Slashdot Mirror
Communications Protocol Leaves Power Grid Vulnerable
mspohr writes "The NY Times has an interesting story about a pair of researchers who 'discovered that they could freeze, or crash, the software that monitors a [power] substation, thereby blinding control center operators from the power grid.' These two engineers wrote software to test for vulnerabilities in the control systems of electrical power grids which use a protocol called DNP3 to communicate with sub-stations. They first tested an open source implementation of the protocol and didn't find any problems. They were worried that their software test wasn't adequate so they started testing proprietary systems. The broke every single one of the 16 proprietary systems they tested initially and found nine more systems vulnerable in later testing. They were able to install malware and also found firewalls ineffective. The pair reported this to the Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team, I.C.S.-C.E.R.T. and didn't get much of a response. It's scary that our electrical grid is so vulnerable and there doesn't seem to be much urgency to get it fixed. A few patches have been issued, but who knows if the systems have been updated?"
What are the odds that our best friends already have botnets ready to take our grid down on command?
Excuse me while I got get a few solar panels.
It is not like this is a new issue. Fire all IT managers who were responsible for not doing penetration testing, including the ones at Homeland Security.
If you do NOT hold managers responsible then they are just lifers waiting for their pension!!
I worked for a fellow who'd previously done some work on power grids. He was aware of these problems in 2005 or earlier. I'm pretty sure these problems were also published in the 9/11 comission's report. But I don't think patching holes in power grid controls provides enough theater to keep people scared, so it hasn't been done.
Their first mistake was assuming that the Department of Homeland Security actually cares about homeland security. Department of Homeland Control would be a better, more accurate name.
It's scary that our electrical grid is so vulnerable and there doesn't seem to be much urgency to get it fixed.
Sure - scary to you, scary to me, scary to the old lady down the road.
You know who it's not scary to? The NSA, CIA, and all other clandestine TLAs that profit from allowing harm to come to American citizens.
Remember: the CIA had solid intel about the 9/11/2001 terrorists, but did nothing to stop them; same goes for the Boston Bombers. The more Americans that they can allow to be injured by "terrorists," the fatter their budgets grow.
Stopping terrorist attacks is the last thing anyone in the federal government wants to have happen. THAT is fucking scary.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
Except that open source... oh, I see what you did there....
some karma... and kinda lukewarm about it.
If history is any guide, the managers of these systems are trying to find ways to prosecute the researchers for their actions. It's fairly standard to classify security testing methods as attacks (since that's in effect what they are), and publishing the problems is generally considered telling the "terrorists" how to attack the systems.
But this is about what should be expected for systems that depend on "security by obscurity". And the managers of such systems rarely reward someone who demonstrates how they've failed.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
No. That would require the investment of money better spent on executive bonuses and shareholder dividends.
upon the advice of my lawyer, i have no sig at this time
If you want to go after someone, it probably should be the vendor that sold the crappy implementation.
I'm not a fan of more government, but since the power grid really goes beyond the company owning it, you should have regulations requiring the testing and remediation of any technical/physical security issues. That takes care of your hypothetical lazy IT Manager, the boss who blocks the good manager because it's expensive and not required, and the company who wants to keep selling equipment.
Don't electric utilities maintain private communications networks for their critical infrastructure?
They do, but nowadays many SCADA systems have internet connectivity for service and support. All it takes is one unsecured internet connection left open by bad system design or a forgetful technician to let the wolves in.
I am becoming gerund, destroyer of verbs.
http://ics-cert.us-cert.gov/advisories/ICSA-13-291-01
Wait, there was no response to a report about a vulnerability in our energy structure? Gee, I wonder why.. Perhaps they should try submitting the report when the office that will ultimately respond is.. I don't know.. open maybe?
It is not like this is a new issue. Fire all IT managers who were responsible for not doing penetration testing, including the ones at Homeland Security.
If you do NOT hold managers responsible then they are just lifers waiting for their pension!!
Before you loop that noose over the tree branch, perhaps you should check if this report actually reflects the real world.
TFA simply says the tested software from vendors, not real world installations. This software is in actual use, but that doesn't necessarily mean its running naked on the internet. Most often this is run on private circuits, as most of these installations predate the availability of internet. Even when on the internet, most of these installations use VPN between plants and control centers.
Even those foolish enough to put SCADA directly on the net have already been notified by their trade associations (if not the DHS) to start using off the shelf VPN routers immediately, and that happened months ago.
Contrary to the rantings of Slashdot Experts, these places aren't run by total idiots. Nor do they have the luxury of replacing every SCADA controller in their plants. But they do know enough to use common off the shelf technology to provide reasonable level of security, and probably accomplished this a long time ago simply to make management of their network easier.
Sure, you can scan the net and find some SCADA controllers small water pumps in East Podunk Oklahoma. But they don't control big city plants.
Sig Battery depleted. Reverting to safe mode.
Most big ones do, because they have been in business for far longer than the internet was up and running.
Those who don't use VPN routers so that they can have all their plants on the same IP subnet.
So the story is designed to enrage slash dot nerds, but it never actually says they penetrated systems in the
wild, simply that the software was vulnerable.
Sig Battery depleted. Reverting to safe mode.
