Slashdot Mirror
Chinese Researcher Says US Power Grid Is Vulnerable, Strategist Overreacts
An anonymous reader writes with a story about Wang Jianwei, a grad student in China who recently released a paper detailing a vulnerability in the US power grid. Despite the paper being rather typical for security research, its origin set off alarm bells for military strategist Larry M. Wortzel, who testified before Congress that the student was a threat, despite the fact that the published attack wasn't really feasible. Quoting:
"'We usually say "attack" so you can see what would happen,' [Wang] said. 'My emphasis is on how you can protect this. My goal is to find a solution to make the network safer and better protected.' And independent American scientists who read his paper said it was true: Mr. Wang's work was a conventional technical exercise that in no way could be used to take down a power grid. The difference between Mr. Wang's explanation and Mr. Wortzel’s conclusion is of more than academic interest. It shows that in an atmosphere already charged with hostility between the United States and China over cybersecurity issues, including large-scale attacks on computer networks, even a misunderstanding has the potential to escalate tension and set off an overreaction. 'Already people are interpreting this as demonstrating some kind of interest that China would have in disrupting the US power grid,' said Nart Villeneuve, a researcher with the SecDev Group, an Ottawa-based cybersecurity research and consulting group."
The biggest mistake he made in his paper was the assumption that Homer still works at Springfield Nuclear Power Plant. Clearly China is several seasons behind in their 'research'.
Yes, it would've been much better for this guy not to publish his research so we wouldn't know about this problem and leave it wide open. We should be thanking this man for his hard work, not lambasting him just because he happens to be Chinese.
If the Chinese government were interested in disrupting our power systems, wouldn't they be a little more secretive about their intentions than shouting out our flaws to all the world?
God invented whiskey so the Irish would not rule the world.
Public security research is not a threat. Vulnerable infrastructures that go unchecked are. The trend is to penalize security researchers for publishing their findings will only increase underground security research that will then just be sold to the highest bidder.
I really can't understand this way of thinking. It will probably get me modded down but I ask of you to think about this. What are you afraid of? every time I turn on the tv I see news from the US and every time it is about being scared or about why you should be scared and every time it turns out to be a lie. Why do you feel threatened by a person who is not born in the USA who tells you there is a flaw in your system and goes so far to even tell you all about that flaw.... I don't get it. I just don't get in, I'm sorry.
All power grids are always vulnerable to physical attack. There are few generation stations, relative to the number of customers and many large scale distribution lines. Take those out, and you've disabled power for a long time since they have to be rebuilt. A big, distributed, power grid like we have that does not have tons of excess capacity is just going to be at risk of having large parts taken off line by physical means. Ask anyone who lives in an area of heavy snow.
Now, I understand that an electronic attack could be done remotely, in theory without warning. Ok... To what end? In case people haven't noticed there's a big ole' swath of ocean between the US and China. So if China was to try that as a precursor at an attack, it wouldn't do any good. We'd either already know about the attack, having seen the ships on the way, or it would be way too early, since the ships would take a long time to get here, and it would be back up by the time they got here.
Not that any of that is very relevant to defense. It isn't like aircraft carriers are on the power grid, they've got their own nuclear reactors (2-4 of them in fact). You discover a good deal of important stuff has its own power backup since it isn't like power doesn't go out all the time anyhow. Hell we lose power to our building at work probalby 3-4 times per year, hence there's a generator on critical systems.
I just don't see how this sort of thing is that big a deal. Now please understand, I'm not saying we shouldn't try to secure it. When you find a security hole, you should fix it. Just a good idea over all so you don't have problems in the future. However I don't see it as being a military threat. I see it as being more of a script kiddie type of threat. Some asshole takes power out because they think it is funny. I don't see China trying to knock it out because I can't see how it would be useful, and it would have some rather large negative repercussions if they did and the US found out who was responsible.
It's a worry. Power grids use the Internet extensively. Since "deregulation", generating companies and distribution companies are separate businesses, and the generating companies compete with each other. The generating companies make bids, the distribution companies buy from the bids, and the grid operator (a neutral party) keeps the players connected and runs the market. Bear in mind that these systems don't have much excess generating capacity. 12-20% excess capacity during peak periods is typical. For a good overview of how this works, see Background on Generation Control, an online training course from PJM, the biggest grid operator in the world.
Most of the communication between the various players takes place over the Internet. The bid handling is done on machines connected to the Internet and many of the applications involved are Windows-based. The execution of a power buy involves the transfer of a set of switching decisions from the bid-handling machines to the machines which actually have control over generation and transmission equipment.
Details of the PJM Dispatcher Application and Reporting Tool are available. This is the main way generation companies and the dispatch center communicate. The user interface is Flash in a browser. Bid and buy information is shipped around as XML.
If the Internet-based apps go down, they revert to "conservative operation" and stop trying to optimize the economics. All generation facilities, even high cost peaking plants, crank up to at least standby power levels, in case they're needed. Export of power to outside the control area in trouble is stopped. Coordination is over the "all call", a squawk box system, and satellite phones. Worst case, everybody backs down to a preplanned schedule of what they're supposed to be doing at each hour of the day. In this mode, millions of dollars per hour are being lost, but the grid can probably be kept up.
One worry is insertion of bad data into the bid system via the Internet. The California ISO had outages in the early part of the last decade when energy traders put bids into the system which resulted in transmission congestion, forcing the CAISO to buy more expensive power. Back then, California had an energy auction every half hour. That was an extreme of deregulation. Now, the grid manager has more authority; generating companies put up data which offers price/quantity curves as bids, the grid operator takes them in increasing order of cost, and "energy traders" like Enron are no longer involved in hour by hour decisions. So there's more stability in the system.
Internet-based attacks against the control systems are also a worry. There definitely are connections to the external Internet. PJM seems to be using XML, in well-defined formats, to pass data across that boundary. They're not dumb. The problem is making sure that there aren't unwanted connections somewhere amongst the hundreds of different companies which connect to the control side of the system.
It's interesting that PJM doesn't rely on "security through obscurity". Hundreds of thousands of people have to know how this works. So they put the manuals, training materials, and live operational data on the Internet. (Right now, there's a problem near the West Virgina/Ohio border.)