Slashdot Mirror


Hackers Targeting US Nuclear Power Plants, Report Finds (cnet.com)

For the past couple of months, hackers have breached the computer networks of companies that operate nuclear power facilities in the US, according to a new report from federal law enforcement officials. From a report: One of the companies targeted was the Wolf Creek Nuclear Operating Corporation, which operates a nuclear facility near Burlington, Kansas, according to a joint report issued last week by the FBI and Department of Homeland Security and described by The New York Times. The report carried an urgent amber warning, the second-highest rating for the severity of the threat, the Times reported. Organizations running the nation's energy, nuclear and other critical infrastructure have become frequent targets for cyberattacks in recent years. In a 2013 executive order, President Barack Obama called cyberattacks "one of the most serious national security challenges we must confront."

91 comments

  1. Confusing headline and summary by Anonymous Coward · · Score: 0

    Headline says the power plants were targeted, summary says the companies were targeted.

    1. Re:Confusing headline and summary by Mr+D+from+63 · · Score: 2

      Headline says the power plants were targeted, summary says the companies were targeted.

      The headline is BS. The Wolf Creek plant controls were not involved at all, just the corporate business network which is completely separate. The headline intentionally implies something that didn't happen.

    2. Re:Confusing headline and summary by Registered+Coward+v2 · · Score: 2

      Headline says the power plants were targeted, summary says the companies were targeted.

      The headline is BS. The Wolf Creek plant controls were not involved at all, just the corporate business network which is completely separate. The headline intentionally implies something that didn't happen.

      Taking headquarters out of the loop would be the best thing to happen to the plant, says this former operator.

      --
      I'm a consultant - I convert gibberish into cash-flow.
    3. Re:Confusing headline and summary by AHuxley · · Score: 1

      Think of it as finding information online and sending malware emails and links that get deeper into any network detected or accessed.
      Does the malware care if its nuclear or what the social media or site was used to find the way in?
      Its just like spam efforts that got a new list of emails that worked.
      The malware wants to get deeper into any network that they get activated in.
      Too much information is on the internet and too many random people are finding details online.

      Malware follows social media or the wide open "internet" back up into other networks.

      --
      Domestic spying is now "Benign Information Gathering"
    4. Re:Confusing headline and summary by Mr+D+from+63 · · Score: 1

      Taking headquarters out of the loop would be the best thing to happen to the plant, says this former operator.

      We're from fleet, and we're here to help.

    5. Re:Confusing headline and summary by Registered+Coward+v2 · · Score: 1

      Taking headquarters out of the loop would be the best thing to happen to the plant, says this former operator.

      We're from fleet, and we're here to help.

      And we're glad to have you. The two biggest lies in the Navy.

      --
      I'm a consultant - I convert gibberish into cash-flow.
  2. Who's up for Vodka? by Oswald+McWeany · · Score: 0

    This topic makes me thirsty. Who wants Vodka?

    --
    "That's the way to do it" - Punch
    1. Re:Who's up for Vodka? by Anonymous Coward · · Score: 0

      Force all the workers to be on guest account on Mac dumb terminals with Antivirus installed. Then give them AWS Workspaces for MS office resume crap work.

    2. Re:Who's up for Vodka? by Max_W · · Score: 1

      In my opinion it is not the Usual Suspects this time. In Russia there is a compulsory secondary education, all children study physics and can discern that it would not be a good idea to interfere with a nuclear power plant.

    3. Re:Who's up for Vodka? by rjmx · · Score: 1

      What if it were someone else's nuclear power plant?

    4. Re:Who's up for Vodka? by PolygamousRanchKid+ · · Score: 1

      Who wants Vodka?

      . . . and then the CIA guy answers, "Don't bother pouring a separate glass for me . . . I'll just take drinks out of the glasses of every one else . . . "

      --
      Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
    5. Re:Who's up for Vodka? by Anonymous Coward · · Score: 0

      Who wants Vodka?

      Trump

    6. Re:Who's up for Vodka? by Anonymous Coward · · Score: 0

      Would it surprise you to hear that Trump doesn't drink alcohol? Cause he doesn't..

    7. Re: Who's up for Vodka? by Anonymous Coward · · Score: 0

      Would it surprise you that that only makes him an even bigger tool? Cause it does.

    8. Re:Who's up for Vodka? by BronsCon · · Score: 1

      Fallout spewed into the upper atmosphere in the US can still reach Russia.

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
    9. Re:Who's up for Vodka? by Mr+D+from+63 · · Score: 1

      That might be a valid thought if there were actually a nuclear plant attacked in this case, but there wasn't , just a completely misleading headline.

    10. Re:Who's up for Vodka? by Anonymous Coward · · Score: 0

      YES! I can't believe his actions are the work of a sober person. That just leaves insanity. I'm sure that syphilitic brain of his will get us all killed one day. Tell you what, if we all die in a hail of nuclear winter, you owe me a coke.

