Slashdot Mirror
Wind Power Firm Sees No Evidence of Hack
alphadogg writes "One day after a hacker posted screen shots and data to a hacking mailing list, saying he had broken into a New Mexico wind turbine facility, the company that runs the turbines says it has seen no evidence of a computer intrusion. The hacker, who calls himself Bigr R, made the claims Saturday, posting screenshots of the facility's management interface, screenshots of an FTP server and project management system, as well as Web server info and configuration data from a Cisco router."
If you look at the screenshots he posted (example) you'll see that some of the screens were in the German language or a derivative thereof. Why would a New Mexican power plant have its systems in German!?
It's possible that the IT staff who failed to secure the networks and websites also lack the expertise to detect an intruder. It's certainly not easy, and if they were able to cleanly socially engineer (or perhaps guess) passwords to get it done, there may be no way to detect it at all.
This whole thing smelled funny from the beginning.
They're trying to goad an emotionally immature hacker into providing even more evidence.
Making the criminals do the investigative legwork .. now that's smart policing.
Wind Turbine Firm hack confirmed: "Oh wait, never mind. We found his rootkit on port 31337 going out from our webserver! D'oh!"
Absence of evidence is not evidence of absence.
Otherwise I imagine the hacker will try to put up a demonstration.
i wonder what can be done with access to that system.
Any SCADA/HMI system should be physically isolated from the business LAN regardless of whether it's internet accessible or not. Sounds like a few inherently bad choices were made here if this is true.
Is that the most likely scenario is that this guy is for real. And isn't that, as a former employee, he has old configs stored somewhere that he still has access to (like a personal laptop). As well as screen shots related to training material. Nah this guy that was just fired and has offered up no real-time evidence is probably telling the truth. Just because that would make it more interesting.
Cause Norton Anti-Virus sez so!
Almost everything is hooked to the internet. Most of the critical stuff is behind a good vpn and a good firewall that most engineers do not imagine to be hacked.
And who says it was hacked from the internet?
Dammit, Timecube, you've crossposted back into the sane world again. Stop that!
John
It's a non-denial denial!
When the foot seeks the place of the head, the line is crossed. Know your place. Keep your place. Be a shoe.
It's "cracker", not "hacker". Come on /. You should know better.
You can't backtrace him.
ABB also makes DCS systems and they are a swiss company (ie: speak German).
Another poster already pointed out Siemens as well.
I'm not sure if NextEra is saying it didn't happen, they can't tell, or they are refuting that the screenshots were taken due to a 'hack'. Either way, some of the information looks too credible. For example, NextEra provides output data from wind farms and this data goes into various OASIS systems. One screenshot shows what are presumably OASIS files from as recent as last week. All NextEra would need to do is double check those files, make sure that timestamps and sizes match what exists and that is proof. That should then lead back to the FTP session that gathered that directory listing.
http://en.wikipedia.org/wiki/Open_Access_Same-Time_Information_System
The only thing I know is saying we "found no evidence" one day after the release of information is a stupid PR move. It makes you look incompetent or incapable of detecting / protecting your information, exactly what the 'hacker' was attempting to do. NextEra just reinforced that notion.
If BigR is really a former disgruntled employee he might as well have just posted his full name and address along with the dumps.
The response by Benji on the seclist mailing list sums it up: "so how long do you give yourself before you're in prison?"
I hacked slashdot. As evidence, i found this in the slashdot servers:
0x38a7fe1a