Slashdot Mirror
Utilities Racing To Secure Electric Grid
FreeMichael61 writes "In the latest episode of Spy vs. Spy, China rejects accusations it's hacking U.S. companies to steal IP or bring down the grid. But there's no doubt the grid can be hacked, CIO Journal's Steve Rosenbush and Rachael King report. Industrial control networks are supposed to be protected from the Internet by an air gap that, it turns out, is largely theoretical. Internal security is often lax, laptops and other devices are frequently moved between corporate networks and control networks, and some SCADA systems are still directly connected to the internet. What security standards actually exist are out of date and don't cover enough, and corporations often use questionable supply chains because they are cheaper."
Theoretical Air Gap!
When information is power, privacy is freedom.
... why are mission critical devices connected to the internet
sure we know that the weakest link is the meatware, not the hardware, but still...
Looking for people to chat about multicopters, coding, music. skype: gtsiros
We get it. We're all in imminent danger. Fuck off already. These shitty fear mongering articles don't even contain any interesting technical information.
Anyone with a web-server will tell you that they are seeing dozens of penetration attempts daily, even right now. I also see this on my home ADSL line. I'm not saying the government there is doing it, but I do know that there is no other country which is attacking everything everywhere this aggressively. I don't have any web pages in Chinese and I wonder if I would be better off just using one of those iptables -j DROP lists who list all IPs in China.
9/11: Never forget it was a false-flag operation
China benefits from a functional United States. So long as the benefits outweigh any prize that would remove them in the taking, Americans are fairly safe from Chinese attack.
Amercians are so paranoid about socialism and communism. As an outsider looking it it's like a neurosis for your country.
America is the Hegemony of the world, you are the belligerent sabre rattlers, not China. You have released viruses that have taken down other countries power generation systems already.
Stay inside your own fucking country for once.
Do you think that the energy industry is any easier on IT folks than anybody else?
Big dollar consultants instead of trained employees, given full unescorted access because the manager doesn't want to have to sit in the datacenter and escort them to the restrooms and such.
My SCADA datacenter still allows a cleaning crew in unescorted.
And electricians, and HVAC contractors and so on.
I found out they were PAINTING my datacenter the day that my storage started freaking out with heat alarms. Went running downstairs to find the facilities team had left a painting crew in the datacenter to cover all of my cabinets (and vented tiles) with tarps.
So these devices might not start connected to the internet, but a USB key here, a rogue cellular wi-fi bridge there, and some wild stuff can happen.
I've heard of other shops that had their SCADA people upset that they couldn't work from home, so they set up "secret" networks that only they knew about so they could still get in. Secret to their co-workers/management, but easy to find for the people who do that for a living.
Going anon for good reason.
Repeat after me.
The only succesfull attack on the US power grid was perpetrated by Enron, and it was to make money. They shut down entire sections of the grid to make a profit. There were rolling blackouts not because of 'hackers' but because of Enron. And almost nobody went to jail for it, and alot of the same guys wound up in the subprime mortgage business after Enron went belly up. And most of them never saw any consequences either. They just got richer.
Wake up people. We are doing more damage to ourselves than China could ever dream of. They are simply waiting for us to finally implode (with 14 trillion dollars of debt, it wont take long)
The problem comes from the previous generation of smart meter addressing which included broadcast groups and whose keys were managed by the utilities via HSMs. The tech is solid, but when you are dealing with utilities whom have very little real sophistication on the IT side dealing with crypto technologies they don't understand, bad things can and will happen.
Get access to the HSM at the provider, or the smart cards they've backed up keys onto, and you can forge a packet that will trigger a significant number of meters. All that could go away if we simply required truck rolls for turn-offs, but that is the most marketable aspect that drives adoption (that and turning on 8 confusing pricing tiers which they help shift the "blame" for a high bill from the utility charging more to the user who "chose to run that A/C during the hottest time of the day".
Grr.
...over this bullshit? How many times do we have to hammer into managers and security teams alike that this shit is serious? When do we just start replacing ineptitude with people who give a shit?
One of my clients is a large electric utility. Their security, both physical and for IT systems, is top notch. None of their SCADA systems are online, they do routine and regular audits of all security, and even 'trusted' people like myself have to jump through hoops to get into the Data Center, and are always escorted.
They have really cool doors to get in too. They are like decontamination booths. You step into a vertical tube and wait to be cleared then the tube rotates and opens the other side.
On the other hand, I've done work for other utilities where yes, the cleaning crew goes in through what amounts to an open door, without an escort.
not just work from home but more remote plants switching / sub stations. Also the control centers need to be able to control all of that or do want to have some at each mid size to big substation 24/7 tied to a phone and control bank? As well a ready to go on call linemen who will drive out to the smaller ones to filp the switches?
power lines have reclosers some kind of wireless links on them.
bailout - its the New Capitalism.
...to secure a large scale carbon-free energy supply. Sadly, few seem interested, or even cognizant of the fact that a secure and abundant energy supply is critical for our prosperity and collective well-being.
