Beta

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Utilities Racing To Secure Electric Grid

Soulskill posted about a year and a half ago | from the shouldn't-they-have-done-this-5-years-ago dept.

China 113

FreeMichael61 writes "In the latest episode of Spy vs. Spy, China rejects accusations it's hacking U.S. companies to steal IP or bring down the grid. But there's no doubt the grid can be hacked, CIO Journal's Steve Rosenbush and Rachael King report. Industrial control networks are supposed to be protected from the Internet by an air gap that, it turns out, is largely theoretical. Internal security is often lax, laptops and other devices are frequently moved between corporate networks and control networks, and some SCADA systems are still directly connected to the internet. What security standards actually exist are out of date and don't cover enough, and corporations often use questionable supply chains because they are cheaper."

cancel ×

113 comments

Sorry! There are no comments related to the filter you selected.

Best Nerdcore Band Name Ever (3, Funny)

Jah-Wren Ryel (80510) | about a year and a half ago | (#42950585)

Theoretical Air Gap!

Re:Best Nerdcore Band Name Ever (3, Funny)

ColdWetDog (752185) | about a year and a half ago | (#42950809)

Well, I, uh, don't think it's quite fair to condemn a whole program because of a single slip-up, sir.

Re:Best Nerdcore Band Name Ever (2)

Ol Biscuitbarrel (1859702) | about a year and a half ago | (#42951351)

Thank you, General Turgidson, that will be all.

"Racing to secure Electric Grid" (1)

Runaway1956 (1322357) | about a year and a half ago | (#42952015)

I picture some arrogant fool at a race, who spends several minutes fast walking backwards around the track. When the race is almost won, then he starts running in the right direction.

With luck, the utilities will be back at the starting line before the competition crosses the finish line.

it always baffles me (5, Insightful)

gTsiros (205624) | about a year and a half ago | (#42950647)

... why are mission critical devices connected to the internet

sure we know that the weakest link is the meatware, not the hardware, but still...

Re:it always baffles me (1)

Anonymous Coward | about a year and a half ago | (#42950807)

TFA answered this. It stated:

"The production systems are supposed to be kept off line... so they aren’t vulnerable to viruses distributed via the Internet." followed by, "...these air gaps can be hopped if the two systems use common computer peripherals such as... USB sticks..."

He is saying not connecting these to the internet is not enough.

Re:it always baffles me (1)

gTsiros (205624) | about a year and a half ago | (#42951075)

fair enough... ... no connectivity either, or at least tightly controlled connectivity.

Simple solution... (3, Interesting)

msauve (701917) | about a year and a half ago | (#42951955)

Change those systems from IP to ARCNET (or AppleTalk, or IPX, or ???).

Re:it always baffles me (1)

Nefarious Wheel (628136) | about a year and a half ago | (#42952917)

TFA answered this. It stated:

"The production systems are supposed to be kept off line... so they aren’t vulnerable to viruses distributed via the Internet." followed by, "...these air gaps can be hopped if the two systems use common computer peripherals such as... USB sticks..."

He is saying not connecting these to the internet is not enough.

It's amazing what security enhancements can be made with a little dollop of silicone glue.

"Bit o' Silastic in the USB port when you're finished, George..."

Re:it always baffles me (2)

Redmancometh (2676319) | about a year and a half ago | (#42953187)

"thanks george now we need to order an $800 EROM everytime to update firmware on our PLCs"

Re:it always baffles me (0)

Anonymous Coward | about a year and a half ago | (#42954105)

Silly rabbit, nobody updates the firmware on their PLCs. :)

as Marvin would say (1)

mschaffer (97223) | about a year and a half ago | (#42955675)

It will just end in tears.

At some point... (1)

mschaffer (97223) | about a year and a half ago | (#42955631)

At some point, someone needs to interact with the system, and the system needs to interact with the devices it controls. So, in theory, these systems cannot be completely isolated.
Also, consider that if these systems were isolated with a pure vacuum, it may make the universe fly apart!
http://science.slashdot.org/story/13/02/19/2151238/does-the-higgs-boson-reveal-our-universes-doomsday [slashdot.org]

Re:it always baffles me (1)

jadv (1437949) | about a year and a half ago | (#42955803)

Yep, USB devices. That's how the Stuxnet virus is believed to have reached its intended targets. Not because a PLC was carelessly connected to Facebook, but through infected thumb drives.

