Navigation

Experts hack power grid in no time

Submitted by Anonymous on Wed, 04/09/2008 - 11:24am

Why in the world power control computers need to have Internet connectivity is beyond me. With the low price of desktops today, systems controlling power plants and the grid should be single-function machines on isolated/private networks. If power plant employees need Internet access to do their jobs, then those systems should be physically different and isolated from the control desktops. Seems a lot cheaper than trying to secure critical systems from hackers.

Click to read the article this is in response to.

Permalink
Read more about:

SCADA

Submitted by Anon on Wed, 04/09/2008 - 11:26am.

What is the reasoning behind having Internet access at all in these locations?

At least having physically separated networks with separate computers.

Segmentation implies they are still physically and logically connected, for a SCADA site that is just not enough.

The DHS should spend more time and effort and budget on separate computers and networks then worrying about a fence between Mexico or the H-1B laws.

Reasons for interconnecting SCADA

Submitted by Anonymous (not verified) on Wed, 04/09/2008 - 1:05pm.

SCADA Systems collect a large volume of very useful data and provide many tools for conveniently reviewing and analysing those data. Individuals whose job involves system planning, customer engineering, and system protection (e.g. relay settings for breakers) need these data. It is possible (I have done so) to leverage the SCADA data to create a fairly complete external database and user interface that is adequately firewalled from the SCADA system, and thereby avoid creating vulnerabilities. (Two different penetration tests have demonstrated this.) Unfortunately, vendors are just catching on to security, and are only starting to provide this. Unfortunately, at least so far, what is offered is essentially un-auditable (short of an expensive code review). Things are slowly getting better, but many utilities are still using older software, and will only spend the money to cure this as the new FERC Cyber Security Standards come into enforcement over the next few years. Indeed, there may still be regulators who see cyber security as an unnecessary waste of customer's money. (Much of the utility industry is still regulated.)

My opinions are mine only and do not represent the opinions of my employer, who also shall remain anonymous.

and thats y you are not the

Submitted by Anonymous (not verified) on Thu, 04/10/2008 - 12:59pm.

and thats y you are not the decision maker....

are they logged in as Administrator?

Submitted by Tomasz Chmielewski (not verified) on Sun, 04/13/2008 - 3:02am.

I wouldn't be too surprised if they were logged in as Administrator while browsing the internet on these systems controlling power plants...

Because most all of the government entities (NERC, FERC) as well

Submitted by Anon on Wed, 04/09/2008 - 11:57am.

Because most all of the government entities (NERC, FERC) as well as the regional entities (PJM, CALISO, MISO) do their business over the internet...

anti-phishing feature in Opera browser?

Submitted by Anon on Wed, 04/09/2008 - 9:13pm.

While this is an interesting article, and having physically separate systems would be an obvious solution...I noticed that no mention was made what what OS, what browser, etc...

Simply having a secure, advanced, ACID3-compliant browser, like Opera v9.5 on Windows, Mac, Linux, that includes a cool Fraud Protection anti-phishing feature would solve the social engineering attack. PowerCo employee clicks on a phishing email, they get a warning in Opera, and are diverted.

End of attack.

Maybe I'm missing something.

yeeah, you do. Opera 9.5 is

Submitted by Anonymous (not verified) on Thu, 04/10/2008 - 4:42am.

yeeah, you do. Opera 9.5 is still in beta.

Using Opera on an unpatched

Submitted by Anonymous (not verified) on Thu, 04/10/2008 - 5:48am.

Using Opera on an unpatched Windows box will not solve the problem. (google "opera vulnerabilities") Should we bet the integrity of our infrastructure on the security of any browser and thoughtfulness of that user?
IMHO the S.C.A.D.A. networks need to be completely unaccessible from the Internet, otherwise one networked Computer with a browser could easily bypass all firewalls and potentially bring the SCADA network down.
Apparently in a mater of hours. Scary Man!

They dont

Submitted by Anon on Thu, 04/10/2008 - 3:26am.

We do the same time of work for pretty much every large energy company and are SCADA systems which have all been properly segmented and have been since the mid 90's. They dont have any internet access, and are almost always on a physically segmented network. I'm not sure if what company he was working on was foreign, or just a tiny power plant not the large ones. Seems pretty bogus to me.