Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Hackers Broke Into Brazil Power Grid Operator's Website Last Thursday

kdawson posted more than 4 years ago | from the wolf-no-really-this-time-i-mean-it dept.

Security 85

An anonymous reader writes "A week ago, 60 Minutes had a story (we picked it up too) claiming that hackers had caused power outages in Brazil. While this assertion is now believed to be in error, hackers were inspired by the story actually to do what was claimed. Last Thursday, they broke into ONS, the operator of the grid (Google translation; Portuguese original). DarkReading has specific details on the SQL injection vulnerabilities the hackers probably used."

cancel ×

85 comments

Sorry! There are no comments related to the filter you selected.

full disclosure (1, Insightful)

sopssa (1498795) | more than 4 years ago | (#30137212)

And, two days after the blackout, the systems analyst Maycon Vitali, 23, revealed in the blog "Hack'n'roll" to a login page of the ONS revealed error in the validation data. The flaw could allow a hacker to send command to the database and find sensitive data from ONS.

The failure was published in the newspaper Folha de S. Paulo on Monday (16).

This is exactly why full disclosure is not good.

Re:full disclosure (5, Insightful)

mr exploiter (1452969) | more than 4 years ago | (#30137676)

And, two days after the blackout, the systems analyst Maycon Vitali, 23, revealed in the blog "Hack'n'roll" to a login page of the ONS revealed error in the validation data. The flaw could allow a hacker to send command to the database and find sensitive data from ONS.

The failure was published in the newspaper Folha de S. Paulo on Monday (16).

This is exactly why full disclosure is not good.

How so? If two days after the vulnerabilty was exploited causing millions of dollars of damage they *still* don't fix it, then the public has the right to know how much the security of the systems sucks. It may be the only way to prevent this from happening again.

Re:full disclosure (2, Insightful)

Runaway1956 (1322357) | more than 4 years ago | (#30138504)

Agreed. Sometimes the only way to motivate people to fix a problem is to embarrass them in public. FFS, no part of any critical operation should ever be exposed to the internet, period. If is't sensitive, keep it isolated from everyone - including your billing departement, public relations, sales, and even the company officers. Whenever they need to see something sensitive, they can pick their lead arses up, and move to an office dedicated to the internal workings of the company. When they are ready to put on their happy power hats, and interface with the world, they can return to their own office.

Re:full disclosure (5, Informative)

mitoyarzun (1428713) | more than 4 years ago | (#30138830)

Here in Chile a guy reported the government about a serious bug on their outsourcing website (chilecompra.cl), they ignored him for months, and he made the bug public (you were able to know your competition's offer to the government just by changing a GET parameter).

He was condemned by a court for breaking the law, more info here [fayerwayer.com] (spanish)

What kind of action should one take in those cases? Has this happened before in other countries?

Re:full disclosure (1, Interesting)

Anonymous Coward | more than 4 years ago | (#30139288)

What kind of action? Leave the country, then report it. Any government that paranoid of a situation such as you describe is up to something.

Re:full disclosure (1)

linuxpyro (680927) | more than 4 years ago | (#30144864)

Sounds to me like they screwed up, and now they're covering themselves. It sounds much better if they can say some nasty hacker brought the problem to their attention by trying to break in, as opposed to it being shown that they ignored an innocent guy who was willing to help them for months. Never attribute to malice what can be explained by stupidity (I think that's the quote). Or in this case laziness.

This seems like the way a lot of people would react, so you're probably right that getting out of the country is the best way to be safe.

Re:full disclosure (1)

hesaigo999ca (786966) | more than 4 years ago | (#30142638)

Instead of coming forward after having made this bug aware and seen no activity in months, obviously making sure the first time to point out possible solutions to the case to make repairs quick and easy, I would have posted it in the underground and let the rest of the script kiddies do their job...this would have been done under a new assumed log on name and done from within a internet cafe where I had never been before...also make sure that cafe has no internal cameras, and pay for the service in cash.

