Slashdot Mirror
Massive Power Outages In Brazil Caused By Hackers
Hugh Pickens writes "CBS reports on 60 minutes that a massive two-day power outage in Brazil's Espirito Santo State affecting more than three million people in 2007, and another, smaller event in three cities north of Rio de Janeiro in January 2005, were perpetrated by hackers manipulating control systems. Former Chief of US National Intelligence Retired Adm. Mike McConnell says that the 'United States is not prepared for such an attack' and believes it could happen in America. 'If I were an attacker and wanted to do strategic damage to the United States, I would either take the cold of winter or the heat of summer,' says McConnell, 'I would probably sack electric power on the US East Coast, maybe the West Coast and attempt to cause a cascading effect.' Congressman Jim Langevin says that US power companies need to be forced to deal with the issue after they told Congress they would take steps to defend their operations but did not follow up. 'They admit that they misled Congress. The private sector has different priorities than we do in providing security. Their bottom line is about profits,' says Langevin. 'We need to change their motivation so that when see vulnerability like this, we can require them to fix it.' McConnell adds that a similar attack to the one in Brazil is poised to take place on US soil and that it may take some horrific event to get the country focused on shoring up cyber security. 'If the power grid was taken off line in the middle of winter and it caused people to suffer and die, that would galvanize the nation. I hope we don't get there.'"
Probably impossible.
As we all should know by now, impenetrable security doesn't exist. What we should probably have is tighter backup power for essential services and places like hospitals, where local redundancy could help in the face of a remote 'hacker' type attack
Places where there is a lot of danger for people without electrical power don't need billions spent on the security of their power systems. They need redundancy, generators in their buildings that could be used to keep people alive, batteries, and common sense.
Oh well, let's spend a bunch of money on fear like we always do.
Long live the BSD license
Who thought it would be a swell idea to to hook the grid's computers to the INTERNET?
Did someone surf some pr0n sites on the Win98 powered control computer down at the power plant?
I have to return some videotapes...
Things like this make me wonder why mission- and life-critical systems are (presumably) set up on Internet-facing systems. Sure, it's cheap, but when the walls come tumbling down like this article implies, cost is a moot point.
I don't see why they can't just buy a phone line for each power station and link to central stations (also with NON-Internet-facing systems) like that.
Awfully reminiscent of the hysteria that took place in the 80s, when the FBI and media were convinced that hackers were going to "crash the grid," launch a nuclear attack or god knows what other heinous crimes. The cost to the freedom of their own citizens, and the financial expenditure on all of this hysteria seems awfully prohibitive compared to the actual risk.
That already happened, you moron. And nothing has been done to fix it because repairing infrastructure isn't sexy enough to get politicians elected.
But how much energy can congress really expect them to expend defending against imagined threats?
Well, the energy sector has traditionally been heavily regulated, and works well compared to the huge mess the deregulated banking system made of itself. You do realize that the government took over the banking sector because the bankers failed to run it?
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
Yes, of course! The government has already taken over the banking sector, the mortgage sector, the automotive sector, is about to take over the healthcare sector, so fuck it - the government may as well take over the energy sector as well. I can't wait until they take over food distribution - I've always wanted to know what it's like to stand in line for a loaf of bread all day.
I am not a fan of government intervention either, nor do I like what was done with banking and automobiles. Having said that, this isn't what is being proposed here. If the electric utilities must comply with laws mandating that they meet or exceed a minimum standard of security, this would be much more like the way local Board of Health requires that restaurants handle food in ways that prevent food poisoning. The Board of Health does not own the restaurants and it does not choose their management; it just periodically inspects them and can shut them down if there are egregious violations. Something similar could be worked out for the power companies when it comes to security.
It is a miracle that curiosity survives formal education. - Einstein
If they won't integrate safety systems to protect the system properly from hacker attacks, hit them in the wallet, hard. Pass sound regulation to force them to implement safeguards, require inspections/audits that they are done, not just take their BS word for it.
Yes, of course! The government has already taken over the banking sector, the mortgage sector, the automotive sector, is about to take over the healthcare sector, so fuck it - the government may as well take over the energy sector as well. I can't wait until they take over food distribution - I've always wanted to know what it's like to stand in line for a loaf of bread all day.
The great blackout of 2003, which took out the north east united states and a good chunk of ontario, was caused by deregulation (removing the requirement to clear the branches around the power lines).
Quebec, which has state-owned power (Hydro-Quebec) was not hit hard by that blackout, because it keeps its grid out of phase with those dangerously unregulated parts around it.