    11. Re:Who's up for Vodka? by Obfuscant · · Score: 1

      all children study physics and can discern that it would not be a good idea to interfere with a nuclear power plant.

      All children who are brought up right know it is not ethical to interfere with anything belonging to other people, even if it is connected to the internet. Hackers of this kind don't care, they want the cred for doing the most damage they can. And a lot of people today seem to think that if it is connected to the internet then it is fair game for anything they can do to it.

    12. Re:Who's up for Vodka? by Layzej · · Score: 1

      The chief suspect is Russia, according to three people familiar with the continuing effort to eject the hackers from the computer networks. One of those networks belongs to an aging nuclear generating facility known as Wolf Creek -- owned by Westar Energy Inc., Great Plains Energy Inc. and Kansas Electric Power Cooperative Inc. -- on a lake shore near Burlington, Kansas.

      The possibility of a Russia connection is particularly worrisome, former and current officials say, because Russian hackers have previously taken down parts of the electrical grid in Ukraine and appear to be testing increasingly advanced tools to disrupt power supplies.

      The hacks come as international tensions have flared over U.S. intelligence agencies’ conclusion that Russia tried to influence the 2016 presidential election. The U.S., which has several continuing investigations into Russia’s activities, is known to possess digital weapons capable of disrupting the electricity grids of rival nations.

      - https://www.bloomberg.com/news...

    13. Re:Who's up for Vodka? by Anonymous Coward · · Score: 0

      Yeah, we should believe anything BlumenBerg and Soros have to say.

  3. sensationalist garbage by Anonymous Coward · · Score: 1

    "There is no indication of a threat to public safety, as any potential impact appears to be limited to administrative and business networks,” the government agencies said."

    Zero Cool isn't fucking with the control rods of a reactor from his mom's basement. This is just another intrusion of an organization with poor security.

  4. control rods just need some hitting Y on vent gas by Joe_Dragon · · Score: 1

    control rods just need some hitting Y on vent gas all day long.

  5. Wup Wup! by Ol+Olsoc · · Score: 1

    Slashdot users find semit hysterical incorrect headline on Slashdot article.

    --
    The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
    1. Re:Wup Wup! by Anonymous Coward · · Score: 0

      Sorry. Not following. What is Semitic about attempting to hack reactor sites?

    2. Re:Wup Wup! by Ol+Olsoc · · Score: 1

      Sorry. Not following. What is Semitic about attempting to hack reactor sites?

      Ummm, me neither. Autocorrect does some strange things sometimes. "Some" is the right word But I can't figure out how it made what it "corrected'.

      --
      The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
  6. President Barack Obama called cyberattacks by Anonymous Coward · · Score: 0

    "one of the most serious national security challenges we must confront."

    I imagine Trump will be signing an executive order to say we have nothing to worry from cyber attacks.

  7. Nuclear Power Plants require the Internet? by Anonymous Coward · · Score: 0

    TAIA?

  8. We knew this was going on by evolutionary · · Score: 3, Insightful

    Okay this is not really that new. The tech community knews this was going on for sometime since power companies (for some crazy reason) are internet accessible. Even in the Snowden movie it was shown that the CIA was getting into power plants and hospitals of allies (now semi-allies?) for the purposes of "pressure" if they took actions the CIA decided it didn't like. So of course we've been targeted. Was probably one of the earlier targeted industries since the cyberwar with other countries started.

    --
    "Imagination is more important than knowledge" - Einstein
    1. Re:We knew this was going on by Anonymous Coward · · Score: 0

      Even in the Snowden movie it was shown that the CIA was getting into power plants and hospitals of allies (now semi-allies?) for the purposes of "pressure" if they took actions the CIA decided it didn't like.

      That's outrageously hostile, WW2 style targeting-civilians type of behavior. If assassinations were not explicitly forbidden in the later executive orders and politicians, journalists and activist kept dying, doing them by targeting hospital networks would be understandable since these are "civilian" operations and as such not regulated by the Conventions, in "their" opinion. Oh, wait! They do keep on dying anyway for mysterious reasons. But does that make the claim true about the targeting of the civilian infrastructure, or is this too just "fake news"?

    2. Re:We knew this was going on by evolutionary · · Score: 2

      Uh, the documents proving we were doing this were given to a few trusted reporter including Glenn Greenwald. Did you not read the reports/documents? But we've violated foreign territory in Pakestan with drones without their permission, legally an act of war, for sometime now. And that is acknowledge by the government, just not described as an act of war. (Pakestan complained, but ...not like we were going to listen nor were they going to outright declare war with us). And there is no mysterious reason, it leverage. Pure and simple. Many countries have done this. The Chinese do it with missles in Taiwan, we do it with computers worldwide. And others are doing to the Europeans. We've historically done it for a LONG time throughout history. It IS hostile. but historically this is not new .We are just doing in larger scale and increased frequency, which is what computers were designed to do.