Unfortunately we live in the day and age of people are just stupid, and think they have a right to be stupid, and will bring you to court to be able to stay stupid....just my way of thinking.

Re:full disclosure (1)

fulldecent (598482) | more than 4 years ago | (#30143006)

I may have run into this exact situation in US government websites. Also, I have found many other serious bugs in financial websites. I document some on my blog [blogspot.com] , but I am seeking advice on how to handle, and monetize my future findings.

The last time I found a large bug at a large online trading account (with a pink logo), I gave up the bug, and signed an NDA. They barely fixed the problem and they didn't listen to my other advice. When the FBI got involved... well, let's just say it is interesting what they focus their efforts on.

I'm am sure I will find these bugs in the future. How do I turn security disclosures into advice that will be heeded and consulting fees?

Re:full disclosure (0)

Anonymous Coward | more than 4 years ago | (#30140720)

What you get here is a system developed by the lowest bidder. Do you really think they would have the money to have a separate isolated system?

Lowest bidder = Cheapest system

It might serve you well, or it might not.

Re:full disclosure (0)

Anonymous Coward | more than 4 years ago | (#30142854)

FFS, no part of any critical operation should ever be exposed to the internet, period.

It isn't. The website got hacked, but there's nothing important there. At least nothing important to the operation of the electrical grid. The network they use to monitor and control the system isn't connected to the internet.

Re:full disclosure (3, Insightful)

cosm (1072588) | more than 4 years ago | (#30137816)

Seriously? You must work for the government..

Your solution: Hide or pretend the vulnerability doesn't exist, or ignore the possible ramifications of its exploitation and further promote shoddy programming practices.
The better solution: Make the vulnerability public so that the company is forced to do something about it immediately, hence preventing any threats (pending their programming practices improving).

Full disclosure puts the responcibility on the company to keep their products/services secure, as to keeping it a secret, which puts the burden on whistleblowers fearing prosecution.

Which world do you prefer?

Re:full disclosure (1, Informative)

Anonymous Coward | more than 4 years ago | (#30138168)

Uh oh, best watch out or the Anti-Sec will destroy you... hahaha.

Oh i bet those kiddos will be all over this story.
Hey there AS, how'ya doin? You want some candy?

Re:full disclosure (1)

Khyber (864651) | more than 4 years ago | (#30141862)

Anti-Sec couldn't hack their way into a Menuet box if they had physical access.

Fucking script kiddies.

Re:full disclosure (1)

kalirion (728907) | more than 4 years ago | (#30145282)

Hey everybody, I found a big red button that will blow up the world! I'm going to make its location public so that the governments are forced to fix this little vulnerability.

Re:full disclosure (0)

Anonymous Coward | more than 4 years ago | (#30139648)

No, full disclosure is a good thing, it keeps people on their toes.

This is why having a computer that controls power grids connected to the internet is not good.

Re:full disclosure (1)

n0tWorthy (796556) | more than 4 years ago | (#30145760)

Anyone that knows anything about the utility systems (power, water, gas, sewer) knows they are run by the most insecure systems out there. There have been reports of SCADA vulnerabilities for years (GOOGLE it yourself) and many concerns expressed (http://www.darkreading.com/blog/archives/2009/04/scada_security.html).

Once someone can get out of a compromised system and onto a utilities internal SCADA network they have total control. The best place to practice is on a relatively insecure 2nd or 3rd world network where there are few legal consequences to hacking. Once the skills are honed up and scripts can be written to control large numbers of SCADA systems at once the real fun can begin. This is one of the major objectives of terrorists (http://www.pbs.org/wgbh/pages/frontline/shows/cyberwar/vulnerable/scada.html).

actually (5, Informative)

Anonymous Coward | more than 4 years ago | (#30137270)

the hackers invaded the _website_, the ONS network of computers that actually control the system is private and not connect to the internet.

