Feeds

Chinese crackers blamed for US power blackouts

Lights go out, firewalls come tumbling down

Securing Web Applications Made Simple and Scalable

Chinese hackers have been blamed for two sets of cyber attacks that left US homes without electricity in recent years.

Two blackouts in Florida and the Northeast were at least partially caused by Chinese crackers, computer security experts told the National Journal Magazine.

The magazine bases its claims principally on Tim Bennett, former president of the Cyber Security Industry Alliance, who said that US spooks told him back in 2003 that crackers working on behalf of the Chinese National Liberation Army had gained access to the network controlling power plants in the north eastern US.

This intrusion "may have precipitated" a power outage that affected large swathes of the US in August 2003. The blackout - which affected New York, Michigan, Ohio and parts of Canada - hit 50 million homes and was officially blamed on a cascading failure arising from a failure to deal with the outage of a set of high-voltage lines, which had a knock-on affect on around 100 power plants.

The spread of the Blaster worm at the time may have hampered communications, hampering efforts to fix the problem.

Bennett also blames a February blackout in south Florida that left three million homes without electricity on computer hackers. A second security consultant, speaking anonymously, said that the Florida hack was down to a Chinese PLA hacker who made a mistake while attempting to produce a map of Florida Power & Light’s systems. Power & Light blames an error by an engineer who disabled backup systems while making repairs on the outage. An official inquiry is ongoing.

Joel Brenner, the government’s senior counterintelligence official, was quizzed by the National Journal Magazine on the issue and said such attacks might be possible. Targeted Trojan attacks against senior executive and government officials in the West have been widely blamed on China, but attacks on utilities would be far more difficult to pull off.

Back in January CIA senior analyst Tom Donahue created controversy with claims that crackers have blackmailed foreign governments after disrupting the operating of utilities. Skeptics said the unspecified claims lack credibility, although other security experts subscribe to the possibility of attacks against Supervisory Control And Data Acquisition (SCADA) systems seriously.

SCADA systems lie at the heart of utility control networks. The devices allow utilities, such as electricity plants, to remotely control and monitor generation equipment and substations over phone lines, radio links and, in more and more cases, IP networks.

Interconnection between SCADA environments and corporate networks introduce new security risks that weren't so much of a concern in the previous era of closed control networks.

Reports of successful cyber attacks on utility systems are rare but not unprecedented.

Seven years ago a disgruntled ex-employee of an Australian hotel hacked into a water control system and swamped the grounds with sewage. In Russia, malicious crackers managed to take control of a gas pipeline for around a day in 1999. Closer to home, in the case of the latest US blackouts, the Slammer worm affected the corporate network at Ohio's inactive Davis-Besse nuclear plant and disabled a safety monitoring system for nearly five hours in January 2003. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.