      --
      "Imagination is more important than knowledge" - Einstein
    3. Re:We knew this was going on by XparXnoiaX · · Score: 1

      The tech community knews this was going on for sometime since power companies (for some crazy reason) are internet accessible.

      IF they truly are internet accessible, then I've mapped them myself. zmap is great.

      --
      Irresponsible disclosure is responsible
    4. Re:We knew this was going on by Anonymous Coward · · Score: 0

      ... since power companies (for some crazy reason) are internet accessible

      Smart meters.

  9. Air Gap by sycodon · · Score: 1

    Are the control systems at plants not isolated from the outside world?

    If not, why not?

    It seems obvious that they should be.

    --
    When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
    1. Re:Air Gap by Anonymous Coward · · Score: 2, Informative

      This is the advantage of the vintage of the U.S. nuclear fleet. The vast majority of the control systems, and just about all if not all safety-related control systems are electromechanical. There's nothing digital. You have to physically be there to screw with it. For those unfamiliar, the control logic doesn't use the fancy schmancy transistor, it uses electromechanical relays.

      Plenty of plants have analog to digital converters that take process information for monitoring - even remotely, but these include diodes and such to isolate the system. Plus things like the business network, admin, HR, etc etc are Internet connected. Losing that would be a bad day for business, but the plant itself wouldn't care.

    2. Re:Air Gap by Anonymous Coward · · Score: 0

      An air gap will help you much if one of the computers technicians use to program the SCADA gets infected at the headquarters.

      The vector in the Natanz enrichment facility was reportedly an USB stick. There is no airgap.

    3. Re:Air Gap by NoNonAlphaCharsHere · · Score: 1

      I'm pretty sure those Iranian centrifuges were air-gapped.

    4. Re:Air Gap by Mr+D+from+63 · · Score: 5, Interesting

      Are the control systems at plants not isolated from the outside world?

      If not, why not?

      It seems obvious that they should be.

      Yes, they are isolated. But articles like this tend to hint that plants are hacked when in reality only the corporate business lans are involved in the attacked, not the isolated control systems. But headlines aren't so exciting if they reflect reality.

    5. Re:Air Gap by PolygamousRanchKid+ · · Score: 1

      Are the control systems at plants not isolated from the outside world?

      Air Heads trump Air Gaps . . . the biggest threat to your computer system security is mechanical: "The loose nut behind the keyboard."

      If not, why not?

      Nothing can be made foolproof, because fools are so ingenious.

      It seems obvious that they should be.

      "Well, I don't think there is any question about it. It can only be attributable to human error. This sort of thing has cropped up before, and it has always been due to human error."

      --
      Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
    6. Re:Air Gap by Mr+D+from+63 · · Score: 1

      This is the advantage of the vintage of the U.S. nuclear fleet. The vast majority of the control systems, and just about all if not all safety-related control systems are electromechanical. There's nothing digital.

      There are plenty of digital controls in nuclear plants. Yes, there is also a lot of older relay technology as well, but plants have been upgrading controls for quite some time. Critical safety systems are still mostly non-digital because of difficult licensing process for upgrade to digital, but that is also changing.

    7. Re:Air Gap by tsqr · · Score: 2

      Are the control systems at plants not isolated from the outside world?

      If not, why not?

      It seems obvious that they should be.

      From TFA (yeah, I know; too bad TFS didn't mention this small detail): "The safety and control systems for the nuclear reactor and other vital plant components are not connected to business networks or the internet," Wolf Creek spokeswoman Jenny Hageman said in a statement. "The plant continues to operate safely."

    8. Re:Air Gap by Obfuscant · · Score: 1

      when in reality only the corporate business lans are involved in the attacked,

      This.

      But headlines aren't so exciting if they reflect reality.

      People don't read good news, they react to the sensational bad news. Good news is too boring and run of the mill. "Dog behaved, baby slept peacefully, traffic flowed at a good rate on the interstate..." doesn't get clicks. "Dog eats sleeping baby in the back of a car stuck in a ten hour traffic jam" is what people want to read about.

    9. Re:Air Gap by r2rknot · · Score: 1

      They are, as stated in the featured article.

      --
      "...whenever any Form of Government becomes destructive...it is the Right of the People to alter or to abolish it..."
    10. Re: Air Gap by Anonymous Coward · · Score: 0

      If you look at recent history, an airgap is limited in it's effectiveness.

      Hopefully the are all still running qnx, not windows.

    11. Re:Air Gap by Anonymous Coward · · Score: 0

      Whoa, whoa. Next you'll tell us that Stuxnet was a US/Israeli cyber-attack on Iran's uranium enrichment program.