Re:it always baffles me (5, Interesting)

Beardo the Bearded (321478) | about a year and a half ago | (#42950947)

They aren't supposed to be online, no. What you have though is the desire to do remote monitoring. One of the SCADA systems I used had an email module so you could get an email when things got all fucked up. That's a super awesome feature to have on a mission critical device.

"Hey, Beardo, it's Loader 1. Probably nothing to worry about, but sensors picked up a fluctuation in the output. Last time this happened the system crashed hard. Yeah, I know you're in a movie. Come check on meeee."

Now if this was up to me, and I know it's not, I'd build that module with an optoelectronic relay so it can send messages but be physically incapable of receiving them. Of course that does limit the usefulness, I can't send back messages, but I could call the place and let the night crew know there's a problem (if they aren't already aware) and how to mediate it.

Re:it always baffles me (3, Interesting)

dave562 (969951) | about a year and a half ago | (#42951733)

If the SCADA system is architected properly, remote monitoring is done via a Historian server that does not have the ability to affect the control systems.

I helped setup a Honeywell system to run a power plant in central California. My job was to architect the network piece of it. The hardware itself was completely mirrored in a typical master / slave relationship so that if the master failed, the slave was completely synchronized and could pick up the load.

There was a hardware firewall in between the production network and the Historian. The connection between the two was one way so that the it could report historical data for reporting purposes.

The corporate network connected to the historian via an IPSEC/AES-256 VPN connection. The switch fabric was redundant and the firewall used dual-homed, active/passive connections to mitigate against the potential of a switch failure.

Re:it always baffles me (3)

drinkypoo (153816) | about a year and a half ago | (#42951851)

There was a hardware firewall in between the production network and the Historian. The connection between the two was one way so that the it could report historical data for reporting purposes.

What I'm seeing you say is what I'd like to hear, but unfortunately what I'm reading is you were depending on a piece of software on a firewall to be vulnerability-free in order to provide your one-way communications.

Re:it always baffles me (1)

dave562 (969951) | about a year and a half ago | (#42951903)

I am relying on the firewall. If someone is hacking a Cisco ASA that is set to default deny, I have bigger problems.

Re:it always baffles me (1)

jadv (1437949) | about a year and a half ago | (#42955897)

I agree with the parent poster. At some point you have to stop needing to have everything under your control and start relying on third-party suppliers. Or did you build your own car instead of buying one because you were afraid that the brakes might have a manufacturing flaw?

Re:it always baffles me (1)

adolf (21054) | about a year and a half ago | (#42954519)

Without knowing anything at all about SCADA except that it is a thing (or group of things) that exists:

Real, solid 1-way data connections are entirely possible. As a basic and slow example, RS-232 with only TXD and ground connected will only allow data to go in one direction.

Re:it always baffles me (1)

drinkypoo (153816) | about a year and a half ago | (#42957015)

Real, solid 1-way data connections are entirely possible. As a basic and slow example, RS-232 with only TXD and ground connected will only allow data to go in one direction.

Yes, this is precisely the line along which I am thinking. This is an interface that, barring strange quirks in the serial driver, you're not going to be hacked through. When someone says "it's got a one-way network connection" I say "bullshit". If they say it's got a one-way serial connection or something like that, I can buy that. Even then it's not impossible, merely astronomically improbable that someone can successfully pull off an attack through that channel. And if all you have is the TX connected to the logger's RX and a ground line (as you say) and no handshaking lines or anything, you would almost certainly have to directly mount a hardware attack before you had a chance of affecting anything whatsoever.

