Massive Power Outages In Brazil Caused By Hackers

Hugh Pickens writes "CBS reports on 60 minutes that a massive two-day power outage in Brazil's Espirito Santo State affecting more than three million people in 2007, and another, smaller event in three cities north of Rio de Janeiro in January 2005, were perpetrated by hackers manipulating control systems. Former Chief of US National Intelligence Retired Adm. Mike McConnell says that the 'United States is not prepared for such an attack' and believes it could happen in America. 'If I were an attacker and wanted to do strategic damage to the United States, I would either take the cold of winter or the heat of summer,' says McConnell, 'I would probably sack electric power on the US East Coast, maybe the West Coast and attempt to cause a cascading effect.' Congressman Jim Langevin says that US power companies need to be forced to deal with the issue after they told Congress they would take steps to defend their operations but did not follow up. 'They admit that they misled Congress. The private sector has different priorities than we do in providing security. Their bottom line is about profits,' says Langevin. 'We need to change their motivation so that when see vulnerability like this, we can require them to fix it.' McConnell adds that a similar attack to the one in Brazil is poised to take place on US soil and that it may take some horrific event to get the country focused on shoring up cyber security. 'If the power grid was taken off line in the middle of winter and it caused people to suffer and die, that would galvanize the nation. I hope we don't get there.'"

Comments

Good luck with that

[thenextstevejobs]

Probably impossible.

As we all should know by now, impenetrable security doesn't exist. What we should probably have is tighter backup power for essential services and places like hospitals, where local redundancy could help in the face of a remote 'hacker' type attack

Places where there is a lot of danger for people without electrical power don't need billions spent on the security of their power systems. They need redundancy, generators in their buildings that could be used to keep people alive, batteries, and common sense.

Oh well, let's spend a bunch of money on fear like we always do.

Re:Good luck with that

[Grishnakh]

As we all should know by now, impenetrable security doesn't exist.

Totally impenetrable physical security doesn't exist, but totally impenetrable electronic security most certainly does. It's quite simple to make something completely immune to hacker attacks over the internet: disconnect it from the internet!

Why the nation's power grid control absolutely needs to be tied into the internet, I have no idea. Maybe someone in the field can enlighten me. But if this is a big concern, it seems like it'd be pretty to eliminate the security threat by not having any control over the power grid exposed to the internet. If someone needs to exercise some control over the system, they have to get in their car and drive to the power plant.

Of course, this wouldn't prevent someone from sneaking in somehow, but that's a far more remote danger than some hacker on the internet (who could be anywhere in the world, and probably not anywhere near your power plant) gaining access.

Re:Good luck with that

[Korin43]

Or we could just not steal a trillion dollars from U.S. citizens and let them spend it on what they want, and then have jobs that are actually in demand created..

Re:Good luck with that

[cetialphav]

As we all should know by now, impenetrable security doesn't exist. What we should probably have is tighter backup power for essential services and places like hospitals, where local redundancy could help in the face of a remote 'hacker' type attack

Places where there is a lot of danger for people without electrical power don't need billions spent on the security of their power systems. They need redundancy, generators in their buildings that could be used to keep people alive, batteries, and common sense.

This isn't about impenetrable security. This is about taking basic precautions about known attack vectors. For example, many of these systems are not fail safe so an attacker can actually cause a generator to physically destroy itself. Since these generators are very specialized pieces of equipment, you don't just go to Home Depot and pick up another one.

It is not enough to protect hospitals, etc. A prolonged loss of power to the northern part of the US in the depths of winter would be devastating. Even with backup power supplies, no one has plans to deal with a month of no electricity.

This isn't about spending money on fear. It is about naively ignoring a threat and hoping it will never happen. We need to find a way to force utility companies to take these threats seriously and the only way to do that is to have financial penalties for lax security.

Re:Good luck with that

[RightwingNutjob]

It's perfectly possible. It's called an air gap. If you still want centralized control of a remote substation, don't do it over the public internet. That's not as bad as it sounds in terms of costs, because if you're the power company, you already own a completely independent set of cables to said substation. Now the hacker has to get out of his mom's basement and climb a utility pole to hack you.