      DJ T-Rump tweeted that this was fake CNN news. The real story is that it might have been Russia and some other very, very bad countries like North Korea and Elbonia.

    12. Re:Air Gap by Mr+D+from+63 · · Score: 1

      It also helps the headline hypers that the level of ignorance and fear due to massive mis-perception or risk of anything 'nuclear' or "radioactive' is high in the general population. Even many otherwise smart educated people tend to completely fail when quizzed on those risks.

    13. Re:Air Gap by Anonymous Coward · · Score: 0

      Yes, but unlike the operators at Nantanz, we do not ignore the alarms from the safety systems and just "bypass" them if they disagree with the DCS.

    14. Re:Air Gap by Hussman32 · · Score: 1

      Yes, critical safety systems are air-gapped. In theory some of the operating data could be acquired, and I expect other systems outside of the reactor could be compromised and perhaps force an outage.

      --
      "Who are you?" "No one of consequence." "I must know." "Get used to disappointment."
    15. Re:Air Gap by Layzej · · Score: 1

      “We’re moving to a point where a major attack like this is very, very possible,” Antova said. “Once you’re into the control systems -- and you can get into the control systems by hacking into the plant’s regular computer network -- then the basic security mechanisms you’d expect are simply not there.” - https://www.bloomberg.com/news...

    16. Re:Air Gap by Mr+D+from+63 · · Score: 1

      “We’re moving to a point where a major attack like this is very, very possible,” Antova said. “Once you’re into the control systems -- and you can get into the control systems by hacking into the plant’s regular computer network -- then the basic security mechanisms you’d expect are simply not there.” - https://www.bloomberg.com/news...

      The fact that he said 'the plant's regular computer network' tells of his ignorance to the architectures of nuclear station control networkS (not one), and then the isolated controls as well. This guy has never set foot in a nuclear plant. Also, he should be specific about which 'basic security measure' he claim are not there, because there are in reality many basic security measure "there". That's easy stuff to say when you want attention, and quite vague to evade criticism.

    17. Re:Air Gap by tlambert · · Score: 1

      There are plenty of digital controls in nuclear plants. Yes, there is also a lot of older relay technology as well, but plants have been upgrading controls for quite some time. Critical safety systems are still mostly non-digital because of difficult licensing process for upgrade to digital, but that is also changing.

      I don't know what you've been smoking, but when a friend of mine was involved in the group that attempted to send robots in to assess the damage in the Fukushima facility, all of the electronics in the robots kept dying.

      This is because almost no electronics that aren't military -- and generally sourced from NSA-run chip foundries -- aren't radiation hardened.

      The systems are electromechanical because they have to operate in the event of a large scale radiation leak.

      While you are correct that there's a lot of digital, it's on the ends of very long wires, well away from the possibility of accidental exposure to hard radiation, which would cause it to stop operating and/or malfunctions pretty spectacularly.

      Additionally, these systems tend to exist for monitoring only, not for control.

      And if anyone hooks anything but the monitoring legs of these things -- which are typically output only, optoisolated links -- to the Internet, they are fired, and potentially jailed.

    18. Re:Air Gap by AmiMoJo · · Score: 1

      The air gapped systems are at risk though. As we saw in Iran and in leaked documents from the NSA, there are ways to cross that air gap. Infected USB media, for example.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    19. Re:Air Gap by Anonymous Coward · · Score: 0

      Because they are very far away from any "real people" (ie; rich and/or influential politicians), but an incredibly useful target for attacks. A century ago we needed Reichstag-Fires to clamp down on a populace, but things have changed, and simple power-stations having their human-resources database threatened is more than enough to squeeze the oil out of the proletariat.

    20. Re:Air Gap by Mr+D+from+63 · · Score: 3, Informative

      ^You are talking off of assumptions, not experience. You could have checked just a little first, the link below an example of digital products that have been being installed in US nuclear plants for over that last 20 years. These systems don't need to be installed in containment where radiation levels are high, relay based controls are already installed in low rad environments.

      http://www.westinghousenuclear...

      Here is one on the Oconee Reactor Protection digital system, other plants are in the process of planning protection system digital upgrades;

      http://www.power-eng.com/artic...

      In addition, many US plants have installed digital control rod drive control systems. Once again, those controls are not located inside containment. You can walk right up to them, as most all controls, while the plant is running full power.

    21. Re:Air Gap by Mr+D+from+63 · · Score: 1

      The air gapped systems are at risk though. As we saw in Iran and in leaked documents from the NSA, there are ways to cross that air gap. Infected USB media, for example.

      Very true, which is why a full gamut of other controls are in place. Air gap alone is not sufficient, but it is a central piece to making intrusion extremely difficult.