Learn the lesson: You can't trust the greedy to run critical infrastructure.
You can't take the sky from me...
Yep. We lost the terminology war a decade ago. It's time we deal with it.
Because the remedy for bad speech is more speech. Censorship is never justified. If a post gives you the vapors, stop reading it. A free society is one where it's perfectly fine to stand on a soapbox and make a fool of yourself. I'd like Slashdot to stay as free as possible.
If you have transmission lines running from point A to point B then why cant you just string a data line right below the transmission lines? You already own the right of way. You already have the towers/pole line ran. Compared to the cost of a big high tension line the cost of a little data line would be nothing.
I have to return some videotapes...
If 9/11 was any indication, our national response would be characterized by...
Only in my wildest fantasies would such an attack mobilize the country to have a rational, balanced cyber-security posture.
But how much energy can congress really expect them to expend defending against imagined threats?
There's nothing imagined about any of these threats. They are very, very real. What we know about is scary enough, what we may yet learn could be truly frightening. Maybe you caught that little part in the story where the military is having some of their computer chips made overseas. I wonder how much money you'd think it would be worth to stop four of five of our own Predators and Reapers from bombing US cities? Or a couple nukes going off in their silos? Or all of our refineries melting down at once while the rest of us are sitting around in the dark?
Virtually all our PC's, processors and hard drives are made overseas. By sending all our manufacturing overseas, we may be setting ourselves up for an attack that will make 9/11 look like lunch at Hooters.
We already know what happens when someone whines about imaginary threats...like foreigners taking airline flight lessons.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
You are extremely Naive if you believe this garbage. Blaming bandits for the shortcomings of the government is one of the oldest tricks in the book.
Take what ye can. Give nothing back!
I think you're confused about the English language! "In America" certainly includes any country in either North or South America.
English is defined by customary usage. If you said "In America" to 100 English speakers, MAYBE one would include any other country than the US. If you're lucky.
Why can't people stop biting on lame cut'n'paste trolls?
why can the hacks do something like unlocking all channels in a cable system?
I think if some one where to hack in the power system and set all bills to $0 then you will see a big move to lock the system down.
These bankers, how exactly did they "fail"? And it seems their only "punishment" was a bonus, or a job offer... running the SEC??
For justice, we must go to Don Corleone
Then again I could just take my $2000 plasma cutter, $500 generator and $6000 hilux and head up into the mountains and take down three or four high voltage towers and kill power to about 8 million people for a week or more and be home before nightfall. Just in time to laugh at all of you while you scream in hysteria demanding quadzillions be spent on protecting over hyped "attack vectors".
Talk about not seeing the forest for the trees...
But as long as it's protected by fancy sounding acronyms it appears the white shirts are satisfied.
Oh yeah, well if I were an attacker, I would build a gravity weapon so powerful that it would pull the moon out of its orbit and crash it into the earth.
OR I would create a poison so potent that just a few drops of it in any lake would kill everyone within a 5-mile radius.
OR I would plant thermonuclear bombs in the capitals of the 10 largest cities in the U.S. and detonate them all at once.
See, Mike McConnell? It's easy to invent terrorist movie plots. If they gave out awards for Most Creative Terrorist Strategies That Would Never Work, you all all of your three-letter agencies would win first prize every time.
"We need to change their motivation so that when see vulnerability like this, we can require them to fix it.'"
Why the hell is this so hard to figure out? Hold cooperation responsible for the negative effects caused by their negligence. Power going out because a skilled hacker found an exploit that the best security experts couldn't find is one thing. But power going out because the IT dept. at the power company decided that they didn't need to take basic security measures is another, that's negligance.
If people die because the power went out and the power went out due to negligence (i.e. some 15 year old managed to ssh into the power plant and fuck everything up because the root password was "password") then charge the company with criminally negligent homicide.
We don't need some special, new incentive to get companies to protect the public interest. We just need to remove all of the immunity we've given the companies. The only question we have to answer here is why the fuck did we give companies immunity from the consequences of their actions?
-1 disagree is not a modifier for a reason. -1 troll, flaimbait, redundant, overrated are NOT acceptable substitutes.
Nonsense. The banks failed for one reason and one reason only. Their greed was not checked by adequate government oversight. Remove all regulation and you'll find that they will just rip more people off faster all while enjoying their "too big to fail" status.
