http://beforeitsnews.com/survival/2013/10/alert-fbi-investigating-threats-to-midwest-water-supply-systems-2494092.html
http://bits.blogs.nytimes.com/2013/10/18/electrical-grid-called-vulnerable-to-power-shutdown/?_r=5&
http://beforeitsnews.com/survival/2013/10/natgeos-american-blackout-examines-u-s-without-power-2494076.html
The Associated Press reports that the FBI and other agencies are in the process of investigating multiple threats to Midwest Water Supply Systems. Specifically, the FBI has named Wichita, Kansas as a target, but utility facilities have also been put on alert in other Midwestern cities.
The U.S. Federal Bureau of Investigation learned of the threats in the past two days and has contacted the water supply facilities and law enforcement offices for the municipalities, said Bridget Patton, a spokeswoman for the FBI office in Kansas City, Missouri.
Patton declined to discuss the nature of the threats or the number of cities affected. She said investigators had been sent out in response to the reports, but offered no details.
“We were made aware of the threat,” Patton said. “We have not been able to substantiate any of the threats.”
Wichita city officials warned employees in emails to be on guard for suspicious activities. City officials also told residents the water is safe to drink and the public will be notified immediately if this changes.
Wichita Police Lieutenant Doug Nolte said Friday that the city had taken steps to keep the city’s water supply safe, but would not describe what measures had been taken.
The Wichita water utility plants serve about 500,000 people, but many millions may be affected should systems in multiple Midwest cities fail or come under attack simultaneously.
In 2011 cyber security McAfee issued a warning titled In the Dark: Crucial Industries Confront Cyberattacks, in which they noted that all critical infrastructure systems connected to the internetcould be compromised by rogue attacks resulting in shutdowns or malfunctions.
The sectors on which this report focuses — power, oil, gas, and water — may well be the first targets for a serious cyberattack.
What we found is that they are not ready. The professionals charged with protecting these systems report that the threat has accelerated — but the response has not. Cyberexploits and attacks are already widespread. Whether it is cybercriminals engaged in theft or extortion, or foreign governments preparing sophisticated exploits like Stuxnet, cyberattackers have targeted critical infrastructure.
In the case of water utilities, if hackers were to take control of the computers that maintain safe water levels and chemical treatment they could potentially poison the water supplies of millions. In such a case people could go to sleep like any normal night, wake up in the morning and have a glass of water, and be poisoned by any number of chemical or biological agents that have been released into the water supplies.
Hackers have already broken into water utility computer systems recently, despite assurances that the systems are safe. In November of 2011 a Stuxnet-style virus infected the physical components of the Springfield, Illinois water utility plant and shut down water pumps, demonstrating that not only can systems be infiltrated from outside of protected networks, but that the physical equipment can be overtaken.
But it’s not just the computer systems. There is a woeful disregard for perimeter security in and around critial infrastructure assets around the United States, including water plants.
Security around national water reservoirs may not be as safe as we thought:
In a time where people talk all the time about droughts, 21 year old Josh Seater has cost the city of Portland Oregon 8 million gallons of drinking water.While TSA gaterapes grannies in diapers at our local airports and steams ahead on expanding enhanced pat-downs and searches to all public venues including train stations, sporting events and malls, the real security holes are completely ignored.
After a night on the town, a heavily intoxicated Seater began urinating a water reservoir. “I didn’t know it was a water supply, otherwise I wouldn’t have done it, I thought it was a sewage plant”.
The cost of Josh’s drunken behavior has cost the Portland Water Bureau $36,000, as the 8 million gallons have had to be completely drained away.
With so many billions of dollars being spent on homeland security, Americans have been left with a false sense of security. The government tells us they are protecting us, and most people simply take this at face value.
In reality, even if the government was efficiently deploying its resources for effectively securing critical infrastructure, the fact is that nothing can ever be 100% secure. This is evidenced by recent comments from outgoing Homeland Security Secretary Janet Napolitano, who warned that a widespread cyber attack on our national power grid and other infrastructure is not only guaranteed, but imminent.
In previous comments, Napolitano, along with the Federal Emergency Management Agency, has advised Americans to stockpile at least two (2) weeks of essential supplies, including food and fresh drinking water, citing concerns that emergency responders could be overwhelmed in the event of a widespread emergency.
Failure to prepare for short and long-term disaster could be deadly. Most Americans have about three days worth of food supplies and almost no reserve water supplies or methods for filtering water should the water supply be compromised.
As we saw with Hurricane Sandy, any disruptions to the normal flow of supplies or commerce would lead to a breakdown within 72 hours as those affected struggle to acquire limited resources.
Electrical Grid Is Called Vulnerable to Power Shutdown
By NICOLE PERLROTH
Stuart Isett for The New York Times
Over the past few months, the discoveries of two engineers have led to a steady trickle of alarms from the Department of Homeland Security concerning a threat to the nation’s power grid. Yet hardly anyone has noticed.
The advisories concern vulnerabilities in the communication protocol used by power and water utilities to remotely monitor control stations around the country. Using those vulnerabilities, an attacker at a single, unmanned power substation could inflict a widespread power outage.
Still, the two engineers who discovered the vulnerability say little is being done.
Adam Crain and Chris Sistrunk do not specialize in security. The engineers say they hardly qualify as security researchers. But seven months ago, Mr. Crain wrote software to look for defects in an open-source software program. The program targeted a very specific communications protocol called DNP3, which is predominantly used by electric and water companies, and plays a crucial role in so-called S.C.A.D.A. (supervisory control and data acquisition) systems. Utility companies use S.C.A.D.A. systems to monitor far-flung power stations from a control center, in part because it allows them to remotely diagnose problems rather than wait for a technician to physically drive out to a station and fix it.