    22. Re:Air Gap by ChumpusRex2003 · · Score: 1

      I don't see what the Fukushima robot project has to do with control systems. Digital control systems aren't located in the containment (the conditions in the containment are harsh - during accident conditions, ambient temperatures can reach 160 C, with an atmosphere of saturated steam at 6 bar and potential for high radiation levels). That's not a suitable environment for most electronics, only designs tend to be restricted to just transducers and actuators in the containment.

      The control systems are located outside of containment, but in physically hardened, environmentally controlled, plant rooms.

      Control technologies vary, but microprocessor control is widely used in new build and retrofits. Various systems have been developed with some systems using safety critical grade rad-hard processors, originally designed for space use (the rad hardening, is less for the risk of radioactive contamination, than for mitigation of cosmic ray events, as rad hard processors tend to be immune from rare radiation effects like latch-up, and have strategies for mitigation of single-event upsets).

      These days, however, designs are moving to decentralised, highly redundant clusters of CPUs. Each CPU receives only a very small number of signals for conditioning/processing/validation. Typically, these are processed in quadruplicate. These conditioned signals then pass to CPUs which perform the main logic, again in quadruplicate. The output from these is then aggregated using a fail-safe 2 of 4 logic system for output to the control actuators. In this type of solution, the CPUs don't need to be particularly resistant to radiation, as the entire system has redundancy for any individual CPU (and indeed, if the replicated CPUs are placed in different plant rooms in different plant zones, then the redundancy includes entire plant rooms/power supplies/HVAC/etc.). AMD K6 266 MHz CPUs are used in main example of this technology.

      By keeping the task for each CPU simple, it permits robust analysis of the code. In this solution, the firmware on each single-board computer is automatically generated from logic statements and consists of a formally verified microkernal, supervising automatically generated code from a validated code generator tool. The tools don't permit manual coding, so there is low risk of coding error. The simple and validated software also has a low surface area for cyber attack, even though the individual components of the cluster may be connected over networks running common technologies like profibus or ethernet.

      Some countries have accepted this design for use as the reactor control and safety system on new build EPR plants (e.g. France, China). Others have requested a less complex solution. In the UK, the regulator has accepted this solution for new build, but has required a "non-computerised safety system" as an additional safeguard. The regulator was originally presented with an FPGA design, but rejected that as they considered FPGA technology to be too new and complex, and asked for a simpler system with known long-term reliability and failure modes. The result was a backup system based on TTL logic and op-amps (for signal conditioning). I'm not sure where the US lies, but I would expect that they would be more aligned to countries like UK.

      However, although the US may be strict, this may not be the case universally. The control system I've described above in the reference EPR plant design originally had read-write network access to the non-nuclear-safety plant automation systems. In other words, a conventional industrial control system potentially had authority to transmit data to the safety control system. Most of the regulators reviewing the EPR design spotted this as a potential cyber security weakness, and insisted that the bridge between the safety control system and the balance of plant automation systems be read-only. What is telling, however, is that the vendor of this safety control system, claims to have retrofitted this system in nearly 70 plants. While the scope of retrofits may be smaller than in new builds, it nevertheless raises the question of whether regulators supervising retrofits might have missed potential vulnerabilities such as that described above.

    23. Re: Air Gap by KGIII · · Score: 1

      Dumb question...

      You say two of four. Why not three of four?

      --
      "So long and thanks for all the fish."
    24. Re: Air Gap by ChumpusRex2003 · · Score: 1

      In a nuclear power plant, an unplanned reactor trip is undesirable; it puts considerable stress on the plant, seriously disturbs the power grid (with increased risk of loss of mains power at the plant), and in may plant designs requires activation of multiple systems to manage the temperature/pressure shifts which result.

      2 out of 4 control in this case means that the "safe" action should be initiated if 2 of the control systems issue a "safe" signal or no signal (e.g. due to a complete failure of a control chain). For example, if control chain 1 and 2 generate a "run" signal, but chain 3 is off-line for maintenance, and chain 4 generates a "trip" signal, then the plant will trip. This avoids spurious activation of the safety response due to a single control system malfunction.

      If you have a 3 out of 4 system, where 3 systems must agree for an action to be taken - what happens if 1 system has a failure? You now have no redundancy, and any further hardware failure means that your control system will not be quorate and can't take any useful decisions. So, you will need to shutdown immediately following a single system failure, and even so there would be a small residual risk of a further failure during the shutdown sequence.

      The advantage of the 2 out of 4 system is that if you have one system producing a spurious signal, then you retain redundancy for "safe" actions. This gives time for a fault to be investigated and repaired with the plant operational, avoiding the risks of emergency plant manipulation and loss of production.