As for the power company, they have a natural monopoly simply because we can't have 3 or more sets of everything running everywhere. Just how many poles do you want in your yard? I suppose the distribution net could be public with multiple power companies using it, but then we're back to "socialism".
Smart grid makes it more exposed to hacking. If we're talking about the ability to manage major appliances such that they can be spread out so that we can put a higher load on the grid without overloading it, imagine if someone broke into that system and did the opposite by synchronizing usage. Coupled with the fact that loads are even higher, it's a perfect storm for melting down parts of the grid which would take a long time to repair. During that time, people who are most vulnerable (the elderly) would die.
"Well, the energy sector has traditionally been heavily regulated, and works well compared"
Well excepting for that Enron/Dynegy/Reliant/Williams thing where they nearly bankrupted California manipulating the electricity market, shutting off power plants to create artificial shortages for example, and FERC mostly sat on the sidelines watching.
And then of course there was oil spiking to $140 a barrel due to market manipulation, though chances are you can probably blame a fair bit of that on Goldman/Citi and other big Wall Street banks manipulating the commodities markets for profit.
@de_machina
The blackout in 2005 was a human failure. One transmission line went down, the team recovering that line made a mistake and instead of activating the repaired line disabled the backup line. Result: 3 states withou electric power.
The blackout in 2007 was due a circuit breaker shutting down one line, the same happening after in the backup line, that could manage the excess load (this happened during peak hours, 5 p.m. during a working day).
Ok, these are official explanations and the blackouts may have been caused by evil hackers but, in this case, the brazilian government made an excelent job holding that information for years, leaking now thanks to an american former military that may have some vested interest spreading fear.
2 cents..
I have karma to burn so what the hell.
:)
He's right, you were being highly pedantic and confrontational, only barely challenging his statements.
It does give people the impression that, as previously stated, you are a twat.
Mod me down. It'll be a first for me
Actually, the grandparent post is totally right.
First, because English is defined by customary usage: if, for instance, a majority of English speakers start pronouncing a word in a different way, then that pronunciation will become valid after a while. The shift could also occur semantically. The French have the Académie française, the Germans have the Rat für deutsche Rechtschreibung; but for the English tongue, there exist no such academy.
Secondly, one should not forget that language is by no means systematic. Take the word "anti-Semitism," for example. We all know it means "hatred towards Jews." Now, let's decompose that word for analytical purposes:
- anti- means "against"
- Semite means "Semitic-speaking person"
Woah, wait... Arabic — among other languages — is also a Semitic language. So why has the word "Semite" come to specifically designate Jews? For the same reason we call the United States "America" or the Caribbeans, the "West Indies."
So, the bottom line is: in linguistics, pragmatism often wins where logics ought to prevail.
"The body may heal, but the mind is not always so resilient." -- Deus Ex: Human Revolution
Such a simple solution...keep at least 1 staff person there (3 shifts) and have a computer that connects their desktop system to where-ever it needs to go - but leave the systems that manages the critical systems off the internet...100% hacker proof. There is plenty of room in a profit-margin to employ someone to sit there and watch a screen.
There is little hard evidence in the 'report' as to what caused these outages in Brazil. And given that since at least 2003, the US administration has been well aware of the dangers of putting control equipment on the Internet, why are they still doing it? This whole cyberscare story is yet another pretext for getting more funding.
.. was caused by a combination of technical and human error .. when two of the four lines running from the Cachoeira Paulista substation - between Sao Paulo and Minas Gerais states - to Rio de Janeiro failed. A third line was switched off because of the low consumption on what was a public holiday, and the system operator accidentally disconnected the fourth line
Authorities blame human error for Jan.1 blackout - Brazil
A power cut
We can't know what would happen if banks were fully deregulated
read a little history, young man.
Lets see, if I'm unhappy about the level of service of my current utility what are my options? Not a whole lot.
Exactly. They are beholden to the shareholders, not their customers. They're a monopoly and don't have to care about their customers. A lot of the financial mess we're in now is a result of businesses that aren't monopolies acting as if they were.
My utility company is owned by the city. If they piss me off I'll not vote for the incumbant mayor (an dthat's happened here before). As a result, we get cheap dependable power.
Or you know, how about allowing utility companies to actually compete for prices, service and security.
And how do you go about that? Have ten different power grids in your town with ten electric companies, all with their own poles and cables? Utilities are a natural monoploly and NEED to be heavily regulated. Actually, natural monopolies shouw be owned by the city or state. It's the only way they can be held accountable to the people who pay them.
Free Martian Whores!