A diode can be constructed by trying to pass a small current through a probe in the flame. This diode is caused by the movement of ions through the flame area. However, I wonder what would happen if you tried to pass a larger current through the flame? Might it be able to temporarily neutralize or bind the ions to other molecules? If it did that, would you still have a flame?
This boastful diatribe is not the mark of a really smart person. It seems more like a cult member taunting the public.
I do not doubt that he could be crazy and smart at the same time. I think Iran's leadership has noticed the power of the stuxnet virus/worm. They're rightfully embarrassed. However, instead of fixing their problems and moving on, they're lashing out with dweebs like this deluded idiot.
The fact is that our CA platforms of trust are quite vulnerable. We should be afraid, though perhaps not from drooling whack jobs like this. Take time to review where your trust has been given, and then make some decisions. However, I wouldn't lose much sleep over something like this.
Does anyone wonder why Jefferson was one of the staunch supporters of the Second Amendment to the US Constitution? This is the answer. And no, I'm not speaking of guns in this case, I'm speaking of self defense against evil governance. We have laws against domestic surveillance without a court approved cause. The kind of information gathering that HBG perpetrated against Glenn Greenwald is exactly the reason why such laws exist.
This is actually a very nice example of defensive action by people against a very nasty abuse of power by government.
Seriously, it is hard to codify decades of experience in to a simple class that can be easily transmitted to the next generation. Furthermore, the concept of apprenticeships has been neglected in favor of the bureaucratic and idiotic practice of Human Resources (formerly known as Personnel Management). Now we have well certified people who have absolutely no experience applying anything they have learned. They are nearly worthless in real life; but wow, they look good on paper!
Apprenticeship deserves re-examination. We have bureaucratized so many skills and experiential sets that managers are lead to believe that workers are humanoid units that can be applied to any problem to make a result. Tell that to your football coach next time and ask them whether how well this could work when building a team.
In any case, today we have decades of experience walking out of the door every day and nobody knows how to "download" that well of experience before it evaporates and dies. I suggest apprenticeships on the job instead of formal classroom theory. Don't get me wrong, theory has it's place. But eventually that theory needs to be applied. And for that, you need real experience. You can get that experience on your own, or you can have someone help you by showing you where their experience came from. I know which I would choose.
Meanwhile, security is like safety. It is best taught by people with real battle scars. The reason older tricks are still working is because we have made a profession of securifying other things and other people instead of showing people how to do this for themselves. Clearly people are learning how to make this work, but they're making the same mistakes over and over because they don't have others to show them what worked and what didn't work when applying theory to practice.
And yes, it is true: we can't even get most people to lock the doors of their homes and cars until they've been burglarized.
Feh. It wouldn't be the first time these dimwits at the FCC screwed up. I remember installing 928.8... MHz SCADA (you know, the telemetry that runs your water, electricity, gas...) and it worked great. About nine months later, the FCC allowed 929 MHz paging. In a very short span of time we had enough energy coming down the antenna line to light a neon bulb. They were licensed for 3 kW ERP. Our remotes were licensed for 5 W + some gain from a small Yagi.
The master receivers went deaf from the continuous blast of high powered paging traffic. A Cavity filter can't do much to get rid of strong signals only 200 kHz away at 900 MHz.
Yeah, the FCC screwed up. They had no knowledge of the state of the art of receivers. We bought receivers engineered for sensitivity, not strong signals, because at the time, there were no other significant strong signal sources on that band. The state of the art took a while to catch up. We ended up solving the problem by re-licensing our channels for horizontal polarization. The pager stuff remained vertical. We got 20 dB of immunity from them and that was enough.
And to the jerkwads at the FCC who thought this was acceptable: DO YOU LIKE WATER? DO YOU LIKE ELECTRICITY? DON'T DO THIS TO US!
Even if they could hire them; I'd be even more concerned with retaining them. From everything I've seen with DHS, it's not a good place to get anything done. The last thing anyone wants to do is to get on hamster wheel.
A properly unloaded firearm in a locked case is permitted in an airport. The baggage is checked separately and tagged so that TSA knows it is there. Yes, this includes a handgun. It may seem counter-intuitive to those have never been in uninhabited areas, but a large caliber handgun is useful in case you are caught by surprise by wolves, boar, or bear. My cousin used to go on Salmon fishing trips in Alaska, and he always carried a.44 with him just in case he had to take down a bear. As far as I know, he never had to use it outside of the gun range, but better safe than sorry.
The fundamental question when you buy a PS3 is: What do you own and what did you license?
This is what the lawyers and judges, people who probably know very little about the technology, will have to decide. Yeah, it makes me sick too. At least regulators and legislators might make a show of soliciting input from the public.
Do note that I said nothing about how well the schools were doing this. I merely pointed out that they're focused upon teaching applied math, to the exclusion of exploration or creativity in anything else.
In practice, there are two forms of teaching. The first is applied subject matter in school. In this specific case, it is applied mathematics. They give you the calculation tools for describing a relationship and then they expect you to find similar relationships and apply that formula. The goal is to teach the use of a tool. It is no different than teaching one to write a coherent paragraph, communicate in a foreign language, or to be a good citizen in a democracy. Teaching applied mathematics is a necessary element of any school curriculum.