Even if we do lose the race, hopefully the Chinese will be willing to sell us thorium molten salt reactors, so that we can maintain some level of society. (and no, renewables and conventional nuclear will never be large scale; far too expensive, and incapable of rapid scaling.)
Call me when the USA stops digging around in everyone's financial records.
Have gnu, will travel.
Mr. President, we must not allow... an Internet air gap!
And I'll give you two guesses where the original coding work was outsourced to...
Finally a solution.
Firewalls are pretty vulnerable. In order to really defend a network, you can never make a mistake. And everybody makes a mistake from time to time And once they are in, they are hard to get out.
Much focus needs to be made on things like well made interfaces and quality documentation that has no ambiguities or errors. Many times mistakes are made because something just wasn't clear enough, and it was interpreted to be something other than what it really is. Security itself is hard in part because of so many parameters and settings. For example some value being entered might be unclear whether it is the name of something, or is being used to search for something, or is being used as a match expression. Some effort also needs to be made in security systems to reduce the configuration complexity. The more complex something is to configure, the more that creates the opportunity for a mistake.
now we need to go OSS in diesel cars
Then where are we going to get cheap stuff?
now we need to go OSS in diesel cars
Change those systems from IP to ARCNET (or AppleTalk, or IPX, or ???).
"National Security is the chief cause of national insecurity." - Celine's First Law
I picture some arrogant fool at a race, who spends several minutes fast walking backwards around the track. When the race is almost won, then he starts running in the right direction.
With luck, the utilities will be back at the starting line before the competition crosses the finish line.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
By definition a SCADA Master system is connected to any number of remote units spread all over geography. The physical links that make up this network are also extremely vulnerable as encrypted SCADA protocols are as yet fairly rare. For a cash strapped utility with a limited number of technicians, being able to remotely connect to equipment in difficult to reach places becomes very attractive.
are already compromised? Set up new security using compromised systems; it's the long con.
Only connect one data link and ground, and it will be secure. Run a balanced pair if you are feeling fancy. If the receiver can keep up, you don't even need flow control lines. Problem solved.
Could I fairly categorize all Americans as bone-headed uneducated sloths with 150 TV channels who love their cousins and enjoy a good roadkill stew? .. all because some Americans are like that?
No, but that fits my family fairly well.
Posted anonymous, one or two of them might know how to read and actually wander onto Slashdot. Imagine that.
Only connect one data link and ground, and it will be secure. Run a balanced pair if you are feeling fancy. If the receiver can keep up, you don't even need flow control lines. Problem solved.
You could just set a led that blinks when there is something wrong and have a 2 dollar webcam monitor it. If someone manages to force data through a led that isn't configured for such activity, they have won the internet and deserve access.
Restore the madness of youth's lechery
Because mission critical devices may not be manned. This is a rising trend in remote asset management. It's used extensively in upstream processing and pipelining that is slowly working it's way to downstream.
Heck one large gas ... manufacturer (though it's hard to call air separation "manufacturing") in our country runs all plants remotely. Sure there are staff there, but no one in the control room, no one in front of the computers. The onsite staff are used to bring the plant online and handle emergency cases but as soon as a steady state is achieved the controls are handed over to a dedicated team in another country, who run these almost identical plants all over the world.
Airgap in this case is cutting off control.
A 3rd world grid, where the cables are hanging from wooden poles don't need Chinese hackers.
A drunk missing the curb, squirrels, ice rain, snow, a storm, dry-rot or termites do the job quite well.
Uhm. Yeah. You might want to get back on those meds.
At some point, someone needs to interact with the system, and the system needs to interact with the devices it controls. So, in theory, these systems cannot be completely isolated.
Also, consider that if these systems were isolated with a pure vacuum, it may make the universe fly apart!
http://science.slashdot.org/story/13/02/19/2151238/does-the-higgs-boson-reveal-our-universes-doomsday
It will just end in tears.
Don't put the systems that control the power grid on the internet! Or if you do, make them read-only. If they have to be networked, ever heard of a VLAN? Hell no they haven't because they hire outsourced 3rd party contractors to write this stuff and they don't have to officially deal with it after the check clears. They don't necessarily have to sit there and manage it and deal with the software and control systems on a daily basis. And they certainly aren't the best or brightest programmers, they're just the fastest and laziest. If they were, they'd be working at a better job than a contractor or public company. All we need are people who have the first clue about security to design the control systems for the power grid and we're set.
That's what I said, an optoelectronic relay.
---
ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.
Well, before now it wasnt affordable. All the money is in politics. =x
I also wonder about the quality of engineer they hire when they design these systems. Why arent they behind firewalls with ACLs that only allow a what NEEDS to communicate with it. Why arent there secondary boxes, so they can be patched as 0days come out? Why are they running software that has been reported to be riddled with vulnerabilities?
if you find yourself patching THAT often... its time to find new software written by security minded people.