Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Power Security

Hackers Have Infiltrated the US Power Grid's Control Networks (lasvegassun.com) 129

Posted by Soulskill from the solar-panels-make-excellent-stocking-stuffers dept.
davidwr writes: A security researcher and the Associated Press are reporting that hackers have infiltrated many of the United States' power grid networks. "About a dozen times in the last decade, sophisticated foreign hackers have gained enough remote access to control the operations networks that keep the lights on, according to top experts who spoke only on condition of anonymity due to the sensitive nature of the subject matter." Exfiltrated data included engineering plans and other non-public information that could aid an attacker later, as well as account credentials. Multiple companies were affected, but one of the more notable ones was the energy provider Calpine. "Circumstantial evidence such as snippets of Persian comments in the code helped investigators conclude that Iran was the source of the attacks. Calpine didn't know its information had been compromised until it was informed by Cylance, Kerr said."
This discussion has been archived. No new comments can be posted.

Hackers Have Infiltrated the US Power Grid's Control Networks More

Hackers Have Infiltrated the US Power Grid's Control Networks

Comments Filter:

  • I guess that's payback for the centrifuge hacks the US did on them.

    • Re:Karma is a bitch (Score:5, Interesting)

      by Rob MacDonald ( 3394145 ) on Monday December 21, 2015 @12:34PM (#51159717)
      The US? I think you mean Israel and the US. When we found Hebrew in the code it certainly didn't come from Jewish Israelis but when we find Persian in there it's definitely the Iranians.

      • Well, speaking of Israelis, they have a much longer history of spying, etc against the US than Iran. This story sounds more like regular war time propaganda

        • Well, speaking of Israelis, they have a much longer history of spying, etc against the US than Iran. This story sounds more like regular war time propaganda

          It is somewhere between highly unlikely and impossible for Israel to have a longer history of spying on the US than Iran. Iran has existed since long before the US came into existence whereas Israel only dates from the late 1940s, around 66 years. Iran has a 160 year head start, give or take. It seems pretty likely the Iranians (Persians) would have heard about the US Navy and Marine Corp fighting the Barbary states and would have had an interest.

          Are you just repeating anti-Israel/ant-Jewish propaganda y

          • "that people wouldn't sacrifice for their strongly held beliefs?"

            In an evolutionary context, why would people ever have beliefs strong enough they would die for them? Genes that contribute to such behavior should quickly vanish from the gene pool! But they clearly don't. The key to this is that the suicide bombers (or in times gone by tribal warriors) were not the only ones to carry the "die for the cause" genes. Their children did and if you work out the math, it turns out that genes for getting so wr

          • Please expand upon that. I'm curious as to what you think their motivation is if it isn't ideological in nature or based on their religious belief?

            Gee! You tell me [thedailybeast.com]! Abu Khaled, like other ISIS members, was paid $100 per month, in U.S. greenbacks, not Syrian lira, despite the latter being the coin of the realm in al-Bab. Currency exchange houses exist in the city where ISIS employees can take their salaries for conversion, although they scarcely need to, given the freebies that come with ISIS employment.

            "I rented a house, which was paid for by ISIS," Abu Khaled told me. "It cost $50 per month. They paid for the house, the electricity. Plus, I was marri

    • and all it takes is a nuke to really mess up the power gird.

    • Let me get this straight, you equate nuclear bomb production with civilian power generation?

  • Not too difficult (Score:5, Informative)

    by RobinH ( 124750 ) on Monday December 21, 2015 @12:39PM (#51159747) Homepage
    This isn't too difficult. A couple years ago you could go to Shodan, search for well-known industrial automation equipment providers like Phoenix Contact, and try to find their devices with embedded web servers that someone has connected to the internet. Start clicking on IP addresses. Make sure you don't mess with anything you find. One interesting find was some of the big windmill turbines with real-time monitoring and everything. People installing this stuff really don't understand what they're doing.

    • Re:Not too difficult (Score:5, Insightful)

      by khasim ( 1285 ) <brandioch.conner@gmail.com> on Monday December 21, 2015 @01:17PM (#51160041)

      That's one of the reasons why I'm having trouble believing TFA. There isn't much skill needed to crack most organizations I've seen.