The second is one of discovery. My journey began as a teen, when I read about fractals in an article from Scientific American. Since then I've gone on and explored prime number theories, methods of calculation, the history of these discoveries, and I've gone looking for the blind alleys that may not have been explored as thoroughly as we might think.
We need to recognize that education is not about discovery. It is about teaching a person the tools of modern society. However, in our zeal to teach the applied aspects of these subjects, we need to realize that we are failing to nourish the creative spirit of discovery. Mathematics is no different than reading, writing, civics, history, geography, or language. Learning to write a coherent text does not make one appreciate literature.
Our schools are obsessed with application, not discovery. We spend ridiculous time teaching application, application, and more application. Then we sit and wonder why our children lack the will to explore...
Commuting may be stupid, but you still need to move goods from place to place in a timely fashion. The need for better transportation will always be there, whether humans ride it or not.
Another point: Even if power to weight ratios were improved significantly, as a private pilot, I have personally aborted many flight plans due to weather concerns. There are certain limiting issues such as weight and balance issues, engine performance at altitude, weather, maintenance, "Temporary" Flight Restrictions (some of them aren't so temporary), Runway availability, and so on...
The fact is that even with today's technologies, helicopters and bush planes would have difficulties working in and out of these airports and meeting these requirements. Even if we all flew planes with ridiculously high power to weight ratios, such as a Piper Super Cub with an O-360 engine (and those are just two seat aircraft), you still would have difficulty getting to the sort of performance sought by these "Pocket Airports." Another thing: the noise doesn't come just from the engine: It comes from the propeller as the tips approach the speed of sound. A ducted fan might reduce some of the noise, but it isn't likely to do much for efficiency.
This is clearly something written up by yet another dreamy eyed idiot who has no idea what technologies are currently viable or what the state of the art is. What a waste of money...
If Stuxnet was indeed targeted at the Uranium Enrichment facility in Natanz, it would have taken exactly what the Symantec paper suggested.
You think talent alone is all it takes?
You would need process engineers with at least an understanding of how gas centrifuges work and who know how to set the couple hundred registers for a high speed VFD --one of which was designed and built in Iran; and two models of PLC gear. You'd need network specialists to collect information from the target (there was an Italian football web site that earlier versions of Stuxnet sent data collected from WinCC --but that web site never saw the traffic). There was a rootkit to write, a few private keys to steal, inside knowledge of the WinCC and S7 development package, and intimate knowledge of the embedded systems in an S7 PLC. I know many smart people with tremendous background experience. None of them have this combination.
Nobody learns the breadth of this knowledge overnight. This was not two guys in a basement. If anything, Symantec's estimates are low.
"Your glee might be tempered a bit when this thing gets propagated to Europe, North America, and the rest of the world.
"It seems just as likely that the guys running Turbines for your local power company are no better equipped to handle this than Iran. In Iran, they have unlimited budget and first call upon the best brains in the country."
It already has. It doesn't matter.
Stuxnet was VERY selective. It targeted only the S7 315 and 417 Programmable Logic Controllers (PLC). It looked for specific code blocks and data structures on those devices. You need to know that PLC applications code is usually custom written. It looked at the I/O networks and tried to find at least 33 instances of one of two models of a high speed motor drive. These are not ordinary Variable Frequency Drives. Had they come from the US, they'd be subject to export restrictions. The ones in use came from Finland and were also constructed locally in Iran.
Speaking as a control systems engineer, I don't know of any other massively parallel processes that involve many dozens (hundreds?) of high speed drives like this --other than Uranium enrichment. That's why the risk to other plants, including the Bushir nuclear reactor, are relatively small. The malware will install itself in the development workstations but it won't do much.
This is a good thing because had the malware been less selective, it would have done pretty much what you suggest. Most of you probably have little idea as to the extent and ubiquity of these PLC devices. The S7 PLC line is extremely popular and you'll find one in nearly half of all industrial settings around the world. If there were a malware that blindly attacked these devices, the world economy as we know it would take a massive change for the worse.
THAT is why nobody has done a broad based attack against PLC gear before. It will blow back on them. Once you realize what a PLC is and how widely it is used, you will also realize that an attack against this platform is the equivalent of a nuclear attack in the software world. In the case of a PC you only lose data. Most data can be restored. In this case, you lose an industrial process and it may be significantly damaged. An attack will almost certainly blow back on you and your neighbors. It will make the economic malaise of the present look tame by comparison.
Correction: The Siemens WinCC software had that password, as did the Step 7 development package. Siemens used it as some sort of idiotic way to validate licenses. That is why they were unable to tell anyone to change the password. It was hardwired everywhere. Note that this password was disclosed publicly in 2008, and yet Siemens did nothing to change the code.
The PLC did not have this password. The PLC was built on the assumption that those who have physical access to the unit have ultimate authority anyway (they can walk over to a motor control center and just turn a switch). In today's networked to everywhere situation, this looks foolishly quaint. However, back when these devices were designed, it was assumed that those who build these networks are doing all they can to block the traffic on to the office network.
