Slashdot Mirror
GE Fixing Bug in Software After Warning About Power Grid Hacks (reuters.com)
General Electric said on Wednesday it is fixing a bug in software used to control the flow of electricity in a utility's power systems after researchers found that hackers could shut down parts of an electric grid. From a report: The vulnerability could enable attackers to gain remote control of GE protection relays, enabling them to "disconnect sectors of the power grid at will," according to an abstract posted late last week on the Black Hat security conference website. Protection relays are circuit breakers that utilities program to open and halt power transmission when dangerous conditions surface.
It doesn't sound like a good idea. Air gaps on important infrastructure, people.
If air gaps are not possible, then at least change which port Telnet is running on.
I'll see your senator, and I'll raise you two judges.
Modern app appers like GE know that only apps can app apps, and having the Apper Grid connected to the Appernet of Apps makes everything super appy!
Apps!
That simply isn't ideal anymore. When a critical situation happens, say an earthquake, how long does it take to deploy a person to a breaker unit to manually change its state? They NEED to be networked in today's age to have the level of agility needed to handle a situation.
first
how can a first post be marked "redundant"?
Microwave range two miles? Shortwave? Electrical lines carry signals too.
the ones on lines need some kind of remote so they can send messages and get turn on commands. They also have local control so there can be a lock out / tag out.
https://en.wikipedia.org/wiki/...
https://www.youtube.com/watch?...
https://www.youtube.com/watch?...
If your asset is attached to the network, literally billions of people could potentially attack it, from anywhere on the world. Not only that, but they can unleash automated attacks upon your asset from other Internet targets they've previously compromised.
If your asset is on its own network, or is non-networked, that cuts down on the number of possible attackers tremendously.
So, critical infrastructure should NOT be on the Internet, or at least not without a correspondingly LARGE investment in security commensurate to the risk.
--PeterM
it's been done, like, a million times already.
Sleep your way to a whiter smile...date a dentist!
that will definitely slow down the hackers. all of a whole 10 seconds or so.
Sleep your way to a whiter smile...date a dentist!
If a hacker shuts down the power, won't he no longer be able to hack 8 -)
What kind of place slashdot have become?
Air gaps on important infrastructure, people
Airgaps only make a grid unmanagable which would lead to more poweroutages. The answer isn't airgapping, it's actually knowing security.
If your idea of security is to simply airgap then you're going to fall victim by many other attack vectors.
Yes. But you also have to share data with other utilities in real time for regulatory and marketing purposes. It's more complex than you'd think.
I don't believe in karma, I just call it like I see it.
Would these 'GE protection relays' be connected to the Internet using SCADA units running under Microsoft Windows?
Cyber Security Issues for Protective Relays: 2008
The Northeast blackout of 2003
> If air gaps are not possible, then at least change which port Telnet is running on.
:)
Are you an expert
Did anyone else notice a bunch of blackouts last week? I heard a few folks around the states mention it, but the press was REAL quiet? Maybe slashdotters can confirm? This is a good place to look for trends! so.. maybe this thread is old news?
Time for a new Political party in the US (or two!) One is off the rails Other cant pony up a leader.
Relays control circuit breakers
Not on the same network the breaker controls are on.
When you are dealing with something as important as a power grid, I'd feel safer if you put as much human oversight as you can into it. Hacking never ends, Make sure the human oversight staff is to be educated into not being tricked.
I'm sure the squirrels would notice the difference.
You could but them on a separate network, disconnected from the main Internet, or even not using TCP/IP. One could use PSTN and a modem, or use the cellphone network to send SMS or even use a separate radio UHF network. By the way because they have also laid cables and fiber optics having a separate WAN could be feasible.
Just pondering - if they've strung up a set of powerlines, would it be all that impossible to also put up some control-wires, and have that system air-gapped from internet/telecoms/whatever ?
Nothing electrical based can be used on utility poles. Maybe fiber optic cables but there's probably special considerations for stringing a fibre optic cable on a utility pole that I'm not aware of.
Yes. These days many utilities also run fibre. They also did run control lines but in the past they were for basic copper allowing remote substation intertrips before centralised control became a thing (e.g. OMG my breaker didn't open, please upstream stop feeding me power signal).
The problem with the cost comes in retrofitting the grid now, rather than when it was first built. Helicopter time isn't cheap.
Sure if you ignore technical requirements and start sinking a shitload of money into the system that will lead to public outrage as Americans cease to enjoy their ludicrously low electricity prices you can do ANYTHING.
PSTN, modems, SMS, you don't seem to realise just how much data is required by SCADA systems and how quickly they need to respond.
UHF? I take it you've never actually looked at coverage at these frequencies. HF maybe, but then you're into a new world of problems.
As for cables, they did lay them, but it's worth remembering that the grid wasn't built yesterday. Much of the communications which was laid was done so with simple copper carrying nothing more than dumb trip signals. These days they lay fibre. However laying enough to actually create your own network of all critical substations... we'll how deep is your wallet? After all we can build anything *you* are willing to pay for.
Cheers - been 20 years since I took an introductory course to being an electrician, always curious who things are done now :)
Helicopter time isn't cheap.
Nor are fried grids :)
I am a former employee for GE at exactly this business segment, and I have used the relays in question and was a designer on a related product. This does not surprise me at all. The thing is though, that GE actually tried really hard to get security right. Some employees weren't very good, but for the most part the company did the right things. The problem was customers. Customers _hated_ security features because it made things more difficult for their dummy techs to fix problems quickly. So - typically security features were disabled by customers or never used at all because security got in the way of their smooth operations.
Not if they use ROT13. It would take them more than 10 seconds just to find the website that decodes it.
The managers that run important infrastructure already have air gaps. (between their ears)
I'll see your senator, and I'll raise you two judges.