Re:it always baffles me (1)

cusco (717999) | about a year and a half ago | (#42958631)

That's fine, until the device that you need to monitor is 27 miles away. Even RS-485 is only good for 4000 feet. Frequently the operator will have to decide that since Input 01 and 03 are live but 02, 04 and 05 are not they need to trip Relay 1F, and the whole mess is located at a power dam that's an hour's drive away and has been snowbound for the last three months (real world example, BTW). One-way comms aren't enough for SCADA, and certainly not serial comms.

Re:it always baffles me (1)

cheater512 (783349) | about a year and a half ago | (#42952247)

Even easier. Pull out a RS232 cable to run between a internet connected computer and the SCADA system.

You can still send detailed alerts and possibly even remotely monitor the site. Just keep it read only and use a teeny tiny bit of quality code and its safe.

Its using stuff like IP which is the stupid part.

Re:it always baffles me (0)

Anonymous Coward | about a year and a half ago | (#42953109)

Exactly, the guy above is relying on complicated hardware that he assumes is okay. An rs232 with only the TX line connected was all that was needed but he had thousands of dollars worth of hackable cisco goodies.

Re:keep it read only: Two wires (0)

Anonymous Coward | about a year and a half ago | (#42953197)

Only connect one data link and ground, and it will be secure. Run a balanced pair if you are feeling fancy. If the receiver can keep up, you don't even need flow control lines. Problem solved.

Re:keep it read only: Two wires (1)

allaunjsilverfox2 (882195) | about a year and a half ago | (#42953743)

Only connect one data link and ground, and it will be secure. Run a balanced pair if you are feeling fancy. If the receiver can keep up, you don't even need flow control lines. Problem solved.

You could just set a led that blinks when there is something wrong and have a 2 dollar webcam monitor it. If someone manages to force data through a led that isn't configured for such activity, they have won the internet and deserve access.

Re:keep it read only: Two wires (1)

Beardo the Bearded (321478) | about a year and a half ago | (#42956401)

That's what I said, an optoelectronic relay.

Re:it always baffles me (1)

cusco (717999) | about a year and a half ago | (#42958649)

Fine, and how do you open the spillway on a dam that's inaccessible because of flooded roads if you only have one-way comms? SCADA systems aren't just for monitoring, operators need to react to that data as well.

Re:it always baffles me (1)

Redmancometh (2676319) | about a year and a half ago | (#42953213)

There is always the physical layer.

Re:it always baffles me (1, Informative)

nazsco (695026) | about a year and a half ago | (#42953337)

Cut the crap.

Thereare millions of mission critical things that are online for good reasons.

Just do it right.

Assuming,you don't have to do it right,because there's a air gap or anything else the sales guy would say when explaining why you don't have to hire an expensive network security guy will just get you in trouble.

It's like trusting a car salesman that this car is cheaper because it uses full synthetic oil so you never have to change it again.

Re:it always baffles me (1)

BVis (267028) | about a year and a half ago | (#42956553)

Just do it right.

There are millions of IT folks that would love to do that, but, inexplicably, they are not the people who make the decisions as to what technology to use. Those decisions are frequently made by MBAs/C-level morons who haven't seen a line of code in twenty years, or by the bean counters in Accounting who can barely open Excel. The IT folks just have to clean up after the tremendously bad decision-making that is a result.

It's like trusting a car salesman that this car is cheaper because it uses full synthetic oil so you never have to change it again.

Not exactly. It's more like trusting your boss to pick out the car you're going to pay for when he plays golf/drinks with/is a frat brother of the car salesman, or he thinks he knows better than you want car you want, despite ignoring what you've asked for (so you end up with a Corolla instead of the Sienna you need to cart around your three kids and two dogs), or just buys whatever is cheapest.

Re:it always baffles me (1)

AmiMoJo (196126) | about a year and a half ago | (#42953715)

Would be better if it just said "loader on fire".

Re:it always baffles me (1)

Taibhsear (1286214) | about a year and a half ago | (#42955531)

Or they could just use, oh I don't know... let's say some other sort of dedicated communication device. We could call it a "telephone."

Re:it always baffles me (1)

Beardo the Bearded (321478) | about a year and a half ago | (#42956429)

I've done those too. Hooked up an output signal to an autodialler to call myself.

"Hey Beardo, that loader is all fucked up again. Pick up bananas on the way home."