Unfortunately, there are way too many office IT "experts" who think that because they know the office that they know the plant floor IT as well. They design the one great big network of everything and then use a VLAN to keep it apart. The VLAN gets bridged when some dreamy eyed idiot wants to surf the web and monitor the plant from the same box. And that's when things go downhill pretty fast. I speak from experience. If you do any form of office IT, you would be wise to pause and think before you post your ignorance for the world to see. If you have never done embedded computing, worked on a Programmable Logic Controller, or managed a real industrial process, there will be surprises in store for you. This is not just another app.
The Stuxnet PLC code was looking for something very specific. Current speculation leans toward the notion that this was aimed at the Uranium Enrichment facility in Natanz, Iran. However, there is only circumstantial evidence at best and the clues are awfully thin. Even if this is true, I doubt anyone will be confirming this story in our lifetimes.
One of the interesting aspects to targeting an S7 PLC platform is this: It is one of the most popular PLCs world wide. If someone were to install a back door timebomb that stopped this PLC cold, the world economy as we know it would collapse in a matter of weeks. There is a significant amount of high energy stuff based upon this PLC platform. Aim at more than one platform of PLC and the world as we know it could change overnight.
This is the Nuclear option of weaponized software. Anyone who launches an attack like this has very little concern for anyone but himself. That is why Stuxnet was probably so narrowly targeted at one facility. If they hadn't it would have blown back on the rest of the world.
The lesson learned from Stuxnet is that the response by the CERT agencies world wide was either bad or awful. Even today, Siemens have very little to say about how to remove the Stuxnet rootkit. They'll only remove the payload carrier. Gee. Thanks. It would have done that by itself eventually.
It took a business consultant like Ralph Langner to break open the first evidence of the nature of the PLC code. I was there at the ACS conference in DC when he gave his first presentation on the subject. Yes, there were rumors that INL was doing it too, but they never released their findings. DHS keeps stamping their work secret even when it would have been better not to.
We need to do better. The CERT groups need to step up to the plate and realize that there are other platforms besides the PC. Furthermore, they also need to realize how issues of functional and I/O validation fit in to the picture, and how safety is handled. This may be a simpler platform in many ways, but the social and safety issues that go along with it make financial information system designs look like child's play. At least you can restore the latter from a backup and nobody gets maimed or killed.
If you want to know where the President, Vice President, or Speaker of the House will be before the news story breaks, just read the TFR NOTAMs from the FAA. To enforce the laws against flying in temporary flight restriction areas, they have to let the flying public know at least 24 hours in advance.
Notice that this NOTAM is only valid up to 39,000 Feet MSL (FL390). This may have been a big missile, but I doubt that it was headed for space. If it were, the NOTAM would have gone all the way to FL600 (the limit of enforceable airspace).
Actually, I know those problems quite well. As for size, while our SCADA system doesn't compete much with electric grid SCADA, it serves a utility among the top ten largest in the nation. Our secret is keeping the point count to the minimum needed to get the job done. Too many SCADA systems suffer from so much bloat that the people who use it every day have no idea exactly what its extent is or what the alarms might mean (sound familiar?).
Our system is not new. The original went online in 1988, and I was there when it happened. We did not have a clean sheet of paper by any stretch of imagination. I have kept our system up to date through a series of efforts. The reason we're in a state of the art system today is no accident, nor is it because we built it last year.
Our system is different. Although it has only one control center, we do have distributed backups at all of our six major plants. If the main control center fails or we have a massive network problem, whatever is left will be handled and dispatched by the plant staff. This is a concept that many utilities have not bothered to consider. We call it graceful degradation. There never will be a "backup control center." Everybody is a backup.
As for discussing things with National Labs, they take as many notes and hints from me as I do from them. It is a two way street. Many efforts from DHS and DOE are kept under wraps for security reasons. As a result, people on the front lines like me are often kept in the dark. I'd have more good things to say about national labs if we had better lines of communications.
And As For your last point, I have a saying: In SCADA, the most dangerous people on earth are probably drinking coffee with you every day.
There are people who talk about this stuff, and there are people who do it. I'll leave it to you to ponder which side I'm from.
This is Slashdot. There are many self styled experts here. Some know what they're talking about. Many do not. Tread with care.
I am a registered professional engineer with 25 years of experience integrating, fixing, and designing several generations of SCADA and plant control systems for a large water and sewer utility. I not only design and build these things, I live with my creations through the entire life-cycle. If it does anything unexpected, they call me; no matter how old it is. I have worked on every aspect from the field to the operations control center and every single detail in between. I am not just an engineer, I write software, including protocol drivers, embedded firmware, and system management scripts. I designed the networks we use and I often show our IT department some of the finer points of network design. I'm not a consultant. I'm not selling anything.
As with safety, just as there are no perfectly safe systems, there are no perfectly secure systems. We do not have testing procedures or magic text books that we can throw at this problem. However, for suggestions, I recommend ISA-99 or NIST SP 800, if you do any work on behalf of the Federal Government in the US. In particular, see NIST 800-82. I should warn you, NIST 800-82 is a smorgasbord of suggestions. I think if someone tried to implement all of these notions you'd have a nearly unusable system. At some point, you have to stop securifying and safetying everything and just educate staff what the risks are and what to look for.
