Slashdot Mirror
Smart-Grid Control Software Maker Hacked
tsu doh nimh writes "Telvent, a multinational company whose software and services are used to remotely administer and monitor large sections of the energy and gas industries, began warning customers last week that it is investigating a sophisticated hacker attack spanning its operations in the United States, Canada and Spain. Brian Krebs reports that the attacker(s) installed malicious software and stole project files related to one of Telvent's core offerings — OASyS SCADA — a product that helps energy firms mesh older IT assets with more advanced 'smart grid' technologies. A follow-up story from Wired.com got confirmation from Telvent, and includes speculation from experts that the 'project files' could be used to sabotage systems. 'Some project files contain the "recipe" for the operations of a customer, describing calculations and frequencies at which systems run or when they should be turned on or off. If you're going to do a sophisticated attack, you get the project file and study it and decide how you want to modify the pieces of the operation. Then you modify the project file and load it, and they're not running what they think they're running.'"
stupid vendors.
They won't be installing any of this technology on my property.
Maybe in 10 more years, but I don't trust them to do their jobs effectively, and without violating my rights as both a person and a citizen of this country.
That sounds very technical which means inside knowledge - someone pissed of a sysop
The attackers will produce a cascading failure in the electrical grid that brings down the entire North American power grid. A few additional well timed physical attacks, and we're back to the bronze age for the foreseeable future. Food stocks will quickly run down, as will supplies of petrol. The government will attempt to exert control, but without food and as the situation deteriorates, most of the soldiers will go AWOL to try to get home to help family. Soon, the dying begins. Roving bands of robbers gradually coalesce into gangs ruled by small time warlords, and eventually regional rulers who hoard the remaining food, fuel, and ammo. The few isolated people who planned ahead and who have escaped into their countryside shelters are systematically hunted down, plundered, and given the option to swear fealty to the new regime or be dispatched. Huge fires sweep through most large cities and pollute the atmosphere with soot. Winter soon sets in early due to the reduced sunlight penetrating the atmosphere, and is the harshest one in generations. Eventually, as the winter ends and spring sets in, over 75% of the population is either dead or close to it. Suddenly, armies of foreign soldiers appear at our shores, and before long all of the remaining Americans are conscripted and forced to farm the still fertile fields of America's breadbasket for meager rations, which is still better than starvation and death.
Sure hope not. I mean, does every goddamn thing need to be computerized?
“He’s not deformed, he’s just drunk!”
Really shouldn't be, since the security holes in these systems have been talked about for years now. The threat is just greater now that utilities are actually installing/using these devices on a much larger scale.
Texas citizens have created quite a stir trying to fight installs there....http://www.bantexassmartmeters.com/
stop spamming the thread with crying about your smart meters, this is much much bigger than you
The main problem is that only the hackers that have not tried to hack their system, did not hack their systems. And the more terrifying truth is that there is not even one vendor with secure solution out-there. I am just amazed of how they even put the word "secure" in there product!!!!
This is a good example of why the gov't is worried about cyber security for critical infrastructure. Just like there are minimum standards for building and fire safety there needs to be minimum standards for IT infrastructure security.
Learning HOW to think is more important than learning WHAT to think.
...investigating a sophisticated hacker attack spanning its operations in the United States, Canada and Spain... and they're not running what they think they're running.
Sounds like they need a modern-day Inigo Montoya to do their security: <SPANISH ACCENT>"You keep using that software, I do not think you're running what you think you are running."</SPANISH ACCENT> And if the worst happens, he can exact revenge: "Hello. My name is Inigo Montoya. You killed my power grid during a level 85 raid. Prepare to die."
are waiting for their newly scripted toyboxes,,,and some of them work for "your" government(s).
What with all the new "smart" grids, meters, self-driving cars, internet enabled devices(including medical), etc, etc,,, there are multiple levels of salivating bastards,,, including those just waiting for new BOFH stories to appear on the subjects.
That's right, keep banging on that war drum. While the leaders are making all the big noise and keeping everyone distracted, the governments and their military are already engaged in full-on, no-holds-barred combat.
We took out 50% of Iran's nuclear capacity with nothing more than a USB stick loaded with Lady Gaga albums and porn.
