Slashdot Mirror
Wind Power Firm Sees No Evidence of Hack
alphadogg writes "One day after a hacker posted screen shots and data to a hacking mailing list, saying he had broken into a New Mexico wind turbine facility, the company that runs the turbines says it has seen no evidence of a computer intrusion. The hacker, who calls himself Bigr R, made the claims Saturday, posting screenshots of the facility's management interface, screenshots of an FTP server and project management system, as well as Web server info and configuration data from a Cisco router."
I'm quite sure he gathered all this information while he was still employed, and is just now releasing it.
If you look at the screenshots he posted (example) you'll see that some of the screens were in the German language or a derivative thereof. Why would a New Mexican power plant have its systems in German!?
It's possible that the IT staff who failed to secure the networks and websites also lack the expertise to detect an intruder. It's certainly not easy, and if they were able to cleanly socially engineer (or perhaps guess) passwords to get it done, there may be no way to detect it at all.
This whole thing smelled funny from the beginning.
They're trying to goad an emotionally immature hacker into providing even more evidence.
Making the criminals do the investigative legwork .. now that's smart policing.
Wind Turbine Firm hack confirmed: "Oh wait, never mind. We found his rootkit on port 31337 going out from our webserver! D'oh!"
Absence of evidence is not evidence of absence.
Congrats, you've set the bar super low -- not only did you not bother to RTFA OR TFS, you actually failed at parsing TFH(eadline). Go, moron!
Caveat Utilitor
Or maybe the hacker, or others, are simply waiting to see how much info they can squeeze out of any disclosure where the company attempts to show there hasn't been a break-in.
Why would their "management interface" be accessible via the internet? It seems to me that control of such facilities should always be air-gapped as part of security-101.
Otherwise I imagine the hacker will try to put up a demonstration.
i wonder what can be done with access to that system.
It seemed from the beginning that the "hacker" was the person the hacker claimed to be getting revenge for, the guy who was fired from Florida Power and Light the firm who the wind farm was a subsidiary of.
I would not doubt the photos had been taken when the guy still worked for the plant. Even I have photos of critical systems I work on at work, doesnt mean I could get into them once I was terminated, our security team times to the minute the person is "let go" when we destroy accounts and change passwords.
"...Sterndale: How do you know that? ."
Holmes: I followed you.
Sterndale: I saw no one .
Holmes: That is what you may expect to see when I follow you. .
The Adventure of The Devil's Foot - A Conan Doyle.
Why is something critical like a wind farm even hooked up to the internet? Does it need an internet connection? If you do need to put data onto the Internet, why can't it be from a secure one way firewall box that doesn't even accept connections into it, it only sends data out to an insecure server on the web and the web monitors can be watched from there.
Is that the most likely scenario is that this guy is for real. And isn't that, as a former employee, he has old configs stored somewhere that he still has access to (like a personal laptop). As well as screen shots related to training material. Nah this guy that was just fired and has offered up no real-time evidence is probably telling the truth. Just because that would make it more interesting.
Cause Norton Anti-Virus sez so!
zzzzzzzzzzz.........
Dammit, Timecube, you've crossposted back into the sane world again. Stop that!
John
Anyone else find it funny that the vty and con passwords were cisco.
hackED:)
Baby shower food
It's a non-denial denial!
When the foot seeks the place of the head, the line is crossed. Know your place. Keep your place. Be a shoe.
these arent the turbines your looking for
It's "cracker", not "hacker". Come on /. You should know better.
You can't backtrace him.
ABB also makes DCS systems and they are a swiss company (ie: speak German).
Another poster already pointed out Siemens as well.
I'm not sure if NextEra is saying it didn't happen, they can't tell, or they are refuting that the screenshots were taken due to a 'hack'. Either way, some of the information looks too credible. For example, NextEra provides output data from wind farms and this data goes into various OASIS systems. One screenshot shows what are presumably OASIS files from as recent as last week. All NextEra would need to do is double check those files, make sure that timestamps and sizes match what exists and that is proof. That should then lead back to the FTP session that gathered that directory listing.
http://en.wikipedia.org/wiki/Open_Access_Same-Time_Information_System
The only thing I know is saying we "found no evidence" one day after the release of information is a stupid PR move. It makes you look incompetent or incapable of detecting / protecting your information, exactly what the 'hacker' was attempting to do. NextEra just reinforced that notion.
If BigR is really a former disgruntled employee he might as well have just posted his full name and address along with the dumps.
The response by Benji on the seclist mailing list sums it up: "so how long do you give yourself before you're in prison?"
I hacked slashdot. As evidence, i found this in the slashdot servers:
0x38a7fe1a
Probably an ex-employee for the IT group that knows how to use TOR to post something. Oooooooo what a big hacker he is. Good password management and data cleanup (DLP) cost money most wind farm firms don't have a lot of that substance... yet.