Mr. Crain ran his security test on his open-source DNP3 program and didn’t find anything wrong. Frustrated, he tested a third-party vendor’s program to make sure his software was working. The first program he targeted belonged to Triangle MicroWorks, a Raleigh, North Carolina based company that sells source code to large vendors of S.C.A.D.A. systems. It broke instantly.
Mr. Crain called Mr. Sistrunk, an electrical engineer, to see if he could help Mr. Crain test his program on other systems.
“When Adam told me he broke Triangle, I worried everything else was broken,” said Mr. Sistrunk.
Over the course of one week last April, the two tested Mr. Crain’s software across 16 vendors’ systems. They did not find a single system they couldn’t break.
By the end of the week, the two had compiled a 20-page report replete with vulnerabilities in 16 different system vendors for the Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team, I.C.S.-C.E.R.T., which notifies vendors of vulnerabilities and issues public advisories.
And then, they waited. It would take I.C.S.-C.E.R.T. another four months to issue a public advisory for Triangle MicroWorks’ system.
Triangle MicroWorks’ engineering manager Greg Godlevski said that during those four months, the company developed a number of its own tests to look for defects in its software and fix them. Mr. Godlevski said the company waited for confirmation from Mr. Crain that the problem had been fixed, then met with I.C.S.-C.E.R.T. several times to review and comment on the government advisory.
“We take any reported problems discovered in our products very seriously,” Mr. Godlevski said. “We expend a lot of effort adding levels of security to our protocols and ensuring that they comply to the published specifications.”
D.H.S. did not return a request for comment.
Over the course of those four months, Mr. Crain and Mr. Sistrunk found vulnerabilities in an additional nine vendors’ systems.
Like most security alerts, there are some caveats to this concern for the safety of electric facilities: Mr. Peterson’s company, Digital Bond, sells consulting services to assess and improve the security of S.C.A.D.A. systems.
Mr. Crain also has an interest. In March, he plans to release a free version of his security test, but for now he is charging vendors to use his program. (Mr. Crain would not disclose pricing, since it differed for each vendor based on vendor size, saying only that he charged in the “thousands” though he said he charged far less than commercial services like WurldTech Security, which charges tens of thousands of dollars for similar programs.)
“We haven’t found anything we haven’t broken yet,” Mr. Crain said in an interview. At minimum, the two discovered that they could freeze, or crash, the software that monitors a substation, thereby blinding control center operators from the power grid. Mr. Crain likened that capability to “a bank robber being in a bank vault with the camera frozen.”
In the case of one vendor, Mr. Crain found that he could actually infiltrate a power station’s control center from afar. An attacker could use that capability to insert malware to take over the system, and like Stuxnet, the computer worm that took out 20 percent of Iran’s centrifuges, inflict actual physical harm.
“This is low-hanging fruit,” said Mr. Crain. “It doesn’t require some kind of hacker mastermind to understand the protocol and do this.”
What makes the vulnerabilities particularly troubling, experts say, is that traditional firewalls are ill-equipped to stop them. “When the master crashes it can no longer monitor or control any and all of the substations,” said Dale Peterson, a former N.S.A. employee who founded Digital Bond, a security firm that focuses on infrastructure. “There is no way to stop this with a firewall and other perimeter security device today. You have to let DNP3 responses through.”
Even more troubling, Mr. Peterson said, is that most DNP3 communications aren’t regulated. The original version of DNP3 worked on serial communications — a way of transmitting data usually found in things like coaxial cables — and is still widely deployed in large systems, particularly substations around the country. But current cybersecurity regulations, governed by the North American Electric Reliability Corporation’s (N.E.R.C.) Critical Infrastructure Protection Committee (C.I.P.C.) are focused on Internet Protocols, or I.P. protocols, and specifically exclude serial communications and the equipment that uses them from meeting any security requirements.
“Why isn’t D.H.S., N.E.R.C., and the DNP3 committee telling vendors they need to fix this now and utility owners they need to get this patched A.S.A.P.?” Mr. Peterson said.
To date, D.H.S. has posted nine advisories, several of them for software used by major players in the electric sector.
“This is a systemic problem,” Mr. Crain said. “Most of the top five utilities use this software and just because a patch is available, doesn’t necessarily mean that utilities are applying them.”
What would you do if the world suddenly went dark?
That is exactly what NatGeo’s original movie American Blackout – which premieres Sunday, Oct. 27, seeks to discover. The power grid collapses following a cyber attack, forcing the nation into an immediate crisis. Although the man-made disaster lasts just 10 days, civil unrest, economic turmoil and a horrific amount of deaths still occur.
The National Geographic movie is extremely timely. As previously reported by Off The Grid News, the first ever nationwide power grid down drill will take place on Nov. 13-14.
American Blackout director Jonathan Rudd stated during a Q&A session for the media that a cyber attack was specifically chosen as the power grid disabler because such a scenario is no longer science fiction. As the Department of Homeland Security (DHS) reported earlier this year, the United States experienced a 68 percent increase in “cyber incidents” at federal agencies during 2012. The DHS also warned that a cyber activity increase in America appears to include Middle Eastern nations such as Iran.
Rudd also said:
“The research drove the narrative. This film is obviously a drama, but we were determined to be as informed as possible and we spent countless hours trying to get it right.
Source: http://www.offthegridnews.com/2013/10/18/natgeos-american-blackout-examines-us-without-power/
Source: http://www.offthegridnews.com/2013/10/18/natgeos-american-blackout-examines-us-without-power/
http://thecommonsenseshow.com/2013/10/15/personal-preparation-for-grid-ex-ii/
No comments:
Post a Comment