samadhisoft.com

• This is a scary article.  And reading it, you might be forgiven if you think this is something new and that our government’s security folks will be all over soon to quash it.
• But,in fact, it is not new.  Not hardly.  The United State’s power structures have been under attack by foreign hackers and very likely compromised for sometime now.
• Compromised how?  And how badly, you say?
• Well, first they are compromised primarily because the Internet and the power grid networks involved are just simply too much and too complicated. The number of people who really understand technical stuff at this level are few. And the need to have our power infrastructure all up and running all the time is intense. We have thousands of facilities, thousands of people working in the industry and God only knows how many software vendors have written packages to help make it all run and sold the packages to the industry. Just think of how little you, your friends and your neighbors (and virtually all the people you know) really know about computers and networks and you’ll begin to see how few are protecting so many from so much.
• And how badly are we compromised?
• Well, you’ll have to read the article to get some idea of how badly we’re compromised – but know this:  this is not new.  Here’s a link to an article I posted back in April of 2009 – on this same subject.  You might read it first and then read the new article and see if you think ‘the government’s security folks will be all over [this situation] soon to quash it’.
• Here’s a few quotes from the new article to get your juices flowing:
•  
  • “The hackers have gained access to an aging, outdated power system. Many of the substations and equipment that move power across the U.S. are decrepit and were never built with network security in mind; hooking the plants up to the Internet over the last decade has given hackers new backdoors in.”
  • “Last year, Homeland Security released several maps that showed a virtual hit list of critical infrastructure, including two substations in the San Francisco Bay area, water and gas pipelines and a refinery. And according to a previously reported study by the Federal Energy Regulatory Commission, a coordinated attack on just nine critical power stations could cause a coast-to-coast blackout that could last months, far longer than the one that plunged the Northeast into darkness in 2003.”
• dennis

= = = = = = = = = = = = = = = = = = = = = = =

Iranian hackers breached the control system of a dam near New York City in 2013, and are also implicated in some of a dozen attacks that have infiltrated the U.S. power grid system in the last decade, say two separate reports.

The reports by the Wall Street Journal and the Associated Press both raise concerns about the security of the country’s aging infrastructure.

Two people familiar with the dam breach told the Wall Street Journal it occurred at the Bowman Avenue Dam in Rye, New York. The small structure about 20 miles from New York City is used for flood control.

The hackers gained access to the dam through a cellular modem, the Journal said, citing an unclassified Department of Homeland Security summary of the incident that did not specify the type of infrastructure.

The breach came as hackers linked to the Iranian government were attacking U.S. bank websites after American spies damaged an Iranian nuclear facility with the Stuxnet computer worm.

Homeland Security spokesman S.Y. Lee would not confirm the breach to Reuters. He said the department’s 24-hour cybersecurity information-sharing hub and an emergency response team coordinate responses to threats to and vulnerabilities in critical infrastructure.

Meanwhile, about a dozen times in the last decade, sophisticated foreign hackers have gained enough remote access to control the operations networks that keep the lights on, according to top experts who spoke only on condition of anonymity due to the sensitive nature of the subject matter, the Associated Press found.

Security researcher Brian Wallace was on the trail of hackers who had snatched a California university’s housing files when he stumbled into one example: Cyberattackers had opened a pathway into the networks running the United States power grid.

Digital clues pointed to Iranian hackers. And Wallace found that they had already taken passwords, as well as engineering drawings of dozens of power plants, at least one with the title “Mission Critical.”

The drawings were so detailed that experts say skilled attackers could have used them, along with other tools and malicious code, to knock out electricity flowing to millions of homes.

The attack targeted Calpine Corp., a power producer with 82 plants operating in 18 states and Canada — it has one plant in Courtright, Ont. The hacking software appeared to originate in Iran, but the hacking group included members in the Netherlands, Canada, and the United Kingdom.

Wallace was astonished. But this breach, The Associated Press has found, was not unique.

Capability to strike at will

These intrusions have not caused the kind of cascading blackouts that are feared by the intelligence community. But so many attackers have stowed away in the systems that run the U.S. electric grid that experts say they likely have the capability to strike at will.

The hackers have gained access to an aging, outdated power system. Many of the substations and equipment that move power across the U.S. are decrepit and were never built with network security in mind; hooking the plants up to the Internet over the last decade has given hackers new backdoors in.

Distant wind farms, home solar panels, smart meters and other networked devices must be remotely monitored and controlled, which opens up the broader system to fresh points of attack. Hundreds of contractors sell software and equipment to energy companies, and attackers have successfully used those outside companies as a way to get inside networks tied to the grid.

• More: ➡