If you're really trying to do SCADA, stay away from Modbus. While Modbus is a good DCS protocol, it is a poor SCADA protocol. Too many engineers still specify Modbus for SCADA because they know nothing else. DNP3 is an event oriented, near-real-time protocol. It is a far better SCADA protocol. If you don't understand the distinction, find a consulting engineer who can explain it to you. If your present consulting engineer has difficulty understanding this nuance, find another one. DNP has been in wide use in the electrical power industry in North American for over a decade. Water utilities in Australian and the UK are using DNP. It also has new features for secure authentication. See IEC 62351-5 for details.
On the other side, Office IT is not the same as a real time or near real time IT. I know of at least two books explaining this difference. If your IT staff do not understand that this application is truly different, find someone who does.
Understand that control engineering is a very broad field, embedded IT is a very broad field, and IT security is a very broad field. If you put the experts in the same room, make sure you define the problem for them very carefully. These fields tend to make prima-donna characters out of otherwise mild mannered people. I can guarantee a very heated argument after a short period of time and even a fist fight is not entirely out of the question. We do not have room for this kind of behavior.
The IT security people need to understand that while IT systems can be restored from backups, physical systems can not. They also need to understand that we do not spray patches at the field on a whim. We do not have broadband to a manhole in the middle of the street. And we use common carriers with extreme caution and evaluation. Likewise, the engineers need to stop thinking about building things and start thinking about how to break them. Too many engineers assume that nobody in their right mind would mess with their wonderful creations because it would clearly break something. That's like designing cars without considering what they'll do when they crash.
I suggest getting familiar with the various standards efforts. Also, I suggest keeping track of what is going on with SCADA security. Note some of the following
(Shameless plug alert) I am a co founder of SCADASEC, an email list for SCADA and ICS security issues. I am also a member and contributor to the DNP3 and ISA-99 standards committees. These are many popular efforts. The NIST SP 80
Mod parent up. This idea is not as novel as the re discoverers would have you think. I attended a patented technology show with similar concepts in these engines back in the mid 1970s, and it wasn't even a particularly novel idea back then. Next on the resurrected idea list will probably be either a Wankel rotary engine or perhaps some variant of the infamous Dyna-cam engine.
Sometimes it is the IP/marketing that quashes an idea, sometimes it is the lack of need (low fuel prices), sometimes it is the sheer costs of changing all the manufacturing systems to build the new stuff. Sometimes, it's the costs of exotic materials. There are many reasons why an engine technology might not get adopted.
If we're lucky, perhaps this engine's time has come. And then again, maybe it's an unmaintainable nightmare. We'll have to buy a few to figure this out.
Agreed. In a broader application, Function Block Diagramming is one of the silliest features in IEC 611131 (the common interface specification for Programmable Logic Controllers). Not much better: Relay Ladder Logic diagrams. I know, this is heresy among many people who "believe" in this stuff.
I want my program text to appear in a concise, easy to read format. The logic in RLL requires too much scrolling and is simply too diffusely displayed on the screen. People who use this stuff often forget that someone with a laptop may be standing in front of the controller in the field, wondering why it is behaving the way it is. Having to scroll across many screens just to see a single line of logic doesn't help understand what the code is supposed to do.
A simple text based line of logic equations would be much easier to parse. However, old habits die hard on the plant floor. There is still this notion that real electricians will want to look at this code and that all those mysterious look-alike blocks with functions that range from timers to shift registers will be comprehensible to them.
Stick to ASCII. Stick to the stuff that everyone knows how to read. Displays and code can be made pretty with a good text editor, but the original software needs to comprehensible by mere mortals.
The Journal of the American Water Works Association had a significant article this month dealing with the effects of fracking on watersheds. Those of you who think natural gas is clean have no concept of what drillers use to get the natural gas from shale in places such as New York state.
In fact, the regulations themselves are not aligned to balance these considerations in any way. Drilling rights are completely disconnected from watershed concerns.
Something needs to happen here... Over the shorter term, we'll need both the energy source and the clean water.
Over the longer term, we need better nuclear plant designs. The designs on the board right now leave much to be desired...
Yes, they're incompetent. If they were really good they wouldn't stick around. Most places have a difficult time justifying the sorts of salaries that keep the good people on staff.
Look, the problem is that large organizations have often bought in to the notion that Human Resources knows what it's doing. They do not. They can not. I've watched this process in my own company. It's not pretty. It is a process designed by lawyer/MBA dweebs where success is almost always accidental.
The difference in your case is that people took the bull by the horns and attempted to resolve the problem. In a larger company, say 1000 employees or more, I can just about guarantee that you wouldn't get that kind of authority.
The State of Virginia was trying to outsource a process they did not fully understand. I don't care how you slice it, this is a recipe for disaster. You don't go to an attorney and ask them to fix your legal problems for you. You go to him or her with a clear plan of what you want to do, or you will end up with nothing but expenses and no end of trouble.
It's no different for IT. There has to be a clear sense of deliverable services and precise resources defined, or you'll get some crap weasel mess like what the state of Virginia got.
And to top it all off, the MBA crowd frequently deludes themselves in to thinking that this can be done without assistance of any sort. I hope these idiots learned their lesson.
Slashdot Mirror
A diode can be constructed by trying to pass a small current through a probe in the flame. This diode is caused by the movement of ions through the flame area. However, I wonder what would happen if you tried to pass a larger current through the flame? Might it be able to temporarily neutralize or bind the ions to other molecules? If it did that, would you still have a flame?