Re:actually (3, Interesting)

TubeSteak (669689) | more than 4 years ago | (#30137908)

the hackers invaded the _website_, the ONS network of computers that actually control the system is private and not connect to the internet.

They may not have hacked the power grid, but TFA says the website has all kinds of fun docs which, I'm assuming, any smart hacker would go after in order to study up on their target.

Never forget that the next best thing to an insider is the freakin' manual.

Re:actually (1, Informative)

Anonymous Coward | more than 4 years ago | (#30141908)

If your security consists of hiding the manual... You're doing it wrong.

Re:actually (0)

Anonymous Coward | more than 4 years ago | (#30143012)

Yeah, lots of fun docs. You can download detailed maps of the grid with lots of interesting stuff, like capacities of power plants and transmission lines and so on. In the USA this stuff may be considered sensitive due to concerns about national security, but in Brazil they put that kind of information freely available on their website for anyone to see, no hacking required.

Re:actually (0)

Anonymous Coward | more than 4 years ago | (#30138272)

the hackers invaded the _website_, the ONS network of computers that actually control the system is private and not connect to the internet.

what you can expect from kdawson? dont even bother.

Re:actually (1)

fluffy99 (870997) | more than 4 years ago | (#30139538)

It's a whole different ballgame if they are using vlans to isolate the control network. Then a hacker just has to penetrate a router or take advantage of poor vlan isolation in some switches. Plus, you're bound to have at least a few employees who just have to have their machine connected to both networks at the same time and think using two network cards is safe.

closed systems (2, Funny)

Haxx (314221) | more than 4 years ago | (#30137298)

  One would think critical power networks would be close systems.

Re:closed systems (4, Informative)

John Hasler (414242) | more than 4 years ago | (#30137566)

> One would think critical power networks would be close systems.

Read the article. What was broken into was the "corporate network" of the organization that runs the system. The control system was not broken into and in fact appears to be protected by an air gap.

Re:closed systems (1)

TubeSteak (669689) | more than 4 years ago | (#30137960)

The control system was not broken into and in fact appears to be protected by an air gap.

AFAIK, no country has a power grid whose network is airgapped.
Even worse, almost everyone is using very old dial-up systems somewhere in their network.
Their only security is "do you know the phone number"

Considering that the hackers got a bunch of manuals off the website,
I'm guessing they now have those phone numbers.

Re:closed systems (0)

Anonymous Coward | more than 4 years ago | (#30142768)

AFAIK, no country has a power grid whose network is airgapped.

It might have been that way 10 years ago, because a few companies hooked up the two systems, but the way they are designed are to be separate systems.

You might want to learn a little bit more I suggest Critical Infrastructure Protection (CIP):

http://www.nerc.com/page.php?cid=2|20

Re:closed systems (1)

Tellarin (444097) | more than 4 years ago | (#30138206)

What was broken into was the website of the organization that runs the system.

Re:closed systems (1)

L4t3r4lu5 (1216702) | more than 4 years ago | (#30141576)

Of course! And no employee on an internal system has ever:
  • Installed their own wireless access point to get internet access
  • Dicked about with patch leads to "fix the network"
  • Ever done anything which can well and truly render useless any security system put in place (Hamachi / Tor installation?)

Air gaps are only good if it's not air at all, but brick.

Re:closed systems (4, Informative)

nametaken (610866) | more than 4 years ago | (#30137576)

FTA...

"ONS was notified last week of this problem. They've confirmed that, indeed, its Website was hacked. It claims to have fixed the SQL injection problems and that there was no danger because there was no connection between its Website network and back-end control network."

Re:closed systems (1)

twoDigitIq (1352643) | more than 4 years ago | (#30138354)

I work in IT at an energy company whose systems are tightly integrated with "the grid" and I can testify that someone with the right knowledge (or even someone well versed in the art of social engineering) could wreak havoc on the power lines here in the U.S.