The only downside is you can't get data on the fly, just a generic error.

Happens all the time (5, Informative)

Anonymous Coward | about a year and a half ago | (#42951033)

Do you think that the energy industry is any easier on IT folks than anybody else?

Big dollar consultants instead of trained employees, given full unescorted access because the manager doesn't want to have to sit in the datacenter and escort them to the restrooms and such.

My SCADA datacenter still allows a cleaning crew in unescorted.

And electricians, and HVAC contractors and so on.

I found out they were PAINTING my datacenter the day that my storage started freaking out with heat alarms. Went running downstairs to find the facilities team had left a painting crew in the datacenter to cover all of my cabinets (and vented tiles) with tarps.

So these devices might not start connected to the internet, but a USB key here, a rogue cellular wi-fi bridge there, and some wild stuff can happen.

I've heard of other shops that had their SCADA people upset that they couldn't work from home, so they set up "secret" networks that only they knew about so they could still get in. Secret to their co-workers/management, but easy to find for the people who do that for a living.

Going anon for good reason.

Not all companies are equally bad (3, Interesting)

dreamchaser (49529) | about a year and a half ago | (#42951375)

One of my clients is a large electric utility. Their security, both physical and for IT systems, is top notch. None of their SCADA systems are online, they do routine and regular audits of all security, and even 'trusted' people like myself have to jump through hoops to get into the Data Center, and are always escorted.

They have really cool doors to get in too. They are like decontamination booths. You step into a vertical tube and wait to be cleared then the tube rotates and opens the other side.

On the other hand, I've done work for other utilities where yes, the cleaning crew goes in through what amounts to an open door, without an escort.

Re:Not all companies are equally bad (2)

bcong (1125705) | about a year and a half ago | (#42955279)

Those doors are called man traps, and they do exactly what it sounds like they do if you are entering an area you are not supposed to.

not just work from home but more remote plants swt (1)

Joe_Dragon (2206452) | about a year and a half ago | (#42951439)

not just work from home but more remote plants switching / sub stations. Also the control centers need to be able to control all of that or do want to have some at each mid size to big substation 24/7 tied to a phone and control bank? As well a ready to go on call linemen who will drive out to the smaller ones to filp the switches?

power lines have reclosers some kind of wireless links on them.

Re:it always baffles me (4, Informative)

Puff_Of_Hot_Air (995689) | about a year and a half ago | (#42951061)

... why are mission critical devices connected to the internet

sure we know that the weakest link is the meatware, not the hardware, but still...

They aren't, at least, not directly. They are however generally connected at various points to the "business" network which is connected to the Internet (people gotta email). The literal air gap is largely fiction. The business network is hacked, then some vulnerability exploited in the bridge points or routers (it's a network of networks!). Why connect the SCADA to the business network at all? To get the data out to do reports, send email alarms etc. in theory this data exporting should be secure. Problem is that who is hacking your SCADA system? It's not the usual suspects; there is no money in it and the barrier of entry is too high for the script kiddies. It's other countries wanting to perform espionage. How the hell do you protect against that? Look at stuxnet, I mean really look at how that took down the centrifuges. Governments have resources that the average hacking group simply doesn't (or SCADA group). They also have no reason to reveal a compromised system. There could be sleeper, targeted, custom malware sitting on every SCADA server in the US, just waiting for the a time where it will be useful to activate. It's a brave new world!

Re:it always baffles me (1)

UltraZelda64 (2309504) | about a year and a half ago | (#42951805)

The question then becomes: Why the hell are mission-critical systems connected to business networks that are themselves connected to the Internet? Surely the government could quit blowing our taxes on dumb, pointless shit for just long enough to get any hardware and technicians required to completely segregate these critical systems from any "business" network that may be connected to the Internet or vulnerable to malware hopping from some employee's USB flash stick? The idea that such critical systems could be exposed to such malware is disturbing... what business does anyone have plugging some random USB drive into a mission-critical system? Why are these systems not protected better in the first place?

