Feeds

CIA claims crackers took out power grids

Future threat or urban myth in the making

Beginner's guide to SSL certificates

Crackers have blackmailed foreign governments after disrupting the operating of utilities, according to a CIA analyst. Skeptics said the unspecified claims amount to nothing more than urban myths, although other sections of the security community are treating the possibility of attacks against Supervisory Control And Data Acquisition (SCADA) systems seriously.

SCADA systems lie at the heart of networks that control water, sewage and electricity systems. These devices allow utilities to remotely control and monitor generation equipment and substations over phone lines, radio links and, increasingly, IP networks.

Interconnection between SCADA environments and corporate networks introduce specific security needs around protocols and applications used that are not addressed by the majority of existing cyber security products. Existing standards are immature, and power systems have different requirements in terms of reliability and availability to corporate systems.

CIA senior analyst Tom Donahue told 300 delegates at a SANS Institute conference in New Orleans last week that utilities were being actively targeted in cyber attacks. Some of these attacks have been accompanied by subsequent blackmail attempts, a pattern first seen in the online gambling industry six or seven years ago. The level of knowledge applied in the attack suggests an internal attack.

"We have information, from multiple regions outside the United States, of cyber intrusions into utilities, followed by extortion demands. We suspect, but cannot confirm, that some of these attackers had the benefit of inside knowledge," Donahue said, according to a statement posted on the SANS web site. "We have information that cyber attacks have been used to disrupt power equipment in several regions outside the US. In at least one case, the disruption caused a power outage affecting multiple cities. We do not know who executed these attacks or why, but all involved intrusions through the internet," he added.

Delegates at the SANS conference shared data on how attackers are eluding current defenses and on best practices for mitigating vulnerabilities. They also shared a jointly developed "SCADA and Control Systems Survival Kit".

According to Donahue, the CIA only decided to make a (highly non-specific) warning about attacks on utilities after a period of internal soul searching. Some security watchers are highly skeptical about the claims, noting the irony that dire predictions of cyberattacks were made in a city that suffered the US's worst ever natural disaster.

Rob Rosenberger, Vmyths co-founder and scourge of cybersecurity fear-mongering, said the CIA had confirmed nothing. In an entertaining rant against SANS for treating unspecified reports of disruption seriously, he described the topic as the genesis of an urban myth.

Reports of successful cyberattacks on utility systems are thin on the ground. There is an Australian case, dating back more than seven years, where a disgruntled ex-employee, Vitek Boden, hacked into a water control system and flooded the grounds of a hotel with a million of gallons of sewage in March and April 2000. In Russia, malicious crackers managed to take control of a gas pipeline run by Gazprom for around 24 hours in 1999. Then there's a case where the Slammer worm affected the operation of the corporate network at Ohio's inactive Davis-Besse nuclear plant and disabled a safety monitoring system for nearly five hours in January 2003.

We've never heard of a "disruption (that) caused a power outage affecting multiple cities". That's not to say attacks against SCADA systems, which are increasingly connected to the net, are impossible or that the topic doesn't deserve careful analysis. The threat level, for now at least, remains at around the same level of the possibility of mobile malware taking down a phone network. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.