Slashdot Mirror
Washington Post Retracts Story About Russian Hackers Penetrating US Electricity Grid (washingtonpost.com)
Those anonymous U.S. officials who reported Russian hacking code had been found "within the system" of a Vermont power utility must've been surprised to learn the code was on a laptop that wasn't actually connected to the grid. The Washington Post has updated their original story, which now reports that "authorities" say there's no indication that Russian hackers have penetrated the U.S. electric grid.
The Post's newly-edited version now appears below (with their original and now-deleted text preseved inside brackets). A code associated with the Russian hacking operation dubbed Grizzly Steppe by the Obama administration has been detected within the system of a Vermont utility, according to U.S. officials. While the Russians did not actively use the code to disrupt operations of the utility, according to officials who spoke on condition of anonymity in order to discuss a security matter, the discovery underscores the vulnerabilities of the nation's electrical grid... [Was "the penetration of the nation's electrical grid is significant because it represents a potentially serious vulnerability."]
American officials, including one senior administration official, said they are not yet sure what the intentions of the Russians might have been. The incursion [was "penetration"] may have been designed to disrupt the utility's operations or as a test by the Russians to see whether they could penetrate a portion of the grid... According to the report by the FBI and DHS, the hackers involved in the Russian operation used fraudulent emails that tricked their recipients into revealing passwords.
The Vermont utility does report that they'd "detected suspicious Internet traffic" on the laptop, but they believe subsequent news coverage got the story wrong. "It's unfortunate that an official or officials improperly shared inaccurate information with one media outlet, leading to multiple inaccurate reports around the country."
The Post's newly-edited version now appears below (with their original and now-deleted text preseved inside brackets). A code associated with the Russian hacking operation dubbed Grizzly Steppe by the Obama administration has been detected within the system of a Vermont utility, according to U.S. officials. While the Russians did not actively use the code to disrupt operations of the utility, according to officials who spoke on condition of anonymity in order to discuss a security matter, the discovery underscores the vulnerabilities of the nation's electrical grid... [Was "the penetration of the nation's electrical grid is significant because it represents a potentially serious vulnerability."]
American officials, including one senior administration official, said they are not yet sure what the intentions of the Russians might have been. The incursion [was "penetration"] may have been designed to disrupt the utility's operations or as a test by the Russians to see whether they could penetrate a portion of the grid... According to the report by the FBI and DHS, the hackers involved in the Russian operation used fraudulent emails that tricked their recipients into revealing passwords.
The Vermont utility does report that they'd "detected suspicious Internet traffic" on the laptop, but they believe subsequent news coverage got the story wrong. "It's unfortunate that an official or officials improperly shared inaccurate information with one media outlet, leading to multiple inaccurate reports around the country."
One laptop not on the network had malware.
Fuck the washington post.
http://boingboing.net/2016/12/31/no-russia-didnt-hack-vermon.html
Journalists wonder why people don't trust them, and this story is a good example. Turns out the crap was found on one laptop in the company's possession, which was not connected to their power grid.
(And when will companies/CIOs stop buying computers that contain so many exploitable vulnerabilities? I guess the answer is "Not until there's financial and legal consequence for their failure.")
According to an earlier post the laptop that was allegedly infected was not connected to the electric company's grid control system. That conclusion answered my first question. Any vital utility system should absolutely never have it's control system of computers connected to the Internet. If somehow that's the case, those responsible need a very long prison sentence. There also needs to be other security measures to prevent folks having direct access to these control systems from sabotaging them.
In a time of universal deceit, telling the truth is a revolutionary act. George Orwell
Why is infrastructure on the public Internet ? It is not like the internet existed when most of the US electric grid was 'designed' and built. It worked quite well for 70 or so years without the internet. And I will say I have experienced more blackouts over the past 10 years than I did in total before 1990.
Infrastructure does not have to be on the internet to be hacked. The Iranians air-gapped the computers controlling their nuclear centrifuges and Stuxnet still managed to infect and damage them. The interesting thing is that Russian hackers have actually taken down an electricity grid, that of the Ukraine. The Ukrainians brought it back online relatively quickly by manual operation even though their computer control systems remained a mess. The irony of that incident was that the relatively primitive nature of the Ukrainian grid actually worked for the Ukrainians. It is doubtful that the higher tech grids in the west could be brought up that quickly after a major attack. Just because this incident turned out to be an attack of hysteria, I think we can learn from the Ukrainian experience that it pays to be vigilant and just because the US now has a Russophile president who is a paid up member of the Putin fan club does not mean that the Russians will stop probing for weaknesses in US infrastructure systems.
The headline is complete bullshit. Can the author not even read? The grid was not penetrated, hacked, or comprimised. No report says it was. This is totally a fabrication from the reporters.
"We detected the malware in a single Burlington Electric Department laptop not connected to our organization’s grid systems."