Re:it always baffles me (1)

aaarrrgggh (9205) | about a year and a half ago | (#42952891)

The alternative to a SCADA system is basically a bunch of stand-alone PLCs. They are heavily used for sub-process control (black-box control), and also for validating the proper operation of the SCADA system. But, to think you can do everything a modern SCADA system does with hard-wired PLCs is disingenuous. The controls become the network.

It all comes down to economics. You can make a system extremely robust, but you have to start from the smallest component which increases cost by an order of magnitude. How do you protect against a rogue wireless modem in the system? You can fairly easily limit what systems the modem could impact by compartmentalizing dumb serial links that it could attach to without being detected by network equipment, but if it can spoof the right IO there is a good chance it can impact system functionality. Things like modbus just never were designed for security; even some of the more "secure" protocols aren't a dramatic improvement, and they are often not available for all equipment.

Re:it always baffles me (1)

UltraZelda64 (2309504) | about a year and a half ago | (#42952967)

Like I said, if the government would just quit wasting our tax dollars, the cost would really not be much of a problem. Just look at all the money going into funding a massively failed drug war and an overpopulated prison system, and the money that goes into funding recycling worthless things like plastic and paper. Not to mention our outsourcing of... well, almost everything, out to places like China. And does the government care? Nah... doesn't seem like it. They're only just now starting to open up to the whole cannabis thing... who knows, maybe one day U.S. farmers will once again be allowed to grow "Hemp for Victory" on American soil instead of importing fibers of the crop from China.

Re:it always baffles me (0)

Anonymous Coward | about a year and a half ago | (#42952895)

I've worked in many private data centers and it's extremely common to encounter people with physical access to the racks setting up rogue wi-fi networks linked into the most convenient point available thus creating a vulnerability.

Re:it always baffles me (2)

blackraven14250 (902843) | about a year and a half ago | (#42953147)

They're not government owned in the US...

Re:it always baffles me (3, Insightful)

firewrought (36952) | about a year and a half ago | (#42953367)

Why the hell are mission-critical systems connected to business networks that are themselves connected to the Internet?

Because the functioning of the business relies integrally on both.

Look... I sympathize with the "air gap" argument, but it's not the mid-90's anymore. Business has been transformed by the ability to connect industrial systems with centralized command centers with payment systems with other companies. It's not for execs to have bullshit ipad dashboards... it's for the business to make operational decisions that will take effect in the upcoming hours/minutes/seconds, to meet contractual and legal obligations, to feed customer- and billing-related systems (no point in running a business if you can't cut a bill, eh?).

The world's not going back... VPN's, firewalls, segregated networks, etc., etc., but "air gap" won't do it anymore. Data is the lifeblood of business.

Re:it always baffles me (1)

thegarbz (1787294) | about a year and a half ago | (#42954433)

They aren't, at least, not directly.

In some cases they actually are, though strictly speaking it's more of a VPN type system. The lines between SCADA, PLC, DCS, etc are extremely blurred these days. You'll find a large portion of SCADA systems aren't actually SCADA at all but rather remotely controlled and managed control systems. They rely a lot of security by obscurity.

I work at a plant where we control several devices via SHDSL links. The modems have internet facing IP addresses and are connected to a SCADA system at one end and to our distributed control system via a firewall at the other end and speak DNP3 over IP. This protocol like many others has security features added as an afterthought. A DNS in theory should only affect our ability to control the pipeline in this case but I have a worse example too.

A major operator of air plants around the world is widely known for not having staff on site actually run the plants. Sure the plants are manned but only for maintenance, a few manual duties, startups, and emergencies, but for the most part as soon as the plant has reached steady state the entire control of the plant is handed over to a team in a completely different country!. Again the network here is VPN but even a network encrypted at that layer is still susceptible to things like denial of service. Also god forbid someone with inside information decides to go on the offensive.

Re:it always baffles me (0)

Anonymous Coward | about a year and a half ago | (#42954677)

Printers to the rescue! Communist countries have no idea how wasteful and inefficient we can all be, they'll never see it coming.