      Anyway, from TFA:
      1. Guy working on thing for A notices that A has been cracked. ok
      2. Guy tracks crack back to open FTP servers. ok
      3. Guy finds lots of other stuff on open FTP servers. ok
      4. Guy does magic to find next time malware attacks someone. um, not ok

      Before Wallace could dive into the files, his first priority was to track where the hackers would strike next - and try to stop them.

      He started staying up nights, often jittery on Red Bull, to reverse-engineer malware. He waited to get pinged that the intruders were at it again.

      Months later, Wallace got the alert: From Internet Protocol addresses in Tehran, the hackers had deployed TinyZbot, a Trojan horse-style of software that the attackers used to gain backdoor access to their targets, log their keystrokes and take screen shots of their information. The hacking group, he would find, included members in the Netherlands, Canada, and the United Kingdom.

      So Iranian "hackers" in Canada deploy malware via Tehran servers?

      And unless he uploaded a hacked version of their malware to those cracked FTP servers ... how did he know?

      Maybe he moved one of his cracked machines to a "honey-net"?

      But then, why would any competent crackers deploy from servers in Iran? Particularly if they live in Canada and elsewhere?

      This reads more like fear-mongering. IRAN IS ATTACKING US! BE AFRAID! EVIL IRANIANS! (and some canadians).

      • Iranian "hackers" in Canada (Score:1)

        by Anonymous Coward

        Sure, blame it on the mooselims

      • I'd say by getting access to and monitoring the c&c servers. probably on an Irc channel.

      • That's one of the reasons why I'm having trouble believing TFA. There isn't much skill needed to crack most organizations I've seen.

        khasim, I find your thinking on this highly curious: It's easy to hack in there, so the Iranians didn't do it?

        Easy to hack critical infrastructure of a country that they call an enemy, one they have aided violent attacks against, ... and they wouldn't do this why? Do you think they just aren't looking, or are somehow insulted by the possibility of an easy and highly damaging attack as being beneath their honor?

        Why would it surprise you that someone engaging in hacking investigations wouldn't openly descr

    • One interesting find was some of the big windmill turbines with real-time monitoring and everything. People installing this stuff really don't understand what they're doing.

      "WINDMILLS SHOULD NOT WORK THAT WAY!!"

      • Re: (Score:2)

        by RobinH ( 124750 )
        Windmills do have a reasonable payback with government subsidies, so you can get capital to invest, but in most cases the purpose seems to be for someone with lots of money to be able to talk about his windmill farm at the country club, and if that's the case they need to be able to pull up the control panel on their iPhone to show their buddies.
  • Good morning, Slashdotters! We sure don't want your ambient fear level dropping (because your higher reasoning abilities might actually start functioning at 100% again if they do), so this is your Monday morning FUD report! See your tax dollars at work? Remember, you're here forever!
    .
    .
    .
    .
    .
    .
    *facepalm*
  • Anonymous so called "experts" and all these examples read like a plot from the TV show "24" lead me to a hypothesis that this story is complete and utter BS or more likely propaganda to increase some governmental budget that benefits from cyberwar funding.

    • Re: (Score:2, Interesting)

      by bobbied ( 2522392 )

      Anonymous so called "experts" and all these examples read like a plot from the TV show "24" lead me to a hypothesis that this story is complete and utter BS or more likely propaganda to increase some governmental budget that benefits from cyberwar funding.

      This is EXACTLY what this is.

      Power companies may have exposed some of their automation equipment inadvertently, but in general they totally understand the risks here and are taking steps to be careful. They usually don't use internet control to stuff anyway, given the internet's propensity to not be operational when there are power issues. I'd bet that some monitoring happens over internet connectivity, but I'll be willing to bet this is behind reasonable levels of encryption and it doesn't really matte

      • Re:I call BS. (Score:5, Informative)

        by angel'o'sphere ( 80593 ) <angelo.schneider ... e ['oom' in gap]> on Monday December 21, 2015 @01:30PM (#51160163) Journal

        You are wrong on all regard and have no clue what the 'internet' is.

        given the internet's propensity to not be operational when there are power issues
        As long as the power plants run, the IP networks connected to it run. If there is any rest of the internet alive is irrelevant.

