Forgot your password?

typodupeerror
Government Power Security United States Politics

Chinese Researcher Says US Power Grid Is Vulnerable, Strategist Overreacts 203

Posted by Soulskill
from the what-color-is-his-hat dept.
An anonymous reader writes with a story about Wang Jianwei, a grad student in China who recently released a paper detailing a vulnerability in the US power grid. Despite the paper being rather typical for security research, its origin set off alarm bells for military strategist Larry M. Wortzel, who testified before Congress that the student was a threat, despite the fact that the published attack wasn't really feasible. Quoting: "'We usually say "attack" so you can see what would happen,' [Wang] said. 'My emphasis is on how you can protect this. My goal is to find a solution to make the network safer and better protected.' And independent American scientists who read his paper said it was true: Mr. Wang's work was a conventional technical exercise that in no way could be used to take down a power grid. The difference between Mr. Wang's explanation and Mr. Wortzel’s conclusion is of more than academic interest. It shows that in an atmosphere already charged with hostility between the United States and China over cybersecurity issues, including large-scale attacks on computer networks, even a misunderstanding has the potential to escalate tension and set off an overreaction. 'Already people are interpreting this as demonstrating some kind of interest that China would have in disrupting the US power grid,' said Nart Villeneuve, a researcher with the SecDev Group, an Ottawa-based cybersecurity research and consulting group."
This discussion has been archived. No new comments can be posted.

Chinese Researcher Says US Power Grid Is Vulnerable, Strategist Overreacts

Comments Filter:
  • by simp (25997) on Sunday March 21 2010, @09:28AM (#31557082)

    If you want to build a power grid in country X right now, take a look at the vendors that supply the products. Then take a look a the vendors that supplied the products 10 or 20 years ago. The same dozen or so of vendors supply all the equipment from control room automation to the actual hardware to make and distribute power to everybody everywhere in the world.
    If the US power grid can be hacked then so can most other power grids because you will find the same equipment and software over and over again.
    It's a bit like the good old MAD during the cold war: sure you can hack my power grid, but I can also hack yours...

  • by mim (535591) on Sunday March 21 2010, @10:16AM (#31557342)
    This is much more likely... http://www.foxnews.com/story/0,2933,478024,00.html [foxnews.com] (yeah, it's fox, but includes some relevant links)
  • Re:Couldn't Happen (Score:5, Informative)

    by girlintraining (1395911) on Sunday March 21 2010, @10:23AM (#31557386)

    The biggest mistake he made in his paper was the assumption that Homer still works at Springfield Nuclear Power Plant. Clearly China is several seasons behind in their 'research'.

    The biggest mistake we made was that we actually still have Montgomery Burns running our power plants, and people like him running our national infrastructure. Which was this guy's point: There is in fact a systemic flaw in capitalism -- adding security decreases profitability, therefore security is rarely focused on even in applications that are critical to a country's well-being. The soviets published a report in the mid 80s detailing key areas in our national infastructure that lack redundant power pathways. If about 5% of our infrastructure were destroyed in key areas, about 45% of the grid would be inoperable.

    That's simply unacceptable.

  • by Neoprofin (871029) <neoprofin@h o t m a il.com> on Sunday March 21 2010, @10:50AM (#31557554)

    Maybe the Chinese universities would be happy to take him, let him do his research and publish his stuff.

    I understand that you didn't read the article, no one ever does, but to not read the summary? He's a Chinese Grad student at a Chinese university. They already let him do his research and publish his findings. The reason he didn't do it on China's grid is that they wont provide him with any data.

  • by Animats (122034) on Sunday March 21 2010, @12:39PM (#31558192) Homepage

    It's a worry. Power grids use the Internet extensively. Since "deregulation", generating companies and distribution companies are separate businesses, and the generating companies compete with each other. The generating companies make bids, the distribution companies buy from the bids, and the grid operator (a neutral party) keeps the players connected and runs the market. Bear in mind that these systems don't have much excess generating capacity. 12-20% excess capacity during peak periods is typical. For a good overview of how this works, see Background on Generation Control [acrobat.com], an online training course from PJM, the biggest grid operator in the world.