Re:it always baffles me (1)

simishag (744368) | about a year and a half ago | (#42952477)

I can appreciate your sentiment, but I think it's wishful thinking. We can certainly argue that these devices SHOULD not be connected to the Internet, but the simple fact is that a great deal of them ARE connected, and many that are not "intended" to be connected will end up connected, and those systems need to be designed with that possibility in mind. They are currently designed with no more security than my pull-start lawn mower.

Re:it always baffles me (2)

west (39918) | about a year and a half ago | (#42952973)

... why are mission critical devices connected to the internet

Because being connected to the internet saves a *lot* of money. Instead of having to have an entire emergency team on site at all hours, you can get away with a minimal team at nights/weekends, and workers who can, in an emergency, connect from home.

It takes a very capable manager who can persuade the higher ups that its necessary to continue spending a few millions dollars in wage costs every year to avoid what (at least until very recently) seemed to be a very illusionary threat. Besides, surely with a few precautions like multi-factor authentication, there's no possible way that anyone could break in :-).

Note, it's even harder if you're bidding for contracts. Try telling prospective clients that the reason your prices are double are because you refuse to enter the Internet age... Especially when those you are bidding against are assuring the customer that they're taking all the necessary precautions.

It's a sad fact of life that it's rarely worthwhile to spend a lot of money to protect against rare disasters if your competitors aren't doing the same. (Note, normal disaster planning adds a few percent to cost - we're talking about making yourself bullet proof, which may double or triple your costs.) The odds are fairly high that with much higher costs, you'll be bankrupt before the disaster hits, and moreover, if all your competitors are being hit by the same disaster, the general sentiment becomes "no-one could have predicted it" and everyone keeps their jobs anyway.

Unmanned. (2)

thegarbz (1787294) | about a year and a half ago | (#42953755)

Because mission critical devices may not be manned. This is a rising trend in remote asset management. It's used extensively in upstream processing and pipelining that is slowly working it's way to downstream.

Heck one large gas ... manufacturer (though it's hard to call air separation "manufacturing") in our country runs all plants remotely. Sure there are staff there, but no one in the control room, no one in front of the computers. The onsite staff are used to bring the plant online and handle emergency cases but as soon as a steady state is achieved the controls are handed over to a dedicated team in another country, who run these almost identical plants all over the world.

Airgap in this case is cutting off control.

And on Slashdot (-1)

Anonymous Coward | about a year and a half ago | (#42950655)

The lights are on, but nobody's home.

Fuck off (0, Troll)

Anonymous Coward | about a year and a half ago | (#42950691)

We get it. We're all in imminent danger. Fuck off already. These shitty fear mongering articles don't even contain any interesting technical information.

Re:Fuck off (-1)

Anonymous Coward | about a year and a half ago | (#42950785)

Stroll away troll.

Re:Fuck off (0, Offtopic)

fustakrakich (1673220) | about a year and a half ago | (#42951017)

You shouldn't have been modded down. Fear mongering has become very big business in our Post 9/11 World

Re: Fuck off (0)

gTsiros (205624) | about a year and a half ago | (#42951179)

he was downmodded for the attitude, not the information.

if a person can't keep their cool during a discussion they annoy me. I suspect you don't see it very differently.

Re: Fuck off (0)

fustakrakich (1673220) | about a year and a half ago | (#42951287)

Considering the hysteria of the last decade and counting, I find the attitude refreshing. A lot of people need to fuck off, starting at the top.

Re:Fuck off (2, Interesting)

Anonymous Coward | about a year and a half ago | (#42951235)

Half of these articles don't even hide the fact that they're written and promoted by people that are looking for government money to secure infrastructure. Often it's even infrastructure that they own and that they're responsible for. One such person is even named in the first sentence of this article.

We're all in danger! Quick better make some new laws, imprison a few more people, and find a hero that can protect us!

Re:Fuck off (1)

fustakrakich (1673220) | about a year and a half ago | (#42951469)

Well, yes, and apparently, telling them to fuck off is uncouth. Who'da thunk... I guess everybody out there is saying, "Just give 'em the money" Somehow that is more "civilized".