Still worried about the possibility of remote hacking from a guy who spent too much time climbing trees in his childhood? Again: airgap. The only bits that should flow between the data transciever in the substation and the actual critical hardware shouldn't flow directly. Observe below:
[Command/Control Center] -----dedicated line-----[Rx/Tx Computer]---Low BW Link----[Local Control Computer]----Hardware

The local control computer, which should be locked up in the substation with a big steel door on it should have internal software interlocks in it that reject bad input from the physically separate transceiver unit. By physically separate, I mean really physically separate, as in one wire per bit for commands and one analog channel for values. Possibly optical lines if we're paranoid about RFI. Now, in order to hack that one substation, the hacker has to physically break into it. At which point we're back to the vulnerability inherent in any distributed dumb system.

I take cash or check.

Re:Good luck with that

[mcgrew]

Oh well, let's spend a bunch of money on fear like we always do.

Terrorists are the least of out worries here in the midwest US. In the winer we have ice storms, in the spring and summer we have storms and wind. An outage caused by hackers probably wouldn't last lomg here, but when a tornado rips through and destroys every utility pole and the equipment hanging from them, it'll take a while to get back on line.

When the tornados ripped through here in 2006, as I walked through the destruction in search of a hot cup of coffee the next day, the thing I thought most was "If Bin Laden saw this he'd give up. No way could a terrorist do this much damage!"

The threat is narural events. The danger from terrorists is minimal.

So...

[CrAlt]

Who thought it would be a swell idea to to hook the grid's computers to the INTERNET?
Did someone surf some pr0n sites on the Win98 powered control computer down at the power plant?

Internets...

[Shadyman]

Things like this make me wonder why mission- and life-critical systems are (presumably) set up on Internet-facing systems. Sure, it's cheap, but when the walls come tumbling down like this article implies, cost is a moot point.

I don't see why they can't just buy a phone line for each power station and link to central stations (also with NON-Internet-facing systems) like that.

Nostalgia

[stagg]

Awfully reminiscent of the hysteria that took place in the 80s, when the FBI and media were convinced that hackers were going to "crash the grid," launch a nuclear attack or god knows what other heinous crimes. The cost to the freedom of their own citizens, and the financial expenditure on all of this hysteria seems awfully prohibitive compared to the actual risk.

Re:Hit'em in their wallets

[Trepidity]

Well, the energy sector has traditionally been heavily regulated, and works well compared to the huge mess the deregulated banking system made of itself. You do realize that the government took over the banking sector because the bankers failed to run it?

Re:Hit'em in their wallets

[causality]

Yes, of course! The government has already taken over the banking sector, the mortgage sector, the automotive sector, is about to take over the healthcare sector, so fuck it - the government may as well take over the energy sector as well. I can't wait until they take over food distribution - I've always wanted to know what it's like to stand in line for a loaf of bread all day.

I am not a fan of government intervention either, nor do I like what was done with banking and automobiles. Having said that, this isn't what is being proposed here. If the electric utilities must comply with laws mandating that they meet or exceed a minimum standard of security, this would be much more like the way local Board of Health requires that restaurants handle food in ways that prevent food poisoning. The Board of Health does not own the restaurants and it does not choose their management; it just periodically inspects them and can shut them down if there are egregious violations. Something similar could be worked out for the power companies when it comes to security.

Re:Hit'em in their wallets

[Scrameustache]

If they won't integrate safety systems to protect the system properly from hacker attacks, hit them in the wallet, hard. Pass sound regulation to force them to implement safeguards, require inspections/audits that they are done, not just take their BS word for it.

Yes, of course! The government has already taken over the banking sector, the mortgage sector, the automotive sector, is about to take over the healthcare sector, so fuck it - the government may as well take over the energy sector as well. I can't wait until they take over food distribution - I've always wanted to know what it's like to stand in line for a loaf of bread all day.

The great blackout of 2003, which took out the north east united states and a good chunk of ontario, was caused by deregulation (removing the requirement to clear the branches around the power lines).
Quebec, which has state-owned power (Hydro-Quebec) was not hit hard by that blackout, because it keeps its grid out of phase with those dangerously unregulated parts around it.

Learn the lesson: You can't trust the greedy to run critical infrastructure.

Re:Those gosh-darned HACKERS again

[QuoteMstr]

Yep. We lost the terminology war a decade ago. It's time we deal with it.

Re:Your official guide to the Jigaboo presidency

[QuoteMstr]

Because the remedy for bad speech is more speech. Censorship is never justified. If a post gives you the vapors, stop reading it. A free society is one where it's perfectly fine to stand on a soapbox and make a fool of yourself. I'd like Slashdot to stay as free as possible.