Really.... (3, Insightful)

Darkness404 (1287218) | more than 4 years ago | (#30137340)

Really -no- critical system be it power, heating, cooling, etc. should be on the internet. A local network is sufficient with the main computer controlling the other computers not being connected to the internet. How hard is it to understand?

Re:Really.... (1)

MichaelSmith (789609) | more than 4 years ago | (#30137434)

Maybe they just got into the company web site or billing system.

But even so imagine that the operator of the system wants to save $$$ by outsourcing maintenance to Indian or Chinese companies. They would have to get in with a VPN. If the tradeoff is between money and security, money wins.

Re:Really.... (1)

maxume (22995) | more than 4 years ago | (#30137524)

When it comes to security, the trade off is always between money and security.

Re:Really.... (-1, Troll)

Anonymous Coward | more than 4 years ago | (#30137764)

No, the tradeoff is between using OpenBSD or being a fucktard.

Too often, being a fucktard is seen as more important, and thus OpenBSD isn't used.

Re:Really.... (1)

John Hasler (414242) | more than 4 years ago | (#30137610)

> Maybe they just got into the company web site or billing system.

That would appear to be the case.

> If the tradeoff is between money and security, money wins.

Not when security failures cost real money.

Re:Really.... (1)

stuckinphp (1598797) | more than 4 years ago | (#30137900)

>> If the tradeoff is between money and security, money wins. >Not when security failures cost real money. /facepalm

Re:Really.... (0, Redundant)

stuckinphp (1598797) | more than 4 years ago | (#30137916)

damn you slashdot.
stop
stripping
newlines

Re:Really.... (2, Informative)

Procasinator (1173621) | more than 4 years ago | (#30141326)

Go to Options and change Comment Post Mode to Plain Old Text.

That will take care of the newlines (inserting <br /> tags for newlines).

Re:Really.... (3, Informative)

nametaken (610866) | more than 4 years ago | (#30137594)

They were not. Read the article.

"there was no danger because there was no connection between its Website network and back-end control network"

Re:Really.... (4, Insightful)

Itninja (937614) | more than 4 years ago | (#30137642)

Keeping a few connected computers off the larger WAN is easy enough. But as those computer grow in number it can become more difficult to prevent someone, somewhere from opening up ssh, ftp, rdp, or some other connection-type. Then the whole LAN becomes susceptible to the evils of WAN baddies.

And don't even get me started on the lack of physical security on 'secure' systems. If you can touch it, it's insecure.

Re:Really.... (1)

thethibs (882667) | more than 4 years ago | (#30138814)

Perhaps you want to think this through again?

How can ssh connect two isolated networks? Linux software is pretty powerful, but I don't think it extends to stringing wire and installing routers.

Re:Really.... (1)

supernova_hq (1014429) | more than 4 years ago | (#30139236)

Depends what hardware it's running on :D

Re:Really.... (3, Interesting)

Itninja (937614) | more than 4 years ago | (#30139672)

I've seen this happen. An engineer needed to get some files from his laptop to a Linux server. Since the server was not on the WAN he decided to use a USB drive, which was fine. Except that what he inserted was not a USB drive, but a USB wireless adaptor (he didn't know that). He spent over an house trying to get the 'drive' to work and then (for reasons unknown to me) left the adaptor in the server...maybe he forgot I don't know. It was there for over a week before anyone discovered it.

I am told by the security people that the adaptor defaulted to 'ad-hoc' mode and could have easily been paired with passerby outside in the parking lot who had the know-how (and presumably the right credentials).

Re:Really.... (1)

iammani (1392285) | more than 4 years ago | (#30139316)

VPNs?

Re:Really.... (1)

n0tWorthy (796556) | more than 4 years ago | (#30145880)

Many of these systems are locked in sheds alongside the larger transformer/switching sites. Cut the padlock and you have access to a Windows 2000 SCADA system that is on their SCADA network. Many of these also have modems and PCAnywhere. It really is scary.