      A 3 of 5 system would continue to provide protection against spurious trip signals when then system is already degraded - but the low likelihood of this event, the fact that this is not a direct safety hazard (as the system would fail to the safe state), means that the increased cost, complexity and more difficult validation of a 5 chain system is not a justifiable trade-off.

    25. Re: Air Gap by KGIII · · Score: 1

      I get it now, thanks!

      --
      "So long and thanks for all the fish."
  10. 12 year olds having frun withon off buttons by Anonymous Coward · · Score: 0

    12 year olds having frun withon off buttons

    59 year olds telling people to be cheap and make this available more

  11. As 7 years ago? by Anonymous Coward · · Score: 0
  12. SSDD by Anonymous Coward · · Score: 0

    With continuing unpopularity at the loss of life in wars with dubious motives, America invested more and more in automated units. From unmanned drones to remotely controlled tanks to finally autonomous infantry robots. At first this seemed to be a sound strategy when dealing with areas totally hostile to the US, but there was a problem. America had moved the biggest threat to their security from extremist terrorists, to bored teenagers in their bedrooms.

    Early warning signs were ignored. The military hierarchy just couldn't grasp the notion that people would try to crack into their systems for for no other motive then for fun, or that their systems could be so easily compromised. Often by children no less. Compromises in security were covered up. Even when the automated infantry units kept breaking into song and dance routines.

    - Extract from "Modern Warfare and Cake Making"

    http://poisonedminds.com/d/20110627.html

    1. Re:SSDD by Anonymous Coward · · Score: 0

      Webcomic detected. Not xkcd. Mod down -10000 Troll

  13. Here's the question to ask... by bogaboga · · Score: 1

    Is the US government, under its various organs doing anything similar - or even bankrolling any entity abroad given what we've learned (thorough Wikileaks) over the last few months?

  14. Re:control rods just need some hitting Y on vent g by sexconker · · Score: 1

    Venting prevents explosion.

  15. Weren't hackers always a threat? by DatbeDank · · Score: 1

    I remember back in the early 2000s hearing about hacker threats to key infrastructure like power plants, water filtration, and the like. The solution then is if you don't air gap your mission critical systems, you're an idiot and shouldn't be in a job.

      How is 2017 any different to then and why is "muh Russia" the most shouted phrase while happily ignoring China, Israel, Pakistan, and well every other country with a vested interest in national and corporate espionage?

    1. Re:Weren't hackers always a threat? by AHuxley · · Score: 1

      In the past some dial up modem would be used to look over lists of interesting phone numbers.
      A connection to a company modem would be made and commands attempted. More details about the OS, file system, wider network would requested after a connection would be made. Sometimes just to use that networks speed to move a lot of data around from other more interesting networks and get some data stored to work on later given dial up speeds.
      A list of all extension phone numbers would be tried until a modem got a connected.

      Too many email and other social media, job sites now exist with internal detail on the open internet.
      So malware follows the email or contact details back to any and every network.
      Workers open an email at work or use a work computer to open emails.
      The issue is reported and some malware has to be a big event as its nuclear.
      Its just internet malware following any link it finds and presenting itself in the most readable way to get more details from any and every account it can.

      The only part to think about is why and how so much detail about nuclear work is on social media or the internet to be found and for such spam attempts to even find any working contacts.

      The new issue is social media and employment sites having too much network detail on the open internet. Spam is been sent with malware to accounts found.
      An air gap and a no internet, social media policy would help with that.

      --
      Domestic spying is now "Benign Information Gathering"
  16. Why would you have a open internet facing by Anonymous Coward · · Score: 0

    interface at a Nuke Plant?

    Have person monitor the interface user calls passes ID interface is turned up user logs in drops network when done and person turns interface down.
    No you cant email and facebook at work.

  17. It's not crazy by rsilvergun · · Score: 1

    it's cheaper to have them internet accessible. That's the basic problem with nuclear power. It's perfectly safe if you take all necessary precautions. But sooner or later some small government types come in, convince everyone they can cut their taxes by being every so much more efficient as a private company, take over and find running a nuke plant is _hard_. Like, really hard; and finally they start cutting corners and running the plants longer than they're supposed to.

    Until you can convince upwards to 90% of the population that having a nuclear power plant run by the lowest bidder is a bad idea I'm gonna oppose nuclear.

    --
    Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
    1. Re:It's not crazy by evolutionary · · Score: 1

      Uh, this is a POWER provider. In security, there is no such thing as perfectly safe, especially if it has the potential be accessed en masse. Whether we SHOULD use nuclear is a different topic but the dangers of an essential service having critical components accessible via the Internet the risks are not increasingly clear. I remember reading how water treatment in a small town with a way outdated server connected to the Internet was accidentally hacked by a low level hacker who thought he was in something else, trigger a subsystem that caused the water to be tainted, and alerted the authorities to his mistake without giving his/her name. (I forget full URL of the article. there were a number of other water treatment plants hacked in 2016 around March as well. So if you like to risk your water supply being tainted as a result, bottom's up. But power, and possible meltdown, hmm...not really for me.