        Power companies may have exposed some of their automation equipment inadvertently, but in general they totally understand the risks here and are taking steps to be careful.
        Yes an no, in general the traffic is simply not routed into the public internet.

        but I'll be willing to bet this is behind reasonable levels of encryption and it doesn't really matter to the safe operation of the system, only the efficient operation of it.
        And you would lose that bet.

        The internet, at least locally, is not very reliable so the power distributors have their own networks and back channel routes they use to manage their distribution networks.
        No idea what you mean with reliable. Yes, they have their own communication lines. They power them themselves and have fallback power. They run them on IP, or TCP/IP or on propriety protocols. They are connected to the companies WAN usually, but usually not routed into the public internet.
        They are mostly not used to control, but to monitor. Power plants and the connections to transportation grids are run _mannually_ like on a Carrier where there is a captain, there is dispatcher on a power plant. However one dispatcher might control several plants, so he has those under remote control and is steering them with IP protocols.
        The machinery that connects a plant to a grid, is controlled from plant side. Usually on a manual command given at that side. There is usually no way at all to disconnect a plant remotely from a grid. Or to connect it to another one.
        The information that at a certain time the plant should change its output or its grid connection might be sent via internet technologies, the execution is done manually, and trust me: the people doing that usually have enough clue to know if such an 'order' makes sense (or not).

        • Re: (Score:1)

          by Anonymous Coward

          They are mostly not used to control, but to monitor. Power plants and the connections to transportation grids are run _mannually_ like on a Carrier where there is a captain, there is dispatcher on a power plant.

          Remember that falsifying monitoring data is sufficient to cause human actors to make some really bad decisions, which the "manual control" will do nothing to mitigate.

        • I think you read my post wrong.

          My perspective of what the power companies are doing with their data networks pretty much matches what you describe for communications. They do not depend on "Internet" (i.e. public network) connections for their operations and in the rare instance they do, it's likely over encrypted VPN links.

          Your picture of how power dispatch is done is pretty messed up though. There are two aspects to this, power generation and power distribution. Power generation is usually controlled

          • Oh, you read me wrong to then ...

            Your picture of how power dispatch is done is pretty messed up though.
            No it is not ;D

            There are two aspects to this, power generation and power distribution. Power generation is usually controlled by a pre-arranged plan which is adjusted throughout the day to fine tune capacity to match demand when necessary for economic reasons. Communication of this information can go by all sorts of means, even a phone call, but in reality everybody kind of knows what's going on and in t

            • The prearranged plan is not only for generation, it is also for distribution, it is called a "grid schedule".

              Touche'

              But you'd have to admit that in order to cause the grid to become unstable enough over a large area you are going to need to come up with a multiple point attack. You are going to need to take targeted distribution lines out of service and/or trip some plants off line in some coordinated way that you know will generate some cascade failure that happens in a way the automation cannot save the grid and humans don't have time to react. This is going to be pretty tough to accomplish from a computer sc

        • Re:I call BS. (Score:5, Interesting)

          by dave562 ( 969951 ) on Monday December 21, 2015 @03:57PM (#51161263) Journal

          This aligns with the one system that I was involved in setting up. A former client of mine was running (and probably still runs as far as I know) a couple of power plants in Central California. The control systems were built by Honeywell. For a small, single turbine plant there were 5 servers. 2 masters, 2 slaves / reporting servers and 1 witness.

          Both masters, 1 slave and the witness server were on a private network without internet access. 1 slave was in the DMZ with a uni-directional connection from the secondary master that wrote out reporting data. There was a VPN connection (over satellite because the plants were out in the middle of no where farm country) back to the company's main office. The VPN connected the company office to the DMZ and the reporting server so that people in the main office could see the output of the plant.

          Nothing in the setup allowed settings to be changed over the internet. Everything within the plant was run on a dedicated IP network that was air gaped from the internet. The only server that was connected to the firewall was the slave / reporting server. It had 2 NICs. So I suppose in fantasy crazy TV land, someone could have hacked the firewall, hopped into the DMZ, compromised the slave and jumped into the control server where they would have been able to... do nothing, because it was the redundant server that would only have been active if the primary failed.