But at least Iran was smart enough to put an AIR GAP between their critical systems and the rest of the world. We had to rely on a human to use the Sneakernet to infect those centrifuge controllers.
Whoever is behind this, is simply doing Gangnam Style right through the front door.
[End Of Line]
YOU. DO. NOT. CONNECT. VITAL. INFRASTRUCTURE. TO. THE. INTERNET.
fucking idiots.
guess we better learn to live in the dark again, because these fools and the power companies they blather money out of will put us there yet.
if this is supposed to be a new economy, how come they still want my old fashioned money?
"The attack comes as U.S. policymakers remain gridlocked over legislation designed to beef up the cybersecurity posture of energy companies and other industries that maintain some of the worldâ(TM)s most vital information networks"
..
US spooks using "Chinese hackers" as pretext to increase budget
"In letters sent to customers last week, Telvent Canada Ltd. said that on Sept. 10, 2012 it learned of a breach of its internal firewall"
What, pray tell is an ' internal firewall'?
`ecc.exe fxsst.dll niu.dll ntshrui.dll`
I know how this ends. Chunky (tm) soup warms you up and fills you up. and then Weatherbreak.
if this is supposed to be a new economy, how come they still want my old fashioned money?
WHO. DOESN'T. HAVE. A. FUCKING. CLUE.
No interconnections = no usage monitoring, no generation monitoring, no billing, no grid interconnects, no fucking power for anyone.
We stated a doctrine a year ago, that a cyber attack equivilant to a military physical attack, could be retaliated against with physical bombs.
What much of the muslim world doesn't realize, is that while we prefer to avoid casualties, and fight smart, if need be, we can -- and do-- rachet up the heat to a level they can't take.
If Iran or Lebanon/Hezb'allah want to atack us, they should be prepared for their countries to be destroyed.
Oh and, Egypt and Saudi Arabia, listen up: you have been placed alert. If you sponsor any more 9-11 style attackers against us, you are going down.
Egypt: listen up. If Romney wins, your country may suddenly become a UN mandate. Saudi Arabia, guess what: once we go in, the money is getting cut off. We will both sieze all the oilfields and you may not get Mecca back, ever. You muslims will be lucky if Jordan gets to control it for a bit. If Romney gets elected, it might get nuked, or, if the neocons have their way, gone over with a fine tooth comb to interrogate everyone and find the local antiamerican ring leaders (basically everyone) and imprison them.
Oh and OIC/Arab League/"Non Aligned Movement" : we consider you guys to be enemies of various degrees. If you fuck with us, we'll blow you up. Just keep that in mind.
I mean look at SCADA. The whole field seems to be staffed by idiots.
They think that OPC (OLE for Process Control) is a good idea, they still use that, even though the networking component works via DCOM, and it's all Windows only.
I mean a sane person would go and have sensors spit out text. That text can then be easily processed and archived easily. You can even batch process it, if you want.
You can of course, also pour it into some SQL database if you prefer to, but having your primary data as text means that you can easily change your database engine without having to worry about compatibility.
For OPC you need additional software just to be able to archive it.
A simple (non-XML) format also would have the advantage of being easy to parse. You might, for example have a little single line header, having the number of the meter in it. Then you have each line representing a measurement point. First column could be the time in Unix epochs, then a space, then the measurement values. Such a format can easily be parsed, quicker than it can be read from RAM and without the danger of buffer overruns.
If they are smart, the "Smart -Grid" will eventually fall under Homeland Security and any contracted entities used to create the IT infrastructure will have to fall under DHS security policy and a secure and non-secure network will be established specifically for National Power Distribution.
We all know the US military maintains their own inter-network. I think the same will be needed for a smart-grid and it should fall under Homeland Security.
(warning: lengthy rant ahead)
I'm an ICA engineer (instrumentation, control and automation) I used to program PLCs and SCADA systems, but now i simply design the architecture of the system, i.e how many PLCs and where, how much I/O on each PLC, how many supervision systems, data interchange, etc. So you could say I’m a “system architect” although we never use that name. I’m an electrical engineer.
I work on water treatment plants: My PLCs control how much chlorine /ammonium sulphate/etc goes into your water, what is the correct UV dose, among a myriad other things.