      --
      "Imagination is more important than knowledge" - Einstein
    2. Re:It's not crazy by Mr+D+from+63 · · Score: 1

      it's cheaper to have them internet accessible. That's the basic problem with nuclear power. It's perfectly safe if you take all necessary precautions. But sooner or later some small government types come in, convince everyone they can cut their taxes by being every so much more efficient as a private company, take over and find running a nuke plant is _hard_. Like, really hard; and finally they start cutting corners and running the plants longer than they're supposed to. Until you can convince upwards to 90% of the population that having a nuclear power plant run by the lowest bidder is a bad idea I'm gonna oppose nuclear.

      First, they are not internet accessible. Not sure why you think they are other than gullible acceptance of a misleading headline. Furthermore, they are not run by the lowest bidder. But hey, maybe you could help write more misleading headlines, you seem to have the knack.

  18. Isn't this a repost? by clonehappy · · Score: 4, Interesting

    I think I've seen this same misleading bullshit article title literally once a month since 9/11/01.

    So the administrative (read: Windows) network got some malware at a nuke plant? Shocking. I'd honestly think I'd be more shocked if the headline said that a nuclear facility had never gotten its Windows network breached, because I've never seen one that hasn't been.

    Now, if the article showed that someone was fucking with the reactors or other critical systems, I'd be worried. But every article for the last 16 years has always been this same kind of clickbait garbage.

    1. Re:Isn't this a repost? by Mr+D+from+63 · · Score: 1

      ^actually, it wasn't even necessarily on the admin network at the plant offices, all we know it was the admin network of the company that owns the plant.

    2. Re:Isn't this a repost? by AmiMoJo · · Score: 1

      Nuclear plants, hospitals and the like are attractive targets for malware. Even if it's only the admin network that is hit, they have to fix it. There are legal requirements for record keeping, privacy, that sort of thing. The place can be forced to shut down if it can't do the paperwork.

      So there is a strong incentive to pay the ransom.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    3. Re:Isn't this a repost? by angel'o'sphere · · Score: 1

      The liked article might be bad.
      But the articles in german news clearly say: the hackers could power down the plant or cause other havoc.
      If that is true, I don't know.

      --
      Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
    4. Re:Isn't this a repost? by Anonymous Coward · · Score: 0

      Doesn't change the fact that the linked article and Slashdot headline are clickbait nonsense. In fact, the stringent recordkeeping and reporting requirements you speak of is probably the only reason we know that some poor sap's AD credentials got compromised. But beyond that...

      mapping computer systems for future attack

      No shit? Like every other script kiddie that's ever owned someone's box then scanned their network?

      report didn't indicate whether the purpose of the cyberattacks was espionage or physical destruction

      The report probably didn't indicate because it was neither. From what it sounds like, some dumbass responded to a phishing message and the "hackers" got someone's credentials that they then probably used to send more phishing messages. And of course, the obligatory Russian connection which makes no logical sense if you spend a few milliseconds thinking about it. Anyone with even rudimentary knowledge of network and operational security can read that article and deduce it's more nothing-burger bullshit from a media hack.

      The safety and control systems for the nuclear reactor and other vital plant components are not connected to business networks or the internet

      Of course they aren't. It's not like the systems that drive the control rods are a Windows machine tied to the corporate AD. People aren't that stupid, but that doesn't mean CNET can't write some sensationalist horseshit to drum up some more fear mongering and two-minutes of Russia hate.

    5. Re:Isn't this a repost? by Anonymous Coward · · Score: 0

      I have a windows network that has been up for 11 years that has never been breached, well, at least that I know of :)

    6. Re:Isn't this a repost? by Anonymous Coward · · Score: 0

      You run a large enterprise Windows network that has never had one node infected with any kind of virii or shitware? Are you available for hire?

  19. big deal by citylivin · · Score: 1

    I get a few fishing emails a day that make it through the spam filter. No where in the linked article is there any evidence of anything different than the spam i get which is the same as anyone gets.

    Sure some may be more akin to spear phishing but its hardly a national emergency. Don't open attachments from random people on the internet. If your responsible for a nuclear power plant, be even more cautious!

    Common sense, nothing to write an article about, which trump will then read and do something half assed and stupid because of. Can we cut down on the sensationalism in this age of knee jerk, no information foreign policy please? Poor journalism and tweets may end up being the cause of ww3, which is the saddest thought I have had all week.

    --
    As a potential lottery winner, I totally support tax cuts for the wealthy
  20. U.S. Technology Mostly Shite by Anonymous Coward · · Score: 0

    By now nobody trusts a REAL secret to US-designed information technology. We slowly replace your craptastic stuff with Alternative, Sound Engineering.