          Keep in mind I set that network up in 2005 for a small, single turbine power plant that generated power by burning green waste (yard trimmings, etc.) I think it is reasonable to assume that 'real' power plants that power thousands of homes and businesses are at least as secure. In my situation, Honeywell told me how to do it. I did not make it up. The vendor had the solution, I was just there to handle the network and VPN.

        • I mostly agree with what you are saying, but as a simple example of 3MW diesel gensets, say a paralleled bus of 12x3MW, that happens to be controlled via Ethernet for sync and paralleling. If the switches are not properly secured then you end up with the ability to lockout all the generators. (Sadly, this particular major manufacturer does not have backup sync and start controls.)

          The most common protective relay on the market is another interesting example-- while they are much better in understanding sec

      • Re: (Score:2)

        by Puls4r ( 724907 )
        You are 100% wrong.

        A great majority of manufacturing systems that live in power plants are built on old platforms. Windows 3.1 and Windows XP abound. These systems are widely connected by standard ethernet connections to information systems that the engineers monitor. These reside on servers that are hooked to the same network as the IP phone systems, all directly linked by fiber-optic lines to the internet.

        In other words, you have a bunch of horribly outdated non-virus / malware protected systems

        • dunno 'bout that... Win 3.1 machines are unlikely to have the toolset necessary for modern viruses to run. Security through obsolescence!

          (yes I'm being sarcastic)

        • Oh sure, you might bring down a manufacturing plant, maybe two, but you are NOT bringing down the country's electric grid by doing this.

          The electric grid has multiple redundancy and even if you can hack in and touch something, it's not going to do anything of importance to the grid. It's like some vandal with a can of spray paint. You can make a mess, but that's about it.

          Bringing the electric grid down is going to take a pretty complex set of actions for the prospective hacker. They will have to disrupt

          • There are a lot of scary terms they don't understand, like "rolling equity"

            You are wrong.

            It is pretty easy to take down the whole grid. You only have to attack something the grid can not balance out ...

            If you are interested send me an email ;D I'm not giving free hints to idiots/terrorists ... however I guess if one is interested in that stuff he only needs a short brain storming to figure how to do it.

            • Not easy under normal circumstances. The grid is designed to be redundant and an attacker is going to need to attack at multiple points to make much of a dent. Yea, a lucky attacker might be able to bring down a small town's grid, but nothing major is going to happen.

              Of course, if the grid is already under stress, and the attacker knows it, then they might be able to push it over the cliff, but there is no real way to know that kind of stuff unless you are hooked in to a lot more places than the electric

      • Don't believe it's secure. The nukes have protection and data diodes, but we have some dumbass cyber engineers. I was formerly in the nuke industry where the senior cyber engineer failed to recognize a phishing email sent out by corporate to weed out the people who were warned not to click everything.

        • Re: I call BS. (Score:4, Interesting)

          by bobbied ( 2522392 ) on Monday December 21, 2015 @04:08PM (#51161373)

          Now that's an interesting test idea... Send out your own phishing E-mails and see who clicked on them..

          Personally, where I work, all external attachments are removed from any inbound Emails and all attachments from inside are scanned before they are allowed to be sent. Also, all web browsing happens within an isolated virtual machine that is hard coded to only transit corporate's proxy/filters regardless of if you are inside or outside the network. The way you transfer stuff is though an external file transfer server that requires that you login and encrypts the data in transit. It too is able to scan just about everything... Pain in the butt, but effective.

          I'm all for trusting folks to do the right thing and train them what that is, but I'm also for making sure they cannot do anything stupid if there is a reasonable way to prevent it.

          • Now that's an interesting test idea... Send out your own phishing E-mails and see who clicked on them..

            Our InfoSec department tried doing that in house. It became quite a game among the programming staff to have the most fun with it. The phishing link went to an internal application that logged the information. The application was totally insecure and hilarity ensued.