I don't know. I'm just speculating.
Mod parent up for informative post.
This boastful diatribe is not the mark of a really smart person. It seems more like a cult member taunting the public.
I do not doubt that he could be crazy and smart at the same time. I think Iran's leadership has noticed the power of the stuxnet virus/worm. They're rightfully embarrassed. However, instead of fixing their problems and moving on, they're lashing out with dweebs like this deluded idiot.
The fact is that our CA platforms of trust are quite vulnerable. We should be afraid, though perhaps not from drooling whack jobs like this. Take time to review where your trust has been given, and then make some decisions. However, I wouldn't lose much sleep over something like this.
Does anyone wonder why Jefferson was one of the staunch supporters of the Second Amendment to the US Constitution? This is the answer. And no, I'm not speaking of guns in this case, I'm speaking of self defense against evil governance. We have laws against domestic surveillance without a court approved cause. The kind of information gathering that HBG perpetrated against Glenn Greenwald is exactly the reason why such laws exist.
This is actually a very nice example of defensive action by people against a very nasty abuse of power by government.
Uh, yeah, good luck with that.
Seriously, it is hard to codify decades of experience in to a simple class that can be easily transmitted to the next generation. Furthermore, the concept of apprenticeships has been neglected in favor of the bureaucratic and idiotic practice of Human Resources (formerly known as Personnel Management). Now we have well certified people who have absolutely no experience applying anything they have learned. They are nearly worthless in real life; but wow, they look good on paper!
Apprenticeship deserves re-examination. We have bureaucratized so many skills and experiential sets that managers are lead to believe that workers are humanoid units that can be applied to any problem to make a result. Tell that to your football coach next time and ask them whether how well this could work when building a team.
In any case, today we have decades of experience walking out of the door every day and nobody knows how to "download" that well of experience before it evaporates and dies. I suggest apprenticeships on the job instead of formal classroom theory. Don't get me wrong, theory has it's place. But eventually that theory needs to be applied. And for that, you need real experience. You can get that experience on your own, or you can have someone help you by showing you where their experience came from. I know which I would choose.
Meanwhile, security is like safety. It is best taught by people with real battle scars. The reason older tricks are still working is because we have made a profession of securifying other things and other people instead of showing people how to do this for themselves. Clearly people are learning how to make this work, but they're making the same mistakes over and over because they don't have others to show them what worked and what didn't work when applying theory to practice.
And yes, it is true: we can't even get most people to lock the doors of their homes and cars until they've been burglarized.
Feh. It wouldn't be the first time these dimwits at the FCC screwed up. I remember installing 928.8... MHz SCADA (you know, the telemetry that runs your water, electricity, gas...) and it worked great. About nine months later, the FCC allowed 929 MHz paging. In a very short span of time we had enough energy coming down the antenna line to light a neon bulb. They were licensed for 3 kW ERP. Our remotes were licensed for 5 W + some gain from a small Yagi.
The master receivers went deaf from the continuous blast of high powered paging traffic. A Cavity filter can't do much to get rid of strong signals only 200 kHz away at 900 MHz.
Yeah, the FCC screwed up. They had no knowledge of the state of the art of receivers. We bought receivers engineered for sensitivity, not strong signals, because at the time, there were no other significant strong signal sources on that band. The state of the art took a while to catch up. We ended up solving the problem by re-licensing our channels for horizontal polarization. The pager stuff remained vertical. We got 20 dB of immunity from them and that was enough.
And to the jerkwads at the FCC who thought this was acceptable: DO YOU LIKE WATER? DO YOU LIKE ELECTRICITY? DON'T DO THIS TO US!
spit...
Even if they could hire them; I'd be even more concerned with retaining them. From everything I've seen with DHS, it's not a good place to get anything done. The last thing anyone wants to do is to get on hamster wheel.
Sick joke (at least, I hope it is, because I really do not want to see what the reality of such an idea might look like).
A properly unloaded firearm in a locked case is permitted in an airport. The baggage is checked separately and tagged so that TSA knows it is there. Yes, this includes a handgun. It may seem counter-intuitive to those have never been in uninhabited areas, but a large caliber handgun is useful in case you are caught by surprise by wolves, boar, or bear. My cousin used to go on Salmon fishing trips in Alaska, and he always carried a .44 with him just in case he had to take down a bear. As far as I know, he never had to use it outside of the gun range, but better safe than sorry.
The fundamental question when you buy a PS3 is: What do you own and what did you license?
This is what the lawyers and judges, people who probably know very little about the technology, will have to decide. Yeah, it makes me sick too. At least regulators and legislators might make a show of soliciting input from the public.
I really want to know what people are going to write for the statement that Neil Armstrong made when he stepped off the LEM ladder.
I agree with all that you posted.
Do note that I said nothing about how well the schools were doing this. I merely pointed out that they're focused upon teaching applied math, to the exclusion of exploration or creativity in anything else.
In practice, there are two forms of teaching. The first is applied subject matter in school. In this specific case, it is applied mathematics. They give you the calculation tools for describing a relationship and then they expect you to find similar relationships and apply that formula. The goal is to teach the use of a tool. It is no different than teaching one to write a coherent paragraph, communicate in a foreign language, or to be a good citizen in a democracy. Teaching applied mathematics is a necessary element of any school curriculum.
