Slashdot Mirror
Smart-Grid Control Software Maker Hacked
tsu doh nimh writes "Telvent, a multinational company whose software and services are used to remotely administer and monitor large sections of the energy and gas industries, began warning customers last week that it is investigating a sophisticated hacker attack spanning its operations in the United States, Canada and Spain. Brian Krebs reports that the attacker(s) installed malicious software and stole project files related to one of Telvent's core offerings — OASyS SCADA — a product that helps energy firms mesh older IT assets with more advanced 'smart grid' technologies. A follow-up story from Wired.com got confirmation from Telvent, and includes speculation from experts that the 'project files' could be used to sabotage systems. 'Some project files contain the "recipe" for the operations of a customer, describing calculations and frequencies at which systems run or when they should be turned on or off. If you're going to do a sophisticated attack, you get the project file and study it and decide how you want to modify the pieces of the operation. Then you modify the project file and load it, and they're not running what they think they're running.'"
The attackers will produce a cascading failure in the electrical grid that brings down the entire North American power grid. A few additional well timed physical attacks, and we're back to the bronze age for the foreseeable future. Food stocks will quickly run down, as will supplies of petrol. The government will attempt to exert control, but without food and as the situation deteriorates, most of the soldiers will go AWOL to try to get home to help family. Soon, the dying begins. Roving bands of robbers gradually coalesce into gangs ruled by small time warlords, and eventually regional rulers who hoard the remaining food, fuel, and ammo. The few isolated people who planned ahead and who have escaped into their countryside shelters are systematically hunted down, plundered, and given the option to swear fealty to the new regime or be dispatched. Huge fires sweep through most large cities and pollute the atmosphere with soot. Winter soon sets in early due to the reduced sunlight penetrating the atmosphere, and is the harshest one in generations. Eventually, as the winter ends and spring sets in, over 75% of the population is either dead or close to it. Suddenly, armies of foreign soldiers appear at our shores, and before long all of the remaining Americans are conscripted and forced to farm the still fertile fields of America's breadbasket for meager rations, which is still better than starvation and death.
Sure hope not. I mean, does every goddamn thing need to be computerized?
“He’s not deformed, he’s just drunk!”
stop spamming the thread with crying about your smart meters, this is much much bigger than you
What's a bantex ass mart meter? I don't want to click it and find out, because I'm fearful it's probably NSFW....
I am tired of the use of characteristics that don't seem to apply being applied by marketing staff.
Clearly "smart" doesn't apply.
Do not look into laser with remaining eye.
If they come out to change the meter housing you really won't have a choice. You realize this, right?
It's either smart meter or else no service.
Do not look into laser with remaining eye.
The main problem is that only the hackers that have not tried to hack their system, did not hack their systems. And the more terrifying truth is that there is not even one vendor with secure solution out-there. I am just amazed of how they even put the word "secure" in there product!!!!
I love my smart meter. My electric bill is half what it used to be.
Of course, that was after I installed my own software on it, but hey, fuck em they're a power company.
---
ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.
This is a good example of why the gov't is worried about cyber security for critical infrastructure. Just like there are minimum standards for building and fire safety there needs to be minimum standards for IT infrastructure security.
Learning HOW to think is more important than learning WHAT to think.
...investigating a sophisticated hacker attack spanning its operations in the United States, Canada and Spain... and they're not running what they think they're running.
Sounds like they need a modern-day Inigo Montoya to do their security: <SPANISH ACCENT>"You keep using that software, I do not think you're running what you think you are running."</SPANISH ACCENT> And if the worst happens, he can exact revenge: "Hello. My name is Inigo Montoya. You killed my power grid during a level 85 raid. Prepare to die."
I don't understand why it doesn't apply. Are you implying that OASyS SCADA isn't "smart" because Telvent was hacked into? Or that the "smart grid" isn't because it's assets can be misused? Or...?
That's right, keep banging on that war drum. While the leaders are making all the big noise and keeping everyone distracted, the governments and their military are already engaged in full-on, no-holds-barred combat.
We took out 50% of Iran's nuclear capacity with nothing more than a USB stick loaded with Lady Gaga albums and porn.
But at least Iran was smart enough to put an AIR GAP between their critical systems and the rest of the world. We had to rely on a human to use the Sneakernet to infect those centrifuge controllers.
Whoever is behind this, is simply doing Gangnam Style right through the front door.
[End Of Line]
YOU. DO. NOT. CONNECT. VITAL. INFRASTRUCTURE. TO. THE. INTERNET.
fucking idiots.
guess we better learn to live in the dark again, because these fools and the power companies they blather money out of will put us there yet.
if this is supposed to be a new economy, how come they still want my old fashioned money?
I know how this ends. Chunky (tm) soup warms you up and fills you up. and then Weatherbreak.
if this is supposed to be a new economy, how come they still want my old fashioned money?
Don't ask, dont tell....
That's the firewall that keeps the people just passed over for promotion for the third time from running amok in your servers.
Why, without your clothes, you're naked, Miss Dudley!
I mean look at SCADA. The whole field seems to be staffed by idiots.
They think that OPC (OLE for Process Control) is a good idea, they still use that, even though the networking component works via DCOM, and it's all Windows only.
I mean a sane person would go and have sensors spit out text. That text can then be easily processed and archived easily. You can even batch process it, if you want.
You can of course, also pour it into some SQL database if you prefer to, but having your primary data as text means that you can easily change your database engine without having to worry about compatibility.
For OPC you need additional software just to be able to archive it.
A simple (non-XML) format also would have the advantage of being easy to parse. You might, for example have a little single line header, having the number of the meter in it. Then you have each line representing a measurement point. First column could be the time in Unix epochs, then a space, then the measurement values. Such a format can easily be parsed, quicker than it can be read from RAM and without the danger of buffer overruns.
So if something can be hacked it isn't smart? So smart phones should have been called slightly more powerful feature phones. Carrying on with that, you can hack a human with magnetic fields http://www.livescience.com/438-remote-controlled-human-sensation.html so none of mankind could be considered smart either.
Rocket Surgeon.
You're right, but you could firewall off your appliances from communicating with the grid using some kind of line filter and/or or battery bank. You'd lose efficiency but gain security and privacy.
"When information is power, privacy is freedom" - Jah-Wren Ryel
If a thing has existed, it is possible. That's perfectly solid logic unless you can point out any existent but impossible things.