    • ...or more likely propaganda to increase some governmental budget that benefits from cyberwar funding

      ...or more likely propaganda to increase some military/industrial/security contractor's budget that benefits from cyberwar funding

      FTFY

  • I wonder (Score:4, Insightful)

    by sgrover ( 1167171 ) on Monday December 21, 2015 @12:43PM (#51159789) Homepage

    putting on my skeptical hat here to consider alternate views. One could easily wonder about the "anonymous" nature of this disclosure and how the message is about instilling fear. Who profits? It would be easy to conclude that this is a propaganda release with the aim of softening up the sheeple's perspective to allow for increased budget expenses, or even direct action at the supposed culprits. Blaming a nation-state on flimsy evidence such as what language was used suggests a preconception being reinforced by circumstancial tidbits. Afterall, there can't ever be anyone else in the world that speaks that language, perhaps even within one of the superpowers known to be fairly multicultural. Or those who hirer foreign workers. Yep, a sceptic would be wary of reports like this - even if the infiltration is 100% true.

    • Re:I wonder (Score:5, Interesting)

      by swb ( 14022 ) on Monday December 21, 2015 @12:56PM (#51159883)

      One of my questions is, if it could be penetrated so deeply, why hasn't the grid been fucked over by someone by now?

      Is it that the "control networks" are less vulnerable than they're made out to be, and that as it turns out a telnet session from someplace isn't enough to actually do any serious sabotage?

      The "hackers" involved lack the know-how and expertise to do anything serious (maybe combined with it being hard to use these networks to do anything serious)?

      $evil_nations are putting this in their back pocket for some later date when they really need it, like when El Presidente Cruz decides to start carpet bombing Iran over nuclear agreement issues or something. This seems compelling, but then again, all security vulnerabilities seem to have something of a shelf-life -- old equipment eventually gets replaced, software ultimately gets updated, networks change, etc -- the hack you thought you have may not be there when you need it, so why wait to hit the button?

      • Re: (Score:2, Informative)

        by Anonymous Coward

        One of my questions is, if it could be penetrated so deeply, why hasn't the grid been fucked over by someone by now?

        Enron already did.

        Made billions for themselves.

      • There are a whole lot easer ways to bring down the grid than hack your way in if you can access it physically (IE you have somebody on the ground, or some way to work your mischief.) All it really takes is a little bit of coordination and planning and looking at the power distribution network topology and some 2nd year undergraduate electrical engineering knowledge.

        Why all the cloak and dagger stuff? BECAUSE, it's political.

        That's right, this is about some rumblings I've been hearing about the dangers o

        • Re: (Score:2)

          by swb ( 14022 )

          There are a whole lot easer ways to bring down the grid than hack your way in if you can access it physically (IE you have somebody on the ground, or some way to work your mischief.) All it really takes is a little bit of coordination and planning and looking at the power distribution network topology and some 2nd year undergraduate electrical engineering knowledge.

          Yeah, but a remote hack has the potential to break the grid on a scale that makes the effect nation wide. A physical hack on a single substation seems much less likely to have more than a regional impact, and getting a larger impact would require a lot more than just a little bit of coordination and planning.

          • No remote attack is going to be able to have the same affect, even from a sophisticated enemy state who had the resources to launch one. Trust me, you are going to have to disrupt the system at multiple points in a coordinated way no matter what way you do this and that's a hard task to accomplish when all you have is some IP addresses where you don't really know how they interact or are interconnected. You might be able to disrupt a couple of things, but you won't be able to really do serious damage to t

            • Re: (Score:2)

              by plover ( 150551 )

              You seem to keep repeating variations on "the attackers don't know enough to make an effective attack." But getting information is one thing that they're actually really good at. Once any black hat breaches a system, the first step is creating a reverse access hole, but the next step in the attack is recon. Figure out what you've gotten into. Find the important servers, like domain controllers, DNS servers, Exchange servers, web servers, etc. Search for documents describing the good stuff; servers, net

              • No, that's not the only thing I'm saying..