The second is one of discovery. My journey began as a teen, when I read about fractals in an article from Scientific American. Since then I've gone on and explored prime number theories, methods of calculation, the history of these discoveries, and I've gone looking for the blind alleys that may not have been explored as thoroughly as we might think.
We need to recognize that education is not about discovery. It is about teaching a person the tools of modern society. However, in our zeal to teach the applied aspects of these subjects, we need to realize that we are failing to nourish the creative spirit of discovery. Mathematics is no different than reading, writing, civics, history, geography, or language. Learning to write a coherent text does not make one appreciate literature.
Our schools are obsessed with application, not discovery. We spend ridiculous time teaching application, application, and more application. Then we sit and wonder why our children lack the will to explore...
Commuting may be stupid, but you still need to move goods from place to place in a timely fashion. The need for better transportation will always be there, whether humans ride it or not.
Mod Parent Up!
Another point: Even if power to weight ratios were improved significantly, as a private pilot, I have personally aborted many flight plans due to weather concerns. There are certain limiting issues such as weight and balance issues, engine performance at altitude, weather, maintenance, "Temporary" Flight Restrictions (some of them aren't so temporary), Runway availability, and so on...
The fact is that even with today's technologies, helicopters and bush planes would have difficulties working in and out of these airports and meeting these requirements. Even if we all flew planes with ridiculously high power to weight ratios, such as a Piper Super Cub with an O-360 engine (and those are just two seat aircraft), you still would have difficulty getting to the sort of performance sought by these "Pocket Airports." Another thing: the noise doesn't come just from the engine: It comes from the propeller as the tips approach the speed of sound. A ducted fan might reduce some of the noise, but it isn't likely to do much for efficiency.
This is clearly something written up by yet another dreamy eyed idiot who has no idea what technologies are currently viable or what the state of the art is. What a waste of money...
If Stuxnet was indeed targeted at the Uranium Enrichment facility in Natanz, it would have taken exactly what the Symantec paper suggested.
You think talent alone is all it takes?
You would need process engineers with at least an understanding of how gas centrifuges work and who know how to set the couple hundred registers for a high speed VFD --one of which was designed and built in Iran; and two models of PLC gear. You'd need network specialists to collect information from the target (there was an Italian football web site that earlier versions of Stuxnet sent data collected from WinCC --but that web site never saw the traffic). There was a rootkit to write, a few private keys to steal, inside knowledge of the WinCC and S7 development package, and intimate knowledge of the embedded systems in an S7 PLC. I know many smart people with tremendous background experience. None of them have this combination.
Nobody learns the breadth of this knowledge overnight. This was not two guys in a basement. If anything, Symantec's estimates are low.
"Your glee might be tempered a bit when this thing gets propagated to Europe, North America, and the rest of the world.
"It seems just as likely that the guys running Turbines for your local power company are no better equipped to handle this than Iran. In Iran, they have unlimited budget and first call upon the best brains in the country."
It already has. It doesn't matter.
Stuxnet was VERY selective. It targeted only the S7 315 and 417 Programmable Logic Controllers (PLC). It looked for specific code blocks and data structures on those devices. You need to know that PLC applications code is usually custom written. It looked at the I/O networks and tried to find at least 33 instances of one of two models of a high speed motor drive. These are not ordinary Variable Frequency Drives. Had they come from the US, they'd be subject to export restrictions. The ones in use came from Finland and were also constructed locally in Iran.
Speaking as a control systems engineer, I don't know of any other massively parallel processes that involve many dozens (hundreds?) of high speed drives like this --other than Uranium enrichment. That's why the risk to other plants, including the Bushir nuclear reactor, are relatively small. The malware will install itself in the development workstations but it won't do much.
This is a good thing because had the malware been less selective, it would have done pretty much what you suggest. Most of you probably have little idea as to the extent and ubiquity of these PLC devices. The S7 PLC line is extremely popular and you'll find one in nearly half of all industrial settings around the world. If there were a malware that blindly attacked these devices, the world economy as we know it would take a massive change for the worse.
THAT is why nobody has done a broad based attack against PLC gear before. It will blow back on them. Once you realize what a PLC is and how widely it is used, you will also realize that an attack against this platform is the equivalent of a nuclear attack in the software world. In the case of a PC you only lose data. Most data can be restored. In this case, you lose an industrial process and it may be significantly damaged. An attack will almost certainly blow back on you and your neighbors. It will make the economic malaise of the present look tame by comparison.
Correction: The Siemens WinCC software had that password, as did the Step 7 development package. Siemens used it as some sort of idiotic way to validate licenses. That is why they were unable to tell anyone to change the password. It was hardwired everywhere. Note that this password was disclosed publicly in 2008, and yet Siemens did nothing to change the code.
The PLC did not have this password. The PLC was built on the assumption that those who have physical access to the unit have ultimate authority anyway (they can walk over to a motor control center and just turn a switch). In today's networked to everywhere situation, this looks foolishly quaint. However, back when these devices were designed, it was assumed that those who build these networks are doing all they can to block the traffic on to the office network.