Re:Really.... (3, Informative)

cdesousa (1426699) | more than 4 years ago | (#30137694)

You should read the article (or the translation) first.... That is exactly how the system is implemented. The original article says

"A rede operativa é blindada, separada da internet e operada via comando de voz", segundo informou a entidade

In English,

According to the organization, "The operative network is secure, is separated from the internet, and is operated by voice command"

The article also says that the hackers got into the operative network but not in the operative network.

Re:Really.... (1)

ColdWetDog (752185) | more than 4 years ago | (#30137814)

"The operative network is secure, is separated from the internet, and is operated by voice command"

The "voice command" part bothers me a bit.

"Dear Aunt: let's set so double the killer select all". Whatcouldpossiblygowrong?

Re:Really.... (2, Interesting)

mr exploiter (1452969) | more than 4 years ago | (#30137700)

That's not how things work in practice. Remote monitoring from anywhere in the world is too tempting. You can take a look at what kind of thing SCADA vendors are selling to realize things are getting worse before they're getting better.

Re:Really.... (1, Interesting)

Anonymous Coward | more than 4 years ago | (#30138148)

And yet, your bank probably uses internet based VPNs for their ATMs, because they are cheaper to run than dedicated lines.

Re:Really.... (0)

Anonymous Coward | more than 4 years ago | (#30143878)

I happen to know for a fact that the A/C system in Rush Limbaugh's Palm Beach home is accessible and controllable via the Internet, as is the system for a small university nearby...

SQL injection? (2, Funny)

XanC (644172) | more than 4 years ago | (#30137344)

Somebody's fired.

Re:SQL injection? (2, Insightful)

etinin (1144011) | more than 4 years ago | (#30137572)

Not if they have been politically appointed, something very common in brazilian state-run companies.

Re:SQL injection? (2, Informative)

Tellarin (444097) | more than 4 years ago | (#30138234)

ONS, the operator of the electric system, whose website was hacked, is not a state-run company. It is a private non-profit regulated by Brazil's National Electrical Energy Agency.

Re:SQL injection? (2, Interesting)

ArsenneLupin (766289) | more than 4 years ago | (#30140956)

Not just Brazilian state-run companies...

Or maybe not just state-run companies even...

Re:SQL injection? (5, Funny)

oGMo (379) | more than 4 years ago | (#30138000)

"' WHERE 1=1; UPDATE plant_employees SET status='FIRED'; ..."

Or everybody's fired!

Do you believe in Coincidence? (3, Funny)

matty619 (630957) | more than 4 years ago | (#30137354)

60min does a story on the security of Brazil's power grid, Brazil says its not true, a few days later, they have the worst power outage in a decade, and now this story.....

Re:Do you believe in Coincidence? (1)

Monkeedude1212 (1560403) | more than 4 years ago | (#30137380)

It's like that James Bond movie, where they report the news quickly because they are the ones causing the news? I think its Tomorrow Never Dies but I can't be sure.

Re:Do you believe in Coincidence? (1)

Itninja (937614) | more than 4 years ago | (#30137616)

"You provide the pictures. I'll provide the war." Not sure who said that (Hearst?) but I think it was apocryphal anyway.

Re:Do you believe in Coincidence? (1)

etinin (1144011) | more than 4 years ago | (#30137654)

I find it highly unlikely that the power plant with the second highest generation capacity in the world can be totally shut down from the internet.

Re:Do you believe in Coincidence? (2, Informative)

Tellarin (444097) | more than 4 years ago | (#30138256)

There was no issue with Itaipu. It remained working. For now it seems it was a problem with distribution lines.

Re:Do you believe in Coincidence? (1)

etinin (1144011) | more than 4 years ago | (#30143330)

Brazilian newspapers say that the power plant was offline for like 10min, although the main problem was an issue with the distribution lines.

Re:Do you believe in Coincidence? (1)

Tellarin (444097) | more than 4 years ago | (#30144814)

As from the news I've read, Itaipu's output was first reduced in about 10% because of the start of the blackout, and later temporarily shutdown as there was nobody consuming power and no need to keep it running at full capacity.