                The power grid is largely redundant, built so parts can fail and the whole keeps working. This makes the attacker's job more difficult. You cannot just break into your local substation, push a few buttons and bring down the grid, you have to mount a coordinated attack at multiple points. To be successful, you have to have a good idea what you are doing (a working plan), in addition to having enough access to grid components to carry out your plan.

                So, I'm not sa

                • Re: (Score:2)

                  by plover ( 150551 )

                  Remember the Northeast blackout of 2003? [wikipedia.org] A single failure on the grid, starting with incorrect load data during a heavy demand day (aka SCADA reporting failures), which caused a peak load generating plant in Eastlake, Ohio to shut itself down. The lack of power caused higher than allowable demand on Ohio's existing transmission lines, causing some of them to sag into trees where the safety systems automatically shut them down. This larger outage resulted in higher demand, so more sets of lines sagged into

                  • Knowing where to push and when then becomes the problem for the hacker. Unless you know what the configuration and power flow is right NOW, you are going to be poking around in the dark while the lights stay on everywhere. You might bring parts of the grid down, but not all of it. The blackout you mentioned is about the extent of the damage a determined hacker *might* be able to cause, but they are going to have to understand more about the system and it's configuration than the operators do, then have a

          • Moreover, the remote hack can be designed to impact systems when an externality occurs rather than just causing one at will. That can often have a much larger impact on a target.

    • Thank you! Whenever they declare "anonymous sources" they are usually bullcrap specialists out to do no-good!
  • Comment removed based on user account deletion

    • Because China is a morale compass for all of us to follow.

      • Re: (Score:1)

        by sehlat ( 180760 )

        No. China is not a moral compass. But the approach has virtues even corporatists will appreciate.

        If corporations are truly people, with human rights, they are also subject to demands that they meet human responsibilities, including taking reasonable care for the safety and lives of others (not just corporations, btw).

        "I'll believe corporations are people when Texas executes one."

        • "I'll believe corporations are people when Texas executes one."

          Well, they've "executed" (shut down) more than one school district since the turn of the century. Does that make school districts people?

          Don't worry, the kids and school buildings (and taxing authority) all got merged into a neighboring school district.

        • It will be nice to see a ceo be forced to pay back there bonus and if they do not contempt of court after a few days in jail they will pay it back.

      • Because China is a morale compass for all of us to follow.

        Funny "morale" vs. "moral"...

        While they are *certainly* a bad *moral* compass, it would certainly improve my *morale* if idiots like this were shot...

        • I'm French. I tend to make mistakes like that. Thanks for the correction. Very appreciated.

          • I'm French. I tend to make mistakes like that. Thanks for the correction. Very appreciated.

            Which means you are probably better at cooking with morel than I am... ;^)

    • Re: (Score:2)

      by Tablizer ( 95088 )

      Stop going after the company and go directly after the people that chose to cut corners

      Smart slimebags don't leave a trail. They may give a verbal order over the phone or in person, for example, so that there is no email or document trail.

      Or ignore warnings, and then later claim that they never saw it or didn't understand it when interrogated. They won't explicitly say "no". The worse you can get them on is incompetence or "light" negligence, which is usually not a criminal offense.

  • Comment removed (Score:4, Interesting)

    by account_deleted ( 4530225 ) on Monday December 21, 2015 @12:50PM (#51159837)
    Comment removed based on user account deletion

  • Utilities are like consumer router manufacturers. They don't give a shit about security and they don't even try.

  • !!!

    Do you realize what this means? ISIS could be in your power lines radicalizing your toaster right now and you'd never even know it until your toast started catching fire!

    • Re: (Score:1)

      by Tablizer ( 95088 )

      If they attacked Comcast, nobody would know the difference.

    • ISIS could be in your power lines radicalizing your toaster right now and you'd never even know it until your toast started catching fire!

      Too late. My Toaster has already had the microaggression update installed.

  • There's no reason to have critical infrastructure attached to the Internet. Also don't allow any "maintenance" via a USB thumb drive.

  • >> Hackers Have Infiltrated the US Power Grid's Control Networks
    That's wrong.
    it should read : "Power Grid's Control Networks are very weak security-wise, and everybody can go in on the front door, not only in the US."

  • top experts who spoke only on condition of anonymity due to the sensitive nature of the subject matter. . .

