Slashdot Mirror
Hackers Broke Into Brazil Power Grid Operator's Website Last Thursday
An anonymous reader writes "A week ago, 60 Minutes had a story (we picked it up too) claiming that hackers had caused power outages in Brazil. While this assertion is now believed to be in error, hackers were inspired by the story actually to do what was claimed. Last Thursday, they broke into ONS, the operator of the grid (Google translation; Portuguese original). DarkReading has specific details on the SQL injection vulnerabilities the hackers probably used."
the hackers invaded the _website_, the ONS network of computers that actually control the system is private and not connect to the internet.
Really -no- critical system be it power, heating, cooling, etc. should be on the internet. A local network is sufficient with the main computer controlling the other computers not being connected to the internet. How hard is it to understand?
Taxation is legalized theft, no more, no less.
60min does a story on the security of Brazil's power grid, Brazil says its not true, a few days later, they have the worst power outage in a decade, and now this story.....
> One would think critical power networks would be close systems.
Read the article. What was broken into was the "corporate network" of the organization that runs the system. The control system was not broken into and in fact appears to be protected by an air gap.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
FTA...
"ONS was notified last week of this problem. They've confirmed that, indeed, its Website was hacked. It claims to have fixed the SQL injection problems and that there was no danger because there was no connection between its Website network and back-end control network."
And, two days after the blackout, the systems analyst Maycon Vitali, 23, revealed in the blog "Hack'n'roll" to a login page of the ONS revealed error in the validation data. The flaw could allow a hacker to send command to the database and find sensitive data from ONS.
The failure was published in the newspaper Folha de S. Paulo on Monday (16).
This is exactly why full disclosure is not good.
How so? If two days after the vulnerabilty was exploited causing millions of dollars of damage they *still* don't fix it, then the public has the right to know how much the security of the systems sucks. It may be the only way to prevent this from happening again.
This is ridiculous. You can easily hack into their corporate website, but there is no way hackers got into the Brazilian power grid management system, because there is no such automated system in the first place! The central agency controlling the grid Operador Nacional do Sistema (ONS) operates the center by calling their buddies on generating station over private phone lines. Unless you are a very good voice impersonator and know all the necessary protocols, you will not get very far. That's when lack of technology is a plus.
Seriously? You must work for the government..
Your solution: Hide or pretend the vulnerability doesn't exist, or ignore the possible ramifications of its exploitation and further promote shoddy programming practices.
The better solution: Make the vulnerability public so that the company is forced to do something about it immediately, hence preventing any threats (pending their programming practices improving).
Full disclosure puts the responcibility on the company to keep their products/services secure, as to keeping it a secret, which puts the burden on whistleblowers fearing prosecution.
Which world do you prefer?
'We are trying to prove ourselves wrong as quickly as possible, because only in that way can we find progress.' RPF
Today hackers gained access to my bank account and increased the ballance to 100 millions dollars without alerting authorities.
Actually that didn't happen. My bank account is perfectly secure. There are no hackers anywhere that are smart enough to do such a thing.
We have the best government that money can buy.
Or everybody's fired!
Don't think of it as a flame---it's more like an argument that does 3d6 fire damage
Original xkcd reference. http://xkcd.com/327/
-- SouNerd.com
Well, first of all, the 60 minutes episode about blackouts in 2005 and 2007 provides absolutely no proof or other data about those blackouts being caused by hackers, except for two anonymous sources that suspect it was.
Second, there was no breach in the grid network, at least not know so far. What happened was that the ONS (the Brazilian electric grid operator) website was hacked.
-- SouNerd.com
Here in Chile a guy reported the government about a serious bug on their outsourcing website (chilecompra.cl), they ignored him for months, and he made the bug public (you were able to know your competition's offer to the government just by changing a GET parameter).
He was condemned by a court for breaking the law, more info here (spanish)
What kind of action should one take in those cases? Has this happened before in other countries?