Feeds

CIA claims crackers took out power grids

Future threat or urban myth in the making

5 things you didn’t know about cloud backup

Crackers have blackmailed foreign governments after disrupting the operating of utilities, according to a CIA analyst. Skeptics said the unspecified claims amount to nothing more than urban myths, although other sections of the security community are treating the possibility of attacks against Supervisory Control And Data Acquisition (SCADA) systems seriously.

SCADA systems lie at the heart of networks that control water, sewage and electricity systems. These devices allow utilities to remotely control and monitor generation equipment and substations over phone lines, radio links and, increasingly, IP networks.

Interconnection between SCADA environments and corporate networks introduce specific security needs around protocols and applications used that are not addressed by the majority of existing cyber security products. Existing standards are immature, and power systems have different requirements in terms of reliability and availability to corporate systems.

CIA senior analyst Tom Donahue told 300 delegates at a SANS Institute conference in New Orleans last week that utilities were being actively targeted in cyber attacks. Some of these attacks have been accompanied by subsequent blackmail attempts, a pattern first seen in the online gambling industry six or seven years ago. The level of knowledge applied in the attack suggests an internal attack.

"We have information, from multiple regions outside the United States, of cyber intrusions into utilities, followed by extortion demands. We suspect, but cannot confirm, that some of these attackers had the benefit of inside knowledge," Donahue said, according to a statement posted on the SANS web site. "We have information that cyber attacks have been used to disrupt power equipment in several regions outside the US. In at least one case, the disruption caused a power outage affecting multiple cities. We do not know who executed these attacks or why, but all involved intrusions through the internet," he added.

Delegates at the SANS conference shared data on how attackers are eluding current defenses and on best practices for mitigating vulnerabilities. They also shared a jointly developed "SCADA and Control Systems Survival Kit".

According to Donahue, the CIA only decided to make a (highly non-specific) warning about attacks on utilities after a period of internal soul searching. Some security watchers are highly skeptical about the claims, noting the irony that dire predictions of cyberattacks were made in a city that suffered the US's worst ever natural disaster.

Rob Rosenberger, Vmyths co-founder and scourge of cybersecurity fear-mongering, said the CIA had confirmed nothing. In an entertaining rant against SANS for treating unspecified reports of disruption seriously, he described the topic as the genesis of an urban myth.

Reports of successful cyberattacks on utility systems are thin on the ground. There is an Australian case, dating back more than seven years, where a disgruntled ex-employee, Vitek Boden, hacked into a water control system and flooded the grounds of a hotel with a million of gallons of sewage in March and April 2000. In Russia, malicious crackers managed to take control of a gas pipeline run by Gazprom for around 24 hours in 1999. Then there's a case where the Slammer worm affected the operation of the corporate network at Ohio's inactive Davis-Besse nuclear plant and disabled a safety monitoring system for nearly five hours in January 2003.

We've never heard of a "disruption (that) caused a power outage affecting multiple cities". That's not to say attacks against SCADA systems, which are increasingly connected to the net, are impossible or that the topic doesn't deserve careful analysis. The threat level, for now at least, remains at around the same level of the possibility of mobile malware taking down a phone network. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
JLaw, Kate Upton exposed in celeb nude pics hack
100 women victimised as Apple iCloud accounts reportedly popped
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.