Worked in the industry for a decade. Wrote simulation shells that did short term forecasts based on on system conditions, did data reductions etc (e.g. This unit IS going down for unscheduled maintenance, how much will it cost to shut it down RTF now vs after afternoon peak?) Went on to 'tech lead' for significant energy trading/risk management platform. Ran on many traders and grid operators desks...don't ask, won't tell. Did once see a bug because grand total on printable VAR only had room for 10 digits plus sign. Assigned to Brahmin coder, week later I fixed it myself, I digress.
What you say isn't really possible. What they typically do have is a secure network, which runs operations, staffed with lots of ex-military actual Engineering school grads. That network is being monitored by redundant data integrators which present integrated (by some time interval, usually hours/half hours or minutes, back when I was up to my nose in it) system data to a second less secure (but still as secure as any corporate) network where routine operations run. That server is usually locked down tight, read only from the less secure network; but that is only software. They also like to run diverse OSs, lots of 'big iron' and Unixes and home brewed binary data formats. These things were mostly architected before Windows was common, particularly on the secure side it's still loaded with 'legacy', likely to remain so until they have a complete staff turnover. Old Dilbert with neckbeard flipping a nickle at Wally and telling him to get a better computer, that's the dude.
Routine operations need access to internet based facilities. To schedule transmission line capacity, trade power, get closing prices from grid operators, weather forecasts and unit availability from neighbors (lots of VPNs). But that part of the operations could more or less crash and burn and it will only cost money (and extra CO2). Operations, more or less, ignores trading at the minute by minute level. Trading gives them trade schedules and operations will try their best. But if 'shit happens' they keep the lights on and let the accountants worry about reconciling to 'what should have happened'. Which is sometimes a bitch of a computational problem, fortunately most everybody involved are engineers and close enough is close enough. Pennies aren't statistically significant; try and explain that to an accountant. Don't recommend it, just say 'not a material difference' and get on with your life, I'm digressing again.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
the USA has invaded a country that didn't attack it and was no threat to it
What, Afghanistan? That country was taken over by the Taliban, which in turn fed, sheltered, and harbored an organization that deliberately set out to kill thousands of Americans and did. The entity running Afghanistan then refused to turn the leaders of that terrorist organization over for prosecution - even as that group promised ever more killings across the world. You're complaining that multiple countries, including the US, after extensive diplomatic attempts through the Taliban's so-called government, only to see that Taliban was not only sheltering AQ, but approved of their mission and gave them material support ... that we sent in forces to end that threat? Your definition of "didn't attack" and "no threat" would sound pretty juvenile and absurd to someone whose family member was killed in those attacks you think didn't happen.
I am curious - what do you think will happen when you lie like that? Are you like those holocaust denier who actually think someone will believe them when they say it never happened? Do you understand how childish you sound when you stamp your feet and pretend that AQ and the Taliban didn't kill thousands of people? So that you understand: everyone knows they did. YOU know they did. So when you lie about it, it really does make people wonder what's wrong with you, that you think someone will believe you. Perhaps you should talk to a doctor or other counselor so you can get some help with this compulsion of yours.
Don't disappoint your bird dog. Go to the range.
Anyone who doubts Trump's long-standing connections w sketchy Russia\FSU types should read this: http://www.the-american-intere...
"Treat the United States nicely or we'll bring democracy to your country"
Watching the video "Why We Fight" explains a lot of this.
Eisenhower warned us about the Military Industrial Complex.
Now both parties are dependent upon war for a successful economy.
Notice we're still in Afghanistan.
Why?
Oh, you mean Iraq, which we and a large group of other countries invaded as part of pushing Saddam Hussein back out of his attempt to annex Kuwait? That Iraq? Or are you referring to Iraq, a few years after Saddam's invasion of a neighboring country, when he'd utterly failed to adhere to a single promise he made in order preserve his rule as his forces retreated from that invasion? Are you thinking of the invasion that happened when Saddam did everything he could to block weapons inspectors? They guy who was so busy slaughtering entire villages with WMDs that we had to enforce no fly zones ... and his forces never stopped shooting at the aircraft enforcing those zones? Are you thinking of the Iraq that was stealing UN funds meant to feed his people, and using that stolen international fund to continue to re-build his military, buy more of the long range missiles he promised he'd never have again, funnel cash to terrorists, and otherwise enrich himself and his cronies?
Doesn't matter which of the hundreds of violations he committed non-stop from the minute his forces were pushed out of Kuwait. The one that matters was his continual targeting of US aircraft. Non-stop. Never stopped.
I know, I know - you think it would have been better to let him continue to use his WMDs to slaughter thousands of ethnic and religious minorities and to lob SCUDs over his border into Israel, etc. No need to worry about stuff like that. It's just a little squabble in the Middle East, right?
Don't disappoint your bird dog. Go to the range.
Sorry, Israel is a land thief, just like Russia. Their mommies should spank them both. All the excuses for the settlements are just plain dumb. Givvitup.
Table-ized A.I.
yeah that was a bad troll. i mean. we werent playing a game where popular vote matters, thats like saying the winning world series team lost too, because the losing team actually had more runs (or hits, or fans in the stands or any other irrelevant point that has nothing to do with the actual rules)
have you seen my sig? there are many others like it but none that are the same