people start freezing because even oil and gas heaters won't start without electric signals & starters. In short, it becomes a real problem to maintain society within a week.

    However, with 30% distributed power, we can lose the grid entirely for months, and maintain communication, food and water, and transportation. of course, it would be inconvenient, but not a disaster.

    And, it would have the side benefit of helping us say "FU" to OPEC, since many of the distributed systems would be solar and wind.

  59. We as a community can help... by CPNABEND · · Score: 1

    So, do they need to run SPYBOT?

    --
    My wife doesn't listen to me either...
  60. Firesale by Frankie70 · · Score: 1

    Is there going to be a Firesale?

  61. you let the feckin wogs in, so by noshellswill · · Score: 1

    as with any enemy, what else did you expect to happen? Globalist fairy-tales whether economic or cultural end with the troll under-da-bridge eating you. Paranoid? Better be 24/7/365

  62. Spy sappin' mah sentry! by PNP_Transistor · · Score: 2, Funny

    Or rather, "Spy sappin' mah power grid!"

  63. cannon fodder for big bro spying on us by Anonymous Coward · · Score: 0

    Guys, this is obviously just a set up so they can respond in concern for our security. You know, big bro and their warrantless wiretapping, spying, etc. People say I wear a tin foil hat, but how can you not see it?

  64. Make a well? by Vegeta99 · · Score: 1

    Dude, if the electricity grid comes crashing down, your well is gonna be useless without a hand pump! I live in the country, no power means no computer, no fridge AND no water.

  65. In a time of war, no one will be "hacking". by Viewsonic · · Score: 1

    At least, a war with China or Russia. If we are at war with either, it will be nuclear, and at that point, hacking someones electrical grid would be hilariously hard to do since it wont even exist any longer. Hacking it beforehand would also be pointless because the facilities that launch the missiles are independent and off the grid regardless.

    1. Re:In a time of war, no one will be "hacking". by Runaway1956 · · Score: 1

      We are already at war with China. They declared war years ago, and we ignored them. Assasin's Mace was the declaration.

      Guess what? They are winning. Technology is being exported to China routinely. Jobs are being exported. Infrastructure (ie, plant and equipment) is being exported. The dollar loses value, the yen goes up, and China is calling today for the world's money exchange to be based on something OTHER THAN the dollar.

      Sun Tzu was Chinese, after all. The Chinese haven't forgotten him. They are indeed waging assymetrical, unconventional war on the United States.

      And, unless we wake up, they will win, WITHOUT any nuclear warheads exchanged.

      Wake up, and smell the roses, my freind.

      There are, today, sophisticated, sustained, well-coordinated hacking attacks on governments around the world, originating in China. Yes, hackers are contributing to their war effort. Don't doubt that for a moment.

      --
      "Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
  66. Exploits in Control system by kaynaan · · Score: 1

    From what I have seen, All plants Power/Water/ Oil & Gas use a handful of the exact same Control systems products (Honeywell, Allen Bradley) and software ... with minor configuration changes across plants. These control systems are just more specialized computer systems, if an exploit were found for any one ... that would render any of them with a link to the outside vulnerable. And yes some people are stupid enough to hookup a Process control network to the internet ... lukcily in that particular case it was caught and rectified by the manager.

  67. "emergency powers": beg your pardon? by Anonymous Coward · · Score: 0

    "Last week, Senate Democrats introduced a proposal that would require all critical infrastructure companies to meet new cybersecurity standards and grant the president emergency powers over control of the grid systems and other infrastructure"

    I work utility operations. I haven't the foggiest idea what "grant the president emergency powers over control of the grid systems" means. Anyone familiar with the proposal in question?

    This was by far the most alarming thing in the article.

  68. If there were a serious security issue... by Anonymous Coward · · Score: 0

    The last thing they would do is ADMIT it. That fact alone tells me we are looking at the marketing pitch for a big funding request.

    Can the problem ever be solved without eradicating Microsoft? Although any system can be hacked, you have to wonder about systems that have proven vulnerable to script kiddies.

    A few years ago, I visited an air traffic control tower. Our group also visited ground control in the same building. Giant monitors and Sun hardware everywhere. Not a single MS box in sight except for ONE in the tower (with it's own internet connection). They were using it as a backup to get weather radar maps off the web in case their own data became unavailable. I find it interesting that nobody (other than movie script writers) are claiming the air traffic control system is under attack. Not that it isn't, but notice how the power grid is somehow a softer target. Makes me wonder why.

  69. Cyber Security by Five+Bucks! · · Score: 1

    The American military's response is said to be akin to the 90s cartoon Superhuman Samurai Cyber-Squad.

    --
    52 52'23" W 47 32'07" N
  70. MOD UP by PetriBORG · · Score: 1

    Mod this guy up big time!

    I've worked on SCADA power systems before as well and everything he says here is very accurate. The problem with the system starts with the desk jockey types start to want to view the system from their office desk... It all goes down hill from there.

    I'll also point out that I'm sure that if someone wanted to get into the system that was off network they would just put USB thumb drives out in the parking lot with malware on them, then wait for the malware to call home or worm its way around the network to a machine that is connecting to the internet and tunnel in that way.

    --
    Pete/Petri "damn, my chainsaw is clogged with 1's and 0's again." --clyde
  71. The Source IP does not mean much by kitgerrits · · Score: 1

    The fact that the traffic originated from IPs that include China and Russia does not mean that the hacker is Chinese or Russian.
    It just means that the hacker is using chinese or russian computers.