Unfortunately, there are way too many office IT "experts" who think that because they know the office that they know the plant floor IT as well. They design the one great big network of everything and then use a VLAN to keep it apart. The VLAN gets bridged when some dreamy eyed idiot wants to surf the web and monitor the plant from the same box. And that's when things go downhill pretty fast. I speak from experience. If you do any form of office IT, you would be wise to pause and think before you post your ignorance for the world to see. If you have never done embedded computing, worked on a Programmable Logic Controller, or managed a real industrial process, there will be surprises in store for you. This is not just another app.
The Stuxnet PLC code was looking for something very specific. Current speculation leans toward the notion that this was aimed at the Uranium Enrichment facility in Natanz, Iran. However, there is only circumstantial evidence at best and the clues are awfully thin. Even if this is true, I doubt anyone will be confirming this story in our lifetimes.
One of the interesting aspects to targeting an S7 PLC platform is this: It is one of the most popular PLCs world wide. If someone were to install a back door timebomb that stopped this PLC cold, the world economy as we know it would collapse in a matter of weeks. There is a significant amount of high energy stuff based upon this PLC platform. Aim at more than one platform of PLC and the world as we know it could change overnight.
This is the Nuclear option of weaponized software. Anyone who launches an attack like this has very little concern for anyone but himself. That is why Stuxnet was probably so narrowly targeted at one facility. If they hadn't it would have blown back on the rest of the world.
The lesson learned from Stuxnet is that the response by the CERT agencies world wide was either bad or awful. Even today, Siemens have very little to say about how to remove the Stuxnet rootkit. They'll only remove the payload carrier. Gee. Thanks. It would have done that by itself eventually.
It took a business consultant like Ralph Langner to break open the first evidence of the nature of the PLC code. I was there at the ACS conference in DC when he gave his first presentation on the subject. Yes, there were rumors that INL was doing it too, but they never released their findings. DHS keeps stamping their work secret even when it would have been better not to.
We need to do better. The CERT groups need to step up to the plate and realize that there are other platforms besides the PC. Furthermore, they also need to realize how issues of functional and I/O validation fit in to the picture, and how safety is handled. This may be a simpler platform in many ways, but the social and safety issues that go along with it make financial information system designs look like child's play. At least you can restore the latter from a backup and nobody gets maimed or killed.
Welcome to my world...
If you want to know where the President, Vice President, or Speaker of the House will be before the news story breaks, just read the TFR NOTAMs from the FAA. To enforce the laws against flying in temporary flight restriction areas, they have to let the flying public know at least 24 hours in advance.
Notice that this NOTAM is only valid up to 39,000 Feet MSL (FL390). This may have been a big missile, but I doubt that it was headed for space. If it were, the NOTAM would have gone all the way to FL600 (the limit of enforceable airspace).
Actually, I know those problems quite well. As for size, while our SCADA system doesn't compete much with electric grid SCADA, it serves a utility among the top ten largest in the nation. Our secret is keeping the point count to the minimum needed to get the job done. Too many SCADA systems suffer from so much bloat that the people who use it every day have no idea exactly what its extent is or what the alarms might mean (sound familiar?).
Our system is not new. The original went online in 1988, and I was there when it happened. We did not have a clean sheet of paper by any stretch of imagination. I have kept our system up to date through a series of efforts. The reason we're in a state of the art system today is no accident, nor is it because we built it last year.
Our system is different. Although it has only one control center, we do have distributed backups at all of our six major plants. If the main control center fails or we have a massive network problem, whatever is left will be handled and dispatched by the plant staff. This is a concept that many utilities have not bothered to consider. We call it graceful degradation. There never will be a "backup control center." Everybody is a backup.
As for discussing things with National Labs, they take as many notes and hints from me as I do from them. It is a two way street. Many efforts from DHS and DOE are kept under wraps for security reasons. As a result, people on the front lines like me are often kept in the dark. I'd have more good things to say about national labs if we had better lines of communications.
And As For your last point, I have a saying: In SCADA, the most dangerous people on earth are probably drinking coffee with you every day.
There are people who talk about this stuff, and there are people who do it. I'll leave it to you to ponder which side I'm from.
This is Slashdot. There are many self styled experts here. Some know what they're talking about. Many do not. Tread with care.
I am a registered professional engineer with 25 years of experience integrating, fixing, and designing several generations of SCADA and plant control systems for a large water and sewer utility. I not only design and build these things, I live with my creations through the entire life-cycle. If it does anything unexpected, they call me; no matter how old it is. I have worked on every aspect from the field to the operations control center and every single detail in between. I am not just an engineer, I write software, including protocol drivers, embedded firmware, and system management scripts. I designed the networks we use and I often show our IT department some of the finer points of network design. I'm not a consultant. I'm not selling anything.
As with safety, just as there are no perfectly safe systems, there are no perfectly secure systems. We do not have testing procedures or magic text books that we can throw at this problem. However, for suggestions, I recommend ISA-99 or NIST SP 800, if you do any work on behalf of the Federal Government in the US. In particular, see NIST 800-82. I should warn you, NIST 800-82 is a smorgasbord of suggestions. I think if someone tried to implement all of these notions you'd have a nearly unusable system. At some point, you have to stop securifying and safetying everything and just educate staff what the risks are and what to look for.