Or maybe... (2, Insightful)

Monkeedude1212 (1560403) | more than 4 years ago | (#30137372)

They were so good the first time they left no trace of their doings and even framed it on some other probable cause.

One of the hackers (I'm guessing the one who likes polo shirts) obviously thought it'd be way cooler to take public credit. They have now revoked his invitation to DEF CON.

Re:Or maybe... (2, Funny)

Anonymous Coward | more than 4 years ago | (#30137478)

One of the hackers (I'm guessing the one who likes polo shirts) obviously thought it'd be way cooler to take public credit. They have now revoked his invitation to DEF CON.

Oh, come on. Unless his Mom named him Roberto'); DROP TABLE Hackers; , little Bobby Tables is never going to register under his real name, do you?

Re:Or maybe... (4, Funny)

Tellarin (444097) | more than 4 years ago | (#30138266)

Original xkcd reference. http://xkcd.com/327/ [xkcd.com]

Accidents.... (1)

jhcaocf197912 (1430843) | more than 4 years ago | (#30137650)

Hey Vinny, give Tommy a little ride....... make sure it looks like an accident.

Conspiracy theorys abound! (5, Insightful)

Anonymous Coward | more than 4 years ago | (#30137680)

This is ridiculous. You can easily hack into their corporate website, but there is no way hackers got into the Brazilian power grid management system, because there is no such automated system in the first place! The central agency controlling the grid Operador Nacional do Sistema (ONS) operates the center by calling their buddies on generating station over private phone lines. Unless you are a very good voice impersonator and know all the necessary protocols, you will not get very far. That's when lack of technology is a plus.

Re:Conspiracy theorys abound! (1)

wilcley (1183323) | more than 4 years ago | (#30138164)

Yes, but it's not clear what information was exposed in this breach. With the right names, phone numbers, and procedures, I suppose you could cause some disruption.

Misundestood news (2, Informative)

aylons (924093) | more than 4 years ago | (#30137692)

Hackers didn't broke into the ONS (national power grid operator) system. They have broken into its web site, and this has happened days after the blackout. And the website, naturally, has nothing to do with the operational servers. There are no evidences whatsoever that last Thurday's blackout was caused by an online attack.

Off-Grid Power (1)

robwgibbons (1455507) | more than 4 years ago | (#30137826)

All of these breaches in power grids are only one more reason for the government to reward/subsidize off-grid (self-sufficient, solar-powered) homes.

Re:Off-Grid Power (0)

Anonymous Coward | more than 4 years ago | (#30143592)

If it was that simple, it would have been done already. A large portion of the affected population lives in densely packed areas where there's no way you can fit enough photovoltaic cells to have self-sufficient buildings. Also, those suckers are pretty damn expensive.

And you've got to remember that saving money was the reason they built those big transmission lines. Some of the affected states where self-sufficient already, but buying power from a big hydroelectric plant like Itaipu is cheaper than buying from lots of smaller H.E. plants or methane-burning thermoelectric plants.

Re:Off-Grid Power (1)

indi0144 (1264518) | more than 4 years ago | (#30153080)

Humm I remember now, a little piece of news around the time when Bush was in the office, maybe 6 months before leaving, about him buying a SHITLOAD of real state in that area of Brazil. Maybe the most valuable real state in the world because of the gigantic water reserves there.

http://www.thetruthseeker.co.uk/article.asp?ID=5324
(no link because slashcode could not be bothered to render my html tags properly, yes, I have an agenda)

Maybe the power outgage was because Bush were trying to overclock his pc to cope with the performance hit of speech recognition software he just installed. He should go POWER PC FTW!

More on-topic, Brazilian hackers are very good but mostly white hats, maybe they were pissed off because of the misinformation of the first news that hit the media but I also recall a series of severe power outages in urugay or paraguay (neighbor countries to Brazil) some days after the first incident. Maybe some /.er from there can give us some insights?