    Why are they anonymous? What are they afraid of? Are they stinking traitor scum?

    We've been hearing this ever since the CIA within the CIA hired top assassins (Jean Souetre, Moise Maschkivitzin, Lazlo the Hungarian and the CIA's own, Lucien Conein) to murder President Kennedy.

    If it is true, then "they" should come forward and declare who they are, otherwise STFU, spineless, cowardly traitor

  • Air gap. Learn it, live it, love it.

  • If the SCADA systems are freaking ON THE INTERNET then the executives need to be put in jail and all their family assets taken and treated as terrorists.

    Only the worlds most incompetent would put ANY SCADA system on the internet with any access ability. Private point to point networks with encrypted tunneling on those private point to points.

    Oh that is expensive? WAHHHHH. suck it up.

    • If the SCADA systems are freaking ON THE INTERNET then the executives need to be put in jail and all their family assets taken and treated as terrorists.

      I find your thoughts about the constitution to be very compelling, and would like to subscribe to your newsletter.

      Also, would you agree that people on the no-fly list, no matter how they got on it, should be deprived of their constitutionally protected rights without any sort of due process? I thought you would! Please feature your praise of that scenario in your next newsletter, and be sure I get a copy in my new subscription.

  • A big advantage of decentralization is that mass disruption is hard to pull off. http://www.rmi.org/reinventing... [rmi.org]

    • A big advantage of decentralization is that mass disruption is hard to pull off. http://www.rmi.org/reinventing... [rmi.org]

      And on August 10, 1996, a failure of one high-voltage power line caused a cascade failure that took out power to seven western US states, two Canadian provinces, and parts of Baja California. People think that to have a big effect an attacker would need to take out a lot of points, but a small number of strategic hits, perhaps as small as one, can do a very disproportionate amount of damage.

  • One thing that is clear is that capitalism is incompatible with computer security*. In lieu of a massive regulatory overhaul that won't happen, we should be switching to independent self-sustainable systems. Therefore, people should switch to using solar panels with battery backup for power because they are both independent and self-sustainable. For those who do not have the space to do so, you will remain at the mercy of the power grid until you get the space.

    * Capitalism is about making money. Making

  • Am I completely naive in thinking that critical systems like this shouldn't have a link to the public internet? I know it may be expensive to build out your own network, but it seems worth it. I

    • Re: (Score:2)

      by cfalcon ( 779563 )

      It's surprising how only governments seem wiling to make truly airgapped networks the norm, but I'd imagine SOME utilities do- just not all of them?

    • Re: (Score:2)

      by AHuxley ( 892839 )
      To totally get rid of union workers on different sites over a network or state, region, then only have a few computer experts looking over a wider network.
      The idea was sold as a way to remove low and mid level human workers and then just have a smaller count of needed, per law experts to look after huge networks. Different teams could then drive out as needed, when needed.
      The pro part for the shareholders is the reduction in union workers, cost savings and better understanding of faults.
      The down side

  • The bottom line is that if the US wages war on ANY medium or large country, we should expect infrastructure outages and perhaps sabotage. That's probably the same for all countries. There are surely gaps lurking about ready to be exploited.

    Buy a good book to read when everything electric is out. A month supply of food and water could also come in handy. If you are in bigger city; and power, traffic signals, trains, truck ignition systems, etc. start goofin' up, it will take a while to get enough basic suppl

  • Now, this was four years ago, so it might be a lot better now; but I worked for an RF smart metering firm and their security and authentication was appallingly bad. The problem with the free market and new technology is that the incentive just isn't there to do it right the first time when you can do it wrong and still get sales (and then require the users to buy a replacement product later on). We had some large purchases of our products (think home meters for half the the biggest state in the US as one of
  • In his recent book "Lights Out" [tedkoppellightsout.com] Ted Koppel (of ABC news "Nightline" fame) lays out in pretty good detail how and why he and others believe this is the case. Read it. And consider preparing for it.
  • There's only one solution: Congress will have to pass a law that makes it mandatory for Homeland Security to bug our household smart meters.

Slashdot Top Deals

news: gotcha

Close