Why?

[CrAlt]

If you have transmission lines running from point A to point B then why cant you just string a data line right below the transmission lines? You already own the right of way. You already have the towers/pole line ran. Compared to the cost of a big high tension line the cost of a little data line would be nothing.

Re:Why?

[A beautiful mind]

Why bother? Just use the Internet. Banks run transaction traffic through the internet, of course heavily encrypted, with proper integrity protection and certificates. It's entirely possible to do this securely, the global economy already depends on this capability.

There is no need to reinvent the wheel, the power companies should just be using proper compartmentalization techniques to dig some trenches between the internet and their systems.

Like we'd respond that well

[DoofusOfDeath]

'If the power grid was taken off line in the middle of winter and it caused people to suffer and die, that would galvanize the nation. I hope we don't get there.

If 9/11 was any indication, our national response would be characterized by...

• NSA snooping into all of our computers, and "state secrets" claimed whenever we tried to invoke the 4th Amendment in court.
• A few massive, no-bid contracts by the Federal Government which achieve almost nothing of value.
• RIAA/MPAA sleezeballs capitalizing on it in ways I don't even want to contemplate.
• Possibly an insane (think Sarbanes-Oxley) amount of red tape added to many computer installations in the country.
• Republicans and Democrats somehow finding a way to blame each other for this, deadlocking the Legislature for a while, and then in some kind of last-minute spasm, pass an appaling bill to just have the appearance of doing something.

Only in my wildest fantasies would such an attack mobilize the country to have a rational, balanced cyber-security posture.

Naive Population

[spyder-implee]

You are extremely Naive if you believe this garbage. Blaming bandits for the shortcomings of the government is one of the oldest tricks in the book.

Re:America?

[nomadic]

I think you're confused about the English language! "In America" certainly includes any country in either North or South America.

English is defined by customary usage. If you said "In America" to 100 English speakers, MAYBE one would include any other country than the US. If you're lucky.

goes good with popcorn

[Eil]

'If I were an attacker and wanted to do strategic damage to the United States, I would either take the cold of winter or the heat of summer,' says McConnell, 'I would probably sack electric power on the US East Coast, maybe the West Coast and attempt to cause a cascading effect.'

Oh yeah, well if I were an attacker, I would build a gravity weapon so powerful that it would pull the moon out of its orbit and crash it into the earth.

OR I would create a poison so potent that just a few drops of it in any lake would kill everyone within a 5-mile radius.

OR I would plant thermonuclear bombs in the capitals of the 10 largest cities in the U.S. and detonate them all at once.

See, Mike McConnell? It's easy to invent terrorist movie plots. If they gave out awards for Most Creative Terrorist Strategies That Would Never Work, you all all of your three-letter agencies would win first prize every time.

I disagree with the military... I am brazilian...

[jorlando]

The blackout in 2005 was a human failure. One transmission line went down, the team recovering that line made a mistake and instead of activating the repaired line disabled the backup line. Result: 3 states withou electric power.

The blackout in 2007 was due a circuit breaker shutting down one line, the same happening after in the backup line, that could manage the excess load (this happened during peak hours, 5 p.m. during a working day).

Ok, these are official explanations and the blackouts may have been caused by evil hackers but, in this case, the brazilian government made an excelent job holding that information for years, leaking now thanks to an american former military that may have some vested interest spreading fear.

2 cents..

Re:Hit'em in their wallets

[mcgrew]

We can't know what would happen if banks were fully deregulated

read a little history, young man.

Lets see, if I'm unhappy about the level of service of my current utility what are my options? Not a whole lot.

Exactly. They are beholden to the shareholders, not their customers. They're a monopoly and don't have to care about their customers. A lot of the financial mess we're in now is a result of businesses that aren't monopolies acting as if they were.

My utility company is owned by the city. If they piss me off I'll not vote for the incumbant mayor (an dthat's happened here before). As a result, we get cheap dependable power.

Or you know, how about allowing utility companies to actually compete for prices, service and security.

And how do you go about that? Have ten different power grids in your town with ten electric companies, all with their own poles and cables? Utilities are a natural monoploly and NEED to be heavily regulated. Actually, natural monopolies shouw be owned by the city or state. It's the only way they can be held accountable to the people who pay them.