Power regs (0)

Anonymous Coward | more than 4 years ago | (#30137872)

I don't know what the regs are in Brazil, but in the US, NERC limits how the Generation and SCADA systems may be connected. There is to be no way to get to the Generation or SCADA systems from outside them.

Data is only allowed to be pushed out from those systems, and even better it should be pushed to a secured DMZ where only trusted systems can, with read-only access, pick up the data (since you have to get customer data back out somehow for the billing systems, etc.). Nothing should be allowed into the DMZ from non-Generation / SCADA networks. That means even the power utilities non-Generation or non-SCADA systems can't get to any of these networks/systems, period. The Generation and SCADA systems should not be able to get to any other networks than this secured DMZ.

If these simple rules are followed, there is no way to affect the grid from the Internet, or even the regular power utility corporate network. However, sadly, for different reasons these obvious security guards are bypassed.

Breaking News (4, Funny)

lupine (100665) | more than 4 years ago | (#30137920)

Today hackers gained access to my bank account and increased the ballance to 100 millions dollars without alerting authorities.
Actually that didn't happen. My bank account is perfectly secure. There are no hackers anywhere that are smart enough to do such a thing.

Re:Breaking News (0)

Anonymous Coward | more than 4 years ago | (#30138868)

Damn looks like you're right. Well, we tried!

What the hell do you mean this isn't a dupe? (1)

BlortHorc (305555) | more than 4 years ago | (#30137974)

I'm sure I can't be the only one who saw this and thought, "You told us this, what, a week ago?". Goddamn moderators.

I think these guys were trolling jaded /. readers for kicks

Wrong summary (4, Informative)

Tellarin (444097) | more than 4 years ago | (#30138308)

Well, first of all, the 60 minutes episode about blackouts in 2005 and 2007 provides absolutely no proof or other data about those blackouts being caused by hackers, except for two anonymous sources that suspect it was.

Second, there was no breach in the grid network, at least not know so far. What happened was that the ONS (the Brazilian electric grid operator) website was hacked.

Re:Wrong summary (0)

Anonymous Coward | more than 4 years ago | (#30139536)

What seems to me is that slashdot has been hacked by the brazillian government...kkkkk

What the hell, if the website was corrupted there are for sure possibility of vital systems to have been invaded. Aren't there billing, payment, provisioning or any other system in this company connected to the internet?
aren't these connect to the core systems either?

Do you guys really believe from the bottom of the heart that is not possible go from the internet to the control system?

Maybe you need better security advisors or better books... maybe better brains

Someone just said the only truth in this history so far: If you can touch it, it's insecure.

"hackers" (1)

clang_jangle (975789) | more than 4 years ago | (#30138370)

hackers were inspired by the story actually to do what was claimed.

***sigh***
Some "hackers, or more accurately some script kiddies . The diggification of slashdot is not at all a good thing.

blackouts? (0)

Anonymous Coward | more than 4 years ago | (#30138454)

Man I've been having blackouts all say! It must be those damn Brazilian hackers!

Re:blackouts? (1)

Virtucon (127420) | more than 4 years ago | (#30143798)

Nope, it's the excessive use of alcohol and Barbiturates..

Mod story down (2, Informative)

acid06 (917409) | more than 4 years ago | (#30138896)

Hackers didn't "break into the grid" or anything close to that. They defaced the *website*, that's it.
While that is surely a shame for them, is nothing even close to a real worry.

No power outages were caused at all (and, in fact, couldn't be caused).

Now please quit posting uninformed crap.

Rede Globo is pretty much a brazilian Faux News (-1, Flamebait)

Anonymous Coward | more than 4 years ago | (#30141290)

/.ers shouldn't be taking them seriously

Busy hackers! (2, Funny)

cpscotti (1032676) | more than 4 years ago | (#30141580)

That's why no one hacked the electronic voting system!! The good guys were busy having fun sql-injecting stuff in some "bigger" system..
Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?