If you're really trying to do SCADA, stay away from Modbus. While Modbus is a good DCS protocol, it is a poor SCADA protocol. Too many engineers still specify Modbus for SCADA because they know nothing else. DNP3 is an event oriented, near-real-time protocol. It is a far better SCADA protocol. If you don't understand the distinction, find a consulting engineer who can explain it to you. If your present consulting engineer has difficulty understanding this nuance, find another one. DNP has been in wide use in the electrical power industry in North American for over a decade. Water utilities in Australian and the UK are using DNP. It also has new features for secure authentication. See IEC 62351-5 for details.
On the other side, Office IT is not the same as a real time or near real time IT. I know of at least two books explaining this difference. If your IT staff do not understand that this application is truly different, find someone who does.
Understand that control engineering is a very broad field, embedded IT is a very broad field, and IT security is a very broad field. If you put the experts in the same room, make sure you define the problem for them very carefully. These fields tend to make prima-donna characters out of otherwise mild mannered people. I can guarantee a very heated argument after a short period of time and even a fist fight is not entirely out of the question. We do not have room for this kind of behavior.
The IT security people need to understand that while IT systems can be restored from backups, physical systems can not. They also need to understand that we do not spray patches at the field on a whim. We do not have broadband to a manhole in the middle of the street. And we use common carriers with extreme caution and evaluation. Likewise, the engineers need to stop thinking about building things and start thinking about how to break them. Too many engineers assume that nobody in their right mind would mess with their wonderful creations because it would clearly break something. That's like designing cars without considering what they'll do when they crash.
I suggest getting familiar with the various standards efforts. Also, I suggest keeping track of what is going on with SCADA security. Note some of the following
(Shameless plug alert)
I am a co founder of SCADASEC, an email list for SCADA and ICS security issues. I am also a member and contributor to the DNP3 and ISA-99 standards committees. These are many popular efforts. The NIST SP 80
Mod parent up. This idea is not as novel as the re discoverers would have you think. I attended a patented technology show with similar concepts in these engines back in the mid 1970s, and it wasn't even a particularly novel idea back then. Next on the resurrected idea list will probably be either a Wankel rotary engine or perhaps some variant of the infamous Dyna-cam engine.
Sometimes it is the IP/marketing that quashes an idea, sometimes it is the lack of need (low fuel prices), sometimes it is the sheer costs of changing all the manufacturing systems to build the new stuff. Sometimes, it's the costs of exotic materials. There are many reasons why an engine technology might not get adopted.
If we're lucky, perhaps this engine's time has come. And then again, maybe it's an unmaintainable nightmare. We'll have to buy a few to figure this out.
Agreed. In a broader application, Function Block Diagramming is one of the silliest features in IEC 611131 (the common interface specification for Programmable Logic Controllers). Not much better: Relay Ladder Logic diagrams. I know, this is heresy among many people who "believe" in this stuff.
I want my program text to appear in a concise, easy to read format. The logic in RLL requires too much scrolling and is simply too diffusely displayed on the screen. People who use this stuff often forget that someone with a laptop may be standing in front of the controller in the field, wondering why it is behaving the way it is. Having to scroll across many screens just to see a single line of logic doesn't help understand what the code is supposed to do.
A simple text based line of logic equations would be much easier to parse. However, old habits die hard on the plant floor. There is still this notion that real electricians will want to look at this code and that all those mysterious look-alike blocks with functions that range from timers to shift registers will be comprehensible to them.
Stick to ASCII. Stick to the stuff that everyone knows how to read. Displays and code can be made pretty with a good text editor, but the original software needs to comprehensible by mere mortals.
"Most legitimate political differences are a result of ..."
There. FTFY. There are many so-called differences that really amount to illegitimate concerns over how many angels will fit on the head of a pin.
The Journal of the American Water Works Association had a significant article this month dealing with the effects of fracking on watersheds. Those of you who think natural gas is clean have no concept of what drillers use to get the natural gas from shale in places such as New York state.
In fact, the regulations themselves are not aligned to balance these considerations in any way. Drilling rights are completely disconnected from watershed concerns.
Something needs to happen here... Over the shorter term, we'll need both the energy source and the clean water.
Over the longer term, we need better nuclear plant designs. The designs on the board right now leave much to be desired...
Read my sig. It explains everything.
Yes, they're incompetent. If they were really good they wouldn't stick around. Most places have a difficult time justifying the sorts of salaries that keep the good people on staff.
Look, the problem is that large organizations have often bought in to the notion that Human Resources knows what it's doing. They do not. They can not. I've watched this process in my own company. It's not pretty. It is a process designed by lawyer/MBA dweebs where success is almost always accidental.
The difference in your case is that people took the bull by the horns and attempted to resolve the problem. In a larger company, say 1000 employees or more, I can just about guarantee that you wouldn't get that kind of authority.
The State of Virginia was trying to outsource a process they did not fully understand. I don't care how you slice it, this is a recipe for disaster. You don't go to an attorney and ask them to fix your legal problems for you. You go to him or her with a clear plan of what you want to do, or you will end up with nothing but expenses and no end of trouble.
It's no different for IT. There has to be a clear sense of deliverable services and precise resources defined, or you'll get some crap weasel mess like what the state of Virginia got.
And to top it all off, the MBA crowd frequently deludes themselves in to thinking that this can be done without assistance of any sort. I hope these idiots learned their lesson.