    --
    "I was in love with a beautiful blonde once, dear. She drove me to drink. It's the one thing I am indebted to her for."
  72. Firewall 'em! by Murpster · · Score: 1

    Whether or not there's anything to be worried about, this seems like a good excuse to firewall off China... which would cut down on massive massive quantities of spam and random ssh brute force hack attempts. I'd say firewall off Russia too for the same reasons, but Russia also contributes much of the porn on the internet, and that's a critical resource.

  73. Forget Cybersecurity... by Anonymous Coward · · Score: 1, Interesting

    Forget Cybersecurity. Start with regular security!

    In the area where I live, there is a mothballed power station with a perfectly live substation attached to it. This is a particularly large one because it controls most of the power to and around a major city. Copper thieves are regulars here, despite the extra cameras that were recently installed. In fact, before the cameras were installed, one of the copper thieves found an interesting locked door. He hotwired a forklift and started ramming it into this door, and stopped only when he got the forklift stuck in a stairwell.

    Turns out that behind this locked door were the controls to the substation. Flipping the wrong switch, let alone several switches, would have damaged equipment and rendered the city dark for quite some time. Thankfully security is much better there now, but someone who knew what they were looking for could easily evade notice long enough to force their way into this room.

    My point is this: your electrical system is only as secure as your delivery system, and those substations are only as secure as the corroded fences and the broken windows they are decorated with. Anyone determined to cause massive damage to the system already knows that they don't need the trojan army to disable you.

  74. Web surfer by EkriirkE · · Score: 1

    In reality, it was likely just some employee(s) looking at pr0n and got some spyware on the machine(s).

    --
    from 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
    to 45 2F 6E 40 3C DF 10 71 4E 41 DF AA 25 7D 31 3F
  75. Who needs spies?? by Reziac · · Score: 1

    We've already SOLD most of our infrastructure to foreign interests, who now control it. Why the hell would they need spies to take it down??

    --
    ~REZ~ #43301. Who'd fake being me anyway?
  76. Re:Very convenient ...fast printer needed by sam0737 · · Score: 1

    I think the administration needs a faster printer to print the bills - the bills in dollars and the bills of the law.

    Hm...is that from HP?

  77. Why put sensitive stuff on the internet? by ThinkTwicePostOnce · · Score: 1

    Why is *anything* that is life & death sensitive to the masses put onto the internet
    in the first place? I understand things needing to be connected to *some* kind of network
    for remote monitoring and control, but why is that network the internet? So the operators
    can shop for shoes or surf for porn while they're bored?

    It makes no sense to me at all.

    --
    Hide all sigs: Click HELP+Prefs (top), VIEWING (last on right), DISABLE SIGS (3rd on left) and SAVE (hidden at bottom).
  78. You nailed it perfectly, Lumpy! by sgt_doom · · Score: 1
    You nailed it exactly so, Superior Citizen Lumpy!

    No comments could improve upon your masterful post!

  79. They want info?We'll give'em info!They'll be sorry by Bushido+Hacks · · Score: 1

    Since it is possible to transmit electrical signals over the power grid, chances are unless you are running on your own power source or a battery, you've been spied on the entire time.

    But now there is a new element to this spygame. Outsiders who are looking for information that they may think is useful but really isn't.

    Imagine if one of those computers had nothing but Rick Astley videos and pornographic videos of two girls and one cup. The files would obviously be give all sorts of important names like "Invasion plans" "Government secrets: Eyes Only" and "CIA Top Priority". Of course, opening the file would redirect them to something annoying or disgusting. The kind of stuff that you REALLY do not want to look at because you just don't want to look at it.

    Of course there reaction would be measured by the next time an international visit occurs and a cellphone playing the music from one of those videos were to go off.

    Who needs GITMO when you can just drive people nuts with this video?

    --
    The Rapture is NOT an exit strategy.
  80. Thank god... by Anonymous Coward · · Score: 0

    Obama is not only continuing warrantless wiretapping but extending it to protect the American people from the terrorists.

    http://www.eff.org/deeplinks/2009/04/obama-doj-worse-than-bush

  81. MOD PARENT UP! Interesting! by bensch128 · · Score: 1

    Nothing to see here. move along...

  82. Energy traders are the threat by Anonymous Coward · · Score: 0

    The bigger threat is the energy traders who trade in http://www.pjm.com http://www.nyiso.com and http://www.midwestiso.org These traders are market manipulators that can disrupt the flow of energy from one market to another. Remember the huge black-out a few years ago that started in Ohio? That was caused by an AMERICAN trading company that wanted to prevent flow from one zone to another such that they can make a profit in another area.

  83. Security through ...? by shermo · · Score: 1

    Texas grid operating statistics are blocked to any non-american IP. This is boring stuff like average prices or sytem demand. It's certainly not sensitive, and every other market allows this stuff to be seen by anyone.

    Luckily, I am smarter than any potential terrorist, and I have heard of proxies.

    --
    Insanity: voting in the same two parties over and over again and expecting different results
  84. Grid Defense by Anonymous Coward · · Score: 0

    Unfortunately the U.S. can't control the Mexican border. How the hell are they going to protect the entire country and put money into grid defense? Not to mention the slight debt problem right now. ;s