    Like this: https://github.com/DiplIngFrankGerlach/SicherHttpd

  21. Plus by Anonymous Coward · · Score: 0

    ...we have learned to love our FOREST again. Much more honest than your "civilization". Our ants, our weasels, our crows, our eagles. They are our allies against the Zuckerberg/Brin/Gates/Bell Labs/NSA Dreck.

    The animals of our forests can keep secrets and they cannot be fully bugged like the electronics you dump into Europe from China and America.

  22. That was only one of the vectors. by tlambert · · Score: 1

    That was only one of the vectors.

    You should really read the literature. They also used other vectors, and while they show a USB stick on the vector line, not all of them were via USB. Sometimes it came in loaded on Lexmark printers.

    https://www2.cs.arizona.edu/~c...

  23. Another reason to abandon nuclear by Anonymous Coward · · Score: 0

    You don't see them going after wind or solar, because those technologies aren't dangerous like nuclear. I know Slashdot has a number of nuclear shills that post on here, but the energy industry is moving away from nuclear. Nuclear is a dead technology, get over it!!

  24. How i i started make $20k every day by Anonymous Coward · · Score: 0

    Unlimited Intelligent Blank ATM Cards Which Have Been Specially Programmed Atm Card Contact Email Unlimitedatmcard@Gmail.com Or Phone Number: +19402426300

    I am announcing this amazing testimonial on this blog, about Mr Dickson how the Blank ATM Card experience changed my whole life.the 2017 blank Atm Programmed Card and cash money directly in any ATM Machine around you. There is no risk of being caught, because the card has been programmed in such a way that its not traceable,so luckily i read about the blank ATM card exercise and how it has made people become rich. I contacted the email address i attached to the testimonial of some beneficiaries and here i am today, all thanks to Global Tech Hackers Team Incorporation world wide for helping me with a blank ATM Card. Now all my financial worries are over. All you need to do is send a message to the email address provided: Unlimitedatmcard@Gmail.com
    Our You-tube Page is : https://youtu.be/Xkel8mTCrYI
    Our Website: http://unlimitedatmcard.webs.com

  25. Trump just said US intel agencies cannot be truste by Anonymous Coward · · Score: 0

    FAKE NEWS
    A
    K
    E

    N
    E
    W
    S

  26. Be Careful with English - Critical Thinking Skills by Anonymous Coward · · Score: 0

    "hackers have breached the computer networks of companies that operate nuclear power facilities in the US"

    That is not the same thing as "hackers have breached the computer networks of nuclear power facilities."

    And whomever put this FAKE NEWS together probably considers "omg I did a Whois and got an IP address of their webserver!" to be hacking.

    FAKE NEWS.

  27. mdsolar by 110010001000 · · Score: 1

    mdsolar is back...submitting as a AC

  28. Kompromat by doug141 · · Score: 2

    All the people saying control systems weren't affected seem too unconcerned about the long game. The hackers undoubtedly have better kompromat opportunities for deeper and better attacks now. An air-gapped system doesn't protect you when an employee has been blackmailed, bought, or duped.

    1. Re:Kompromat by Anonymous Coward · · Score: 0

      And a low-tech analog system does not protect you from those things either.. If you blackmail or bribe someone does it matted if they press button X on a computer or a old analog control-panel?

      But anyway, you would have to involve a lot more than just one person to put a place like that into meltdown... Sure they could cause damage to the place that would cost a shitload to fix, but the actual safety of people outside of the plant would not be affected...

      I don't understand why people are focusing so much on nuclear power when there is a lot more serious targets that can cause major damage, and that requires a lot less effort...

      Imagine someone shuting down the power in a country..
      ref 1 : http://www.reuters.com/article...
      ref 2 : http://www.businessinsider.com...
      I remember there was a talk on blackhat or defcon where they discussed how to bring down the whole grid in the US (without specific details of course) and what they found out was that if they could bring down a few central hubs it would trigger a chain-reaction over the whole grid that would basically shut down power in the whole country.

      Or have a look at what happened in Tianjun.. More people died there than in Fukushima.
      https://en.wikipedia.org/wiki/...
      Please see the list of toxic materials released and the number of people that was evacuated from the area and number of people that died as a direct cause of it.

      Instead of the fear-mongering... Lets try and focus on the important part instead.... How can we protect control/failsafe systems from being affected by a third-party in a destructive way?

  29. It's simple, if you attack, you get attacked by Anonymous Coward · · Score: 0

    stop trying to sabotage european, russian, and asian computer networks, industry, manufacturing plants etc. and they won't do the same to you. You literally asked for it.

  30. hey... by Anonymous Coward · · Score: 0

    mdsolar... is that you?