Slashdot Mirror
Nuclear Regulator Hacked 3 Times In 3 Years
mdsolar (1045926) writes with this disconcerting story from CNet about security breaches at the U.S. Nuclear Regulatory Commission, revealed in a new report to have been compromised three times in the last three years: The body that governs America's nuclear power providers said in an internal investigation that two of the hacks are suspected to have come from unnamed foreign countries, the news site Nextgov reported based on a Freedom of Information Act request. The source of the third hack could not be identified because the logs of the incident had been destroyed, the report said. Hackers, often sponsored by foreign governments, have targeted the US more frequently in recent years. A report (PDF) on attacks against government computers noted that there was a 35 percent increase between 2010 and 2013.
Intruders used common hacking techniques to get at the NRC's computers. One attack linked to a foreign country or individual involved phishing emails that coerced NRC employees into submitting their login credentials. The second one linked to a foreign government or individual used spearphishing, or emails targeted at specific NRC employees, to convince them to click a link that led to a malware site hosted on Microsoft's cloud storage site SkyDrive, now called OneDrive. The third attack involved breaking into the personal account of a NRC employee. After sending a malicious PDF attachment to 16 other NRC employees, one person was infected with malware.
Intruders used common hacking techniques to get at the NRC's computers. One attack linked to a foreign country or individual involved phishing emails that coerced NRC employees into submitting their login credentials. The second one linked to a foreign government or individual used spearphishing, or emails targeted at specific NRC employees, to convince them to click a link that led to a malware site hosted on Microsoft's cloud storage site SkyDrive, now called OneDrive. The third attack involved breaking into the personal account of a NRC employee. After sending a malicious PDF attachment to 16 other NRC employees, one person was infected with malware.
So, three times in three years, hackers get by the first line of defense (humans) and access some servers. They are identified and stopped each time. Not too bad considering the number of nutjobs out there that target them. It might actually be considered impressive. The NRC hires a lot of contractors, so the human element will always be a challenge, just like any other organization of that nature.
The funny thing is, most NRC information is publicly available through their on-line document library. There is a very small amount of redacted intellectual property from various vendors that one might get a hold of, but any of those items are not really much different than the public information or useful to competitors. Doubts are any of these hackers would be able to do anything with it, as competitors generally already know what each other really are doing.
Safeguards & security information could theoretically be of value to a terrorist, but is not kept on any of these common servers. It is kept in isolated, stand-alone file rooms with isolated individual computers & file cabinets and controlled access.
I don't see really why this is any kind of news.
"The few attempts documented in the OIG (Office of the Inspector General) cyber crimes unit report as gaining some access to NRC networks were detected and appropriate measures were taken," he said.
"to convince them to click a link that led to a malware site hosted on Microsoft's cloud storage site SkyDrive, now called OneDrive"
Why on earth would the NRC (or any company or government entity, for that matter) not block access to all cloud storage providers, except those which are explicitly authorized?
Hapless government employees fall susceptible to phishing, but OMG NUCLEAR REGULATORS!!!111!!!1eleventyone!!1!
Why do I have a feeling that if this happened to any other Federal department, we'd never hear about it?
Nuclear Information Security Inspector could be heard in the background saying "Doh!"
Mod me down, my New Earth Global Warmingist friends!
Rise of the dead that is. Not seen a cnet reference in a long, long, long time.
"phishing emails that coerced NRC employees" . . . Email doesn't FORCE a person to do something, or COMPEL obedience. Convince, mislead, trick, confuse someone into doing something, sure. My point is, don't blame the emails - assume that something labeled "nuclear" is a tempting target - blame people ignorant enough (or blame training so insufficient) as to fall for such a ruse, and security lax enough to let the action occur.
I thought I'd provide some anecdotal evidence for the sake of argument. I've worked at 3 major telephone companies/ISPs over the years and have been involved in installing phone and data lines at multiple power companies across the country including 1 reactor. In every case the power company had a standing police that basically boiled down to "No data enters the facility" It used to be a rule that "no copper entered the facility" but that changed with the advent of fiberoptics. I don't know if this is a law, or just a common security practice, but in the dozens of facilities I've worked with they were all air-gaped. Again, this is anecdotal, I don't know if this is done everywhere, but I certainly found it reassuring when I saw it.
On the other hand, I did work with a local municipality once that opened and closed the local damn with a single copper pair running between the control house and the damn. When the damn overflowed and flooded that copper pair rendering it inoperable, they were furious with us because we wouldn't "fix it" I had to explain to a local community leader that our field techs are not trained to use scubba gear and had we known the safety of the entire community was riding on a single $12/month copper pair we'd have likely suggested an alternative solution.
Your ignorance in glaring. In reality, there has been very little change in the way the NRC handles safeguards information since before 9/11. It was of course evaluated like everything, and undergoes occasional refinement, but the basic approach has been adequate and remains the same. If anything, other departments of government took note of how the NRC handles safeguards info.
I suppose, you could explain exactly what changes you think took place in their handling of this information since 9-11? I'm sure you can coherently explain it on your own, without the need to simply sling links, correct?
So why are they unnamed? Makes me think it was China...
It's much easier to blame the victim than provide a technical solution?
Anyone heard of, "AI?"
How hard is it to emulate a user and take the phishing/spear phishing bait to conclusion inside a sandbox; make a call to the, "Not by the hair on my chinny chin chin," routine when the predicted results are deemed harmful?
I have to think of everything.
It little behooves the best of us to comment on the rest of us.
Thank you.
There's virtually nothing to be gained by illegitimately obtaining information from the NRC -- almost everything they produce is in the public domain. This is just FUD designed to scare anyone easily excited by the combination of the words "hacked" and "nuclear" in the same article.
Most American Blackhats use foreign country's connections to infiltrate American systems.
This is why every single fucking time they appear to come from "unnamed foreign countries" . Because wouldn't you want to appear like you are coming from China when in actuality you are sitting at a desk in new york city when owning these poor bastards?
I bet they paid a lot of money to "security professionals" to fix this though. lolololololol
Still hearing those Americans shouting USA, USA, USA...
Yeah, you're so not the backwards soviet union of the world this time around...
"...except for meetings on security subjects that include sensitive information..." TRUST US! Sleeping guards, sweep it under the rug.... http://www.nrc.gov/security/fa...
Yup, just as I figured. No point, a link to go with it.
As I say, you are a denier. You even deny what comes straight from the horse's mouth, which is what makes your posts what comes from the other end of the horse,
The public was never allowed to attend portions of meetings where safeguards info was presented. That has not changed. The fact that something so obvious eluded you gives me a better understanding of your behavior. You are as predictable as the nightly shutdown of solar power.
Corrected Title ..
Who is the genius that wired up the nuclear power plant to the internet!!
As a recent example, people around the Limerick plant don't know how serious a big security problem is because of post 9-11 secrecy. http://www.mainlinemedianews.c... Obviously you don't know what you are talking about.
You said there were changes due to 9-11, but you haven't identified any. And, of course they don't release to the public details of safeguards information, be that issues found at site, designs, or other. They never have, and never will, for obvious reasons. There has been no change in this as you claimed. In your haste to google stuff to make a point, because you don't have the insight yourself, you repetitively fail to stop and think. Why would you want think they would ever release safeguards information to the public?
As usual you deny the plain facts.
I see you cannot answer the question.