And I'm starting to get tired of this wave of scaremongering that started when stuxnet came out.
As I see it, in general, people with a BS in CS or CE don’t have a clue of how industrial systems work. When I was at university getting my EE degree, the CS people often said “we computer scientist are so important! We design the computers that run your electrical networks and your water and gas systems.!!”
Well, you don’t. We EE and ICA-E have been designing that for the last hundred of years. We only started to use PLCs in the seventies as a cost saving measure, but we could go back to the relay boards if we wanted. In fact, the ladder PLC programming resembles relay board design) And scada systems came next as replacement for the expensive and time consuming control panels.
The “hacker gets into plant” scenario so used by Hollywood scriptwriters never happened, until the US government assembled a massive group of world class experts, and by getting the manufacturers Microsoft, Siemens and Vacon on board. I’d say that one occurrence on 40 years, and that occurrence having behind the force of the world’s biggest superpower, it’s a pretty good security record.
And know what? Stuxnet spread all over Iran, and despite of that, reports indicate that uranium enriching it’s increasing. So it’s debatable if stuxnet achieved its ultimate objective or not. All that we know is that the US is back to the good old-fashioned method of killing nuclear scientists.
So leaving international politics aside and going back to our humble water plants. I’ll try to shed a little light on how these things work.
You know what would happen if somebody gets into a plant and blows up all the computers and network gear on the control room? I’ll tell you: nothing. The plant would keep running since the code that controls the machines is residing in the PLCs, and the PLCs are in one cabinet on the MCC rooms. All that would happen is that the operator would have to move his fat ass and actually go to the HMI on the MCCs if he desires to change a setpoint. SCADA machines are dumb machines, used for data visualization and logging, and setpoint changing only.
Now, what would happen if somebody blows up all the PLCs? Or worse, if someone breaks into the MCC room with a field programmer and changes the code of any of the PLCs?.
At best, the machines simply stop and that means that the operator has to go to the local control panel and change some some switches from “remote” to “manual”. And at worst, there are these things called the wired interlocks. No matter how you change the code, It’s impossible to damage a motor by overheating, or run a pump dry, or have the run-to-supply pumps running If the water is out of parameters.
Of course you could bypass the wired interlocks, but then you need the key to the MCC room, the key to the cabinet, a complete set of blueprints, a multimeter and a screwdriver. By this point you need physical access to the site, and I’d say its way easier to damage the machinery itself than the hardware controlling it.
However, since stuxnet came out, all the IT security companies have suddenly realized: “new market!!!” “we can now sell our crap to these hapless industrial clients!” “hundreds of unprotected ma
That's logically invalid, you know. But ignoring that, there's a bigger problem.
You're asking for distributed generation under distributed authority. That is the opposite of what your elected officials and their corporate masters have spent a hundred years converging on; you cannot have what you're asking for as long as you also want things like "laissez faire capitalism" and "a totally free market" and "national currency" etc. You're talking about what the much-derided (on slashdot, anyway) greens want - dirty hippy philosophy, oh noes!
Only a strong regulatory force (like, for instance, the social structures that reduce the murder rate, which include a complex mesh of interlocking local, federal and international laws, customs, and institutions) can prevent the consolidation of control of energy resources under a single controlling entity or an essentially monolithic group of entities. That regulatory power is what the post-Reagan world calls "Evil Big Government over-regulation" - forcing wealthy entities to do things for the common good, despite the fact that they can become even more wealthy by acting solely for short-term self-interest (see "greed is good" and "tragedy of the commons" if you aren't a Randroid).
If you let the zaibatsus run the power grid, it will be networked. It's the only way they can do it, because the corporations themselves are effectively a centralized control system.
Suspicion is that hacks are from Chinese source. Meanwhile here in Canada we ar GIVING the Chinese CONTROL of our infrastructure, no hacking required,
Huawei has telecom projects with Telus, Bell, SaskTel and WIND Mobile. Telus has just signed a $250-million contract to provide the Canadian military with secure voice and data services worldwide.
Chinese state company CNOOC’s $15-billion bid for Nexen, a major Canadian oil and gas company. That will most likly go through.