Slashdot Mirror
Hackers Broke Into Brazil Power Grid Operator's Website Last Thursday
An anonymous reader writes "A week ago, 60 Minutes had a story (we picked it up too) claiming that hackers had caused power outages in Brazil. While this assertion is now believed to be in error, hackers were inspired by the story actually to do what was claimed. Last Thursday, they broke into ONS, the operator of the grid (Google translation; Portuguese original). DarkReading has specific details on the SQL injection vulnerabilities the hackers probably used."
the hackers invaded the _website_, the ONS network of computers that actually control the system is private and not connect to the internet.
> One would think critical power networks would be close systems.
Read the article. What was broken into was the "corporate network" of the organization that runs the system. The control system was not broken into and in fact appears to be protected by an air gap.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
FTA...
"ONS was notified last week of this problem. They've confirmed that, indeed, its Website was hacked. It claims to have fixed the SQL injection problems and that there was no danger because there was no connection between its Website network and back-end control network."
They were not. Read the article.
"there was no danger because there was no connection between its Website network and back-end control network"
Hackers didn't broke into the ONS (national power grid operator) system. They have broken into its web site, and this has happened days after the blackout. And the website, naturally, has nothing to do with the operational servers. There are no evidences whatsoever that last Thurday's blackout was caused by an online attack.
This comment may contain speech figures. Reader discretion is advised.
"A rede operativa é blindada, separada da internet e operada via comando de voz", segundo informou a entidade
In English,
According to the organization, "The operative network is secure, is separated from the internet, and is operated by voice command"
The article also says that the hackers got into the operative network but not in the operative network.
Uh oh, best watch out or the Anti-Sec will destroy you... hahaha.
Oh i bet those kiddos will be all over this story.
Hey there AS, how'ya doin? You want some candy?
ONS, the operator of the electric system, whose website was hacked, is not a state-run company. It is a private non-profit regulated by Brazil's National Electrical Energy Agency.
-- SouNerd.com
There was no issue with Itaipu. It remained working. For now it seems it was a problem with distribution lines.
-- SouNerd.com
Well, first of all, the 60 minutes episode about blackouts in 2005 and 2007 provides absolutely no proof or other data about those blackouts being caused by hackers, except for two anonymous sources that suspect it was.
Second, there was no breach in the grid network, at least not know so far. What happened was that the ONS (the Brazilian electric grid operator) website was hacked.
-- SouNerd.com
Here in Chile a guy reported the government about a serious bug on their outsourcing website (chilecompra.cl), they ignored him for months, and he made the bug public (you were able to know your competition's offer to the government just by changing a GET parameter).
He was condemned by a court for breaking the law, more info here (spanish)
What kind of action should one take in those cases? Has this happened before in other countries?
Hackers didn't "break into the grid" or anything close to that. They defaced the *website*, that's it.
While that is surely a shame for them, is nothing even close to a real worry.
No power outages were caused at all (and, in fact, couldn't be caused).
Now please quit posting uninformed crap.
Go to Options and change Comment Post Mode to Plain Old Text.
That will take care of the newlines (inserting <br /> tags for newlines).