Feeds

CIA claims crackers took out power grids

Future threat or urban myth in the making

Choosing a cloud hosting partner with confidence

Crackers have blackmailed foreign governments after disrupting the operating of utilities, according to a CIA analyst. Skeptics said the unspecified claims amount to nothing more than urban myths, although other sections of the security community are treating the possibility of attacks against Supervisory Control And Data Acquisition (SCADA) systems seriously.

SCADA systems lie at the heart of networks that control water, sewage and electricity systems. These devices allow utilities to remotely control and monitor generation equipment and substations over phone lines, radio links and, increasingly, IP networks.

Interconnection between SCADA environments and corporate networks introduce specific security needs around protocols and applications used that are not addressed by the majority of existing cyber security products. Existing standards are immature, and power systems have different requirements in terms of reliability and availability to corporate systems.

CIA senior analyst Tom Donahue told 300 delegates at a SANS Institute conference in New Orleans last week that utilities were being actively targeted in cyber attacks. Some of these attacks have been accompanied by subsequent blackmail attempts, a pattern first seen in the online gambling industry six or seven years ago. The level of knowledge applied in the attack suggests an internal attack.

"We have information, from multiple regions outside the United States, of cyber intrusions into utilities, followed by extortion demands. We suspect, but cannot confirm, that some of these attackers had the benefit of inside knowledge," Donahue said, according to a statement posted on the SANS web site. "We have information that cyber attacks have been used to disrupt power equipment in several regions outside the US. In at least one case, the disruption caused a power outage affecting multiple cities. We do not know who executed these attacks or why, but all involved intrusions through the internet," he added.

Delegates at the SANS conference shared data on how attackers are eluding current defenses and on best practices for mitigating vulnerabilities. They also shared a jointly developed "SCADA and Control Systems Survival Kit".

According to Donahue, the CIA only decided to make a (highly non-specific) warning about attacks on utilities after a period of internal soul searching. Some security watchers are highly skeptical about the claims, noting the irony that dire predictions of cyberattacks were made in a city that suffered the US's worst ever natural disaster.

Rob Rosenberger, Vmyths co-founder and scourge of cybersecurity fear-mongering, said the CIA had confirmed nothing. In an entertaining rant against SANS for treating unspecified reports of disruption seriously, he described the topic as the genesis of an urban myth.

Reports of successful cyberattacks on utility systems are thin on the ground. There is an Australian case, dating back more than seven years, where a disgruntled ex-employee, Vitek Boden, hacked into a water control system and flooded the grounds of a hotel with a million of gallons of sewage in March and April 2000. In Russia, malicious crackers managed to take control of a gas pipeline run by Gazprom for around 24 hours in 1999. Then there's a case where the Slammer worm affected the operation of the corporate network at Ohio's inactive Davis-Besse nuclear plant and disabled a safety monitoring system for nearly five hours in January 2003.

We've never heard of a "disruption (that) caused a power outage affecting multiple cities". That's not to say attacks against SCADA systems, which are increasingly connected to the net, are impossible or that the topic doesn't deserve careful analysis. The threat level, for now at least, remains at around the same level of the possibility of mobile malware taking down a phone network. ®

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
Carders punch holes through Staples
Investigation launched into East Coast stores
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.