    Most of the communication between the various players takes place over the Internet. The bid handling is done on machines connected to the Internet and many of the applications involved are Windows-based. The execution of a power buy involves the transfer of a set of switching decisions from the bid-handling machines to the machines which actually have control over generation and transmission equipment.

    Details of the PJM Dispatcher Application and Reporting Tool [isomou.com] are available. This is the main way generation companies and the dispatch center communicate. The user interface is Flash in a browser [pjm.com]. Bid and buy information is shipped around as XML. [pjm.com]

    If the Internet-based apps go down, they revert to "conservative operation" and stop trying to optimize the economics. All generation facilities, even high cost peaking plants, crank up to at least standby power levels, in case they're needed. Export of power to outside the control area in trouble is stopped. Coordination is over the "all call", a squawk box system, and satellite phones. Worst case, everybody backs down to a preplanned schedule of what they're supposed to be doing at each hour of the day. In this mode, millions of dollars per hour are being lost, but the grid can probably be kept up.

    One worry is insertion of bad data into the bid system via the Internet. The California ISO had outages in the early part of the last decade when energy traders put bids into the system which resulted in transmission congestion, forcing the CAISO to buy more expensive power. Back then, California had an energy auction every half hour. That was an extreme of deregulation. Now, the grid manager has more authority; generating companies put up data which offers price/quantity curves as bids, the grid operator takes them in increasing order of cost, and "energy traders" like Enron are no longer involved in hour by hour decisions. So there's more stability in the system.

    Internet-based attacks against the control systems are also a worry. There definitely are connections to the external Internet. PJM seems to be using XML, in well-defined formats, to pass data across that boundary. They're not dumb. The problem is making sure that there aren't unwanted connections somewhere amongst the hundreds of different companies which connect to the control side of the system.

    It's interesting that PJM doesn't rely on "security through obscurity". Hundreds of thousands of people have to know how this works. So they put the manuals, training materials, and live operational data [pjm.com] on the Internet. (Right now, there's a problem near the West Virgina/Ohio border.)

  • by Reziac (43301) * on Sunday March 21 2010, @01:47PM (#31558622) Homepage Journal

    [goes off, looks it up]
    http://archive.newsmax.com/archives/articles/2005/10/20/172811.shtml [newsmax.com] seems to be a good overview. I get the point, anyway.

    I'm also reminded of the old not-quite-a-joke:

    The mission is to steal sand from an American beach.

    The Soviet Union sends a stealth submarine, which disgorges a camo'd scuba dude who swims up to the beach in the middle of the night, grabs some sand, and swims away.

    Red China sends a million tourists to the beach.

  • Re:Couldn't Happen (Score:3, Informative)

    by shutdown -p now (807394) on Sunday March 21 2010, @02:46PM (#31559030) Journal

    We didn't beat them financially. They imploded with a coup de etat.

    Huh? The only successful coup d'etat was in 1993 (when there was no USSR anymore), when Yeltsin dissolved the commie parliament. The one before it in 1991 was hardline commies trying to oust Gorbachev, and it wasn't successful.

    Regardless of which one you're referring to, the country was gutted long before either one of them.

  • Re:Couldn't Happen (Score:2, Informative)

    by Securityemo (1407943) on Sunday March 21 2010, @03:00PM (#31559142) Journal
    You go back in time and tell that to the political prisoners in the gulags. Russia was hell under communism. Why was there corruption? Because the system didn't work at all. Now, as a Swede I can firmly give a reasoned and experienced backing of extensive socialist policies apparently considered "extreme" in the US, but don't confuse that for "communism".
  • by bunratty (545641) on Sunday March 21 2010, @05:33PM (#31560428)
    What cherrypicking are you talking about? There is a consensus on AGW, with most climate studies showing AGW is happening and none showing AGW is not [norvig.com]. That's why 97% of active climatologists agree that AGW is happening [cnn.com]. I'm sure some climatology studies have been debunked -- there are several studies in physics that have been debunked in recent years, yet strangely I haven't heard anyone saying that physicists shouldn't be taken seriously.

What soon grows old? Gratitude. -- Aristotle

Working...