Feeds

Chinese crackers blamed for US power blackouts

Lights go out, firewalls come tumbling down

The Power of One eBook: Top reasons to choose HP BladeSystem

Chinese hackers have been blamed for two sets of cyber attacks that left US homes without electricity in recent years.

Two blackouts in Florida and the Northeast were at least partially caused by Chinese crackers, computer security experts told the National Journal Magazine.

The magazine bases its claims principally on Tim Bennett, former president of the Cyber Security Industry Alliance, who said that US spooks told him back in 2003 that crackers working on behalf of the Chinese National Liberation Army had gained access to the network controlling power plants in the north eastern US.

This intrusion "may have precipitated" a power outage that affected large swathes of the US in August 2003. The blackout - which affected New York, Michigan, Ohio and parts of Canada - hit 50 million homes and was officially blamed on a cascading failure arising from a failure to deal with the outage of a set of high-voltage lines, which had a knock-on affect on around 100 power plants.

The spread of the Blaster worm at the time may have hampered communications, hampering efforts to fix the problem.

Bennett also blames a February blackout in south Florida that left three million homes without electricity on computer hackers. A second security consultant, speaking anonymously, said that the Florida hack was down to a Chinese PLA hacker who made a mistake while attempting to produce a map of Florida Power & Light’s systems. Power & Light blames an error by an engineer who disabled backup systems while making repairs on the outage. An official inquiry is ongoing.

Joel Brenner, the government’s senior counterintelligence official, was quizzed by the National Journal Magazine on the issue and said such attacks might be possible. Targeted Trojan attacks against senior executive and government officials in the West have been widely blamed on China, but attacks on utilities would be far more difficult to pull off.

Back in January CIA senior analyst Tom Donahue created controversy with claims that crackers have blackmailed foreign governments after disrupting the operating of utilities. Skeptics said the unspecified claims lack credibility, although other security experts subscribe to the possibility of attacks against Supervisory Control And Data Acquisition (SCADA) systems seriously.

SCADA systems lie at the heart of utility control networks. The devices allow utilities, such as electricity plants, to remotely control and monitor generation equipment and substations over phone lines, radio links and, in more and more cases, IP networks.

Interconnection between SCADA environments and corporate networks introduce new security risks that weren't so much of a concern in the previous era of closed control networks.

Reports of successful cyber attacks on utility systems are rare but not unprecedented.

Seven years ago a disgruntled ex-employee of an Australian hotel hacked into a water control system and swamped the grounds with sewage. In Russia, malicious crackers managed to take control of a gas pipeline for around a day in 1999. Closer to home, in the case of the latest US blackouts, the Slammer worm affected the corporate network at Ohio's inactive Davis-Besse nuclear plant and disabled a safety monitoring system for nearly five hours in January 2003. ®

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.