They were supposed to, but they've been busy selling off those massive fiber networks for a good long while now. (after first trying to be ISPs, and failing rather comically.)
Is the problem with the protocol or the implementation of that protocol?
Mr. Crain ran his security test on his open-source DNP3 program and didn't find anything wrong. Frustrated, he tested a third-party vendor’s program to make sure his software was working. The first program he targeted belonged to Triangle MicroWorks, a Raleigh, North Carolina based company that sells source code to large vendors of S.C.A.D.A. systems. It broke instantly.
If the vulnerability is not in an open source implementation but is in third party vendor implementation then it looks like an implementation problem not a protocol problem.
Bahaha...the power goes out in the DC area all the freaking time. Pepco is notorious for power outages in DC. They blame the "dense tree canopy of the city" or something retarded. Ask anyone who's lived there for a while.
The DC metro area has suffered major outages, the remnants of Hurricane Isabel knock out most of the power and water in Fairfax County, Virginia as well.
Anything important in the DC metro area and well everywhere else, is going to have both battery and generator backup power, knowing that grid power can and does fail all the time.
Too important my ass...the power reliability in DC was like living in a third world country.
Well, as for private networks...
Do you remember a few years back when a nuclear plant that was only on a private network was taken over by a virus. (Nothing major happened that time.) This was because in a different building on the network a contractor plugged in his laptop to the private network. I believe that this was by accident. I think he was trying to go on the web. But his laptop had an active infection.
What with wifi becomming increasingly common, I don't think private networks count as security unless they are QUITE strictly controlled.
I think we've pushed this "anyone can grow up to be president" thing too far.
I think you're trying (and failing) to make a pun. "Open Sores" = vulnerable proprietary systems. Lame.
DNP3 functionality will soon (5-10 years) be embedded in grid-tie solar inverters in Canada so the local power company can control them at will on a per-second basis (I'm working with a local college developing this technology right now). Pretty easy access to the communications channel if you ask me. And no, no one seems interested in security.
Sure, you can scan the net and find some SCADA controllers small water pumps in East Podunk Oklahoma. But they don't control big city plants.
Well here I am in West Podunk Oklahoma and our water pump is controlled by an Emitrol Sytstems relay board connected to an IMSAI 8080 with RS-232 to our PDP-8. I talk to the pump and post to Slashdot with an LA36 DECWriter. It does lower case but it sure looks funny.
Don't go touching my pump now.
This is my pump.
There are many like it, but this one is mine.
<blink>down the rabbit hole</blink>
Or one unsecured PC server (most likely running Linux) that can communicate to the devices and then it is irrelevant what protocol is being used on the end point devices. The same is true for SCADA systems, or any other system where you don't want to flip switches or read dials manually, or drive out to the remote sites to be flipping the switches.
Embedded systems (only) get replaced when they break.
Write protect the appliances. It is impossible to remotely modify the code then installing malware should be very difficult. The next trick would be making it impossible to pass executable code to the system's ram.
Even if you couldn't accomplish the second part... the first part is easy and it would mean recovering from any breach with a reboot.
There are ways to secure these systems. But ultimately they're going to have to have limited access from remote users. Security updates and modifications to the software should be done locally. That means a hacker needs to gain physical access to the appliance to compromise it. Then you can keep most attacks out with a good lock.
Some will say this defeats the purpose of these systems. That teh whole thing was supposed to be remotely administered from some central computer command center. How much is that dream worth? Is it really worth all this trouble to not send a technician by every so often to make changes?
Hard code and write lock the appliances. Then sleep like a baby.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
"The NY Times has an interesting story about a pair of researchers who 'discovered that they could freeze, or crash, the software that monitors a [power] substation, thereby blinding control center operators from the power grid.' .. It's scary that our electrical grid is so vulnerable and there doesn't seem to be much urgency to get it fixed"
Then don't connect your electrical grid directly to the Internet !!
You must be Captain Obvious! It's a pleasure to meet you, sir!
Ezekiel 23:20
And they don't get replaced when it comes to light they've been broken all along? Sounds almost like the "broken windows" thingy.
Ezekiel 23:20
Whoever is giving access to vital national resources on the Internet should be arrested and shot.
Fata viam invenient.
This problem is often brought about by a LACK of IT involvement. In many operational systems the control system is maintained by a small group with more knowledge of the plant and the vendor package than IT infrastructure. You may be targeting the wrong people.
In any case you're still right. DNP3 is about the most secure of the telemetry protocols, and actually has some basic form of encryption. An attacker shouldn't even be able to get as far as to see or communicate with it.
The researches have shown that the system can be compromised from within the network. This should come as no surprise. In many regards DNP3 is far better than any alternative, many of which do not even offer basic authentication let alone encryption. The critical part is the researchers were effectively sitting at the keyboard of their targeted machine. They shouldn't be able to get remotely that far. They should be separated by isolated networks, firewalls, etc.
I bet 99.99% of this is the SCADA systems. Those are huge open sores in the power distribution network because of the SCADA vulnerabilities. And the geniuses at the power companies thought it was a-ok to hook SCADA into an ethernet network.
If you want to be entertained go read the NERC documents.