China tries to crack everything, news at 11 (4, Interesting)

xiando (770382) | about a year and a half ago | (#42950695)

Anyone with a web-server will tell you that they are seeing dozens of penetration attempts daily, even right now. I also see this on my home ADSL line. I'm not saying the government there is doing it, but I do know that there is no other country which is attacking everything everywhere this aggressively. I don't have any web pages in Chinese and I wonder if I would be better off just using one of those iptables -j DROP lists who list all IPs in China.

Re:China tries to crack everything, news at 11 (2)

OhANameWhatName (2688401) | about a year and a half ago | (#42951255)

I'm not saying the government there is doing it, but I do know that there is no other country which is attacking everything everywhere this aggressively

I'm not saying that you're contradicting yourself, but you're contradicting yourself.

Re:China tries to crack everything, news at 11 (0)

drinkypoo (153816) | about a year and a half ago | (#42951873)

I'm not saying the government there is doing it, but I do know that there is no other country which is attacking everything everywhere this aggressively

I'm not saying that you're contradicting yourself, but you're contradicting yourself.

I'm not saying that your reading comprehension skills are for shit, but seriously?

Re:China tries to crack everything, news at 11 (1)

OhANameWhatName (2688401) | about a year and a half ago | (#42953027)

Arrgghhh, I hate having to explain myself.

I'm not saying the government there is doing it

You say that, and then immediately follow with this:

there is no other country which is attacking everything everywhere this aggressively

So either you're contradicting what you just said, you're attempting to imply that the mountains, rivers, fields and rocks of China are attacking other countries or you're drawing no distinction between the people living in China and the 'country' of China. And why would any given person in China be 'China'? Could I fairly categorize all Americans as bone-headed uneducated sloths with 150 TV channels who love their cousins and enjoy a good roadkill stew? .. all because some Americans are like that?

No (0)

Anonymous Coward | about a year and a half ago | (#42953553)

Could I fairly categorize all Americans as bone-headed uneducated sloths with 150 TV channels who love their cousins and enjoy a good roadkill stew? .. all because some Americans are like that?

No, but that fits my family fairly well.

Posted anonymous, one or two of them might know how to read and actually wander onto Slashdot. Imagine that.

Re:China tries to crack everything, news at 11 (0)

Anonymous Coward | about a year and a half ago | (#42951293)

Yeah, IP's in thailand seemed to be hacking my machine when the great IE zero day flaw was out there. I remember getting cross about the fact that a lot of updates use update services that do not necessarily make it easy to understand if your machine is connecting to a rougue IP, or just an update server. Why can't it be made simple for people to see where there machine is connecting to (and a description of why it is connecting)?

I can't help thinking that these flaws in OS's or software platforms need to be made more public and clear to people... that if they continue using it they will be vunerable to attack. At least you can disconnect from the internet and wait for updates before going back online. I mean people use computers for more financial purposes now, buying presents and gifts and grocerys. Waiting months or years to patch some expoit without telling the masses, seems to be negligent on behalf of the person responsible for the software.

Meh. (0)

PPH (736903) | about a year and a half ago | (#42951619)

Call me when the USA stops digging around in everyone's financial records.

Re:Meh. (0)

Anonymous Coward | about a year and a half ago | (#42951715)

I know it is supposed to be good sport to blame the USA for everything, but they explicitly do not dig around in nearly any financial records at all. Note the lack of regulation that led to a multi-year economic meltdown with no dirty hands to show for it despite having plenty of suspects.

You are coming off as someone that uses bias and calls it reason.

Re:Meh. (0)

PPH (736903) | about a year and a half ago | (#42952189)

they explicitly do not dig around in nearly any financial records at all.

Oh really [wikipedia.org] ? If you think this is really aimed at stopping terrorism, keep in mind that the entire 9/11 attack could have easily been funded by some Saudi Prince diverting funds from a good weekend in Las Vegas. The CIA's surveillance won't pick that sort of thing up. This is financial espionage, plain and simple.

You are coming off as someone that uses bias and calls it reason.

Sometimes one has to, to make a point. Look at the USA's espionage program. Enter the country with a laptop and you risk having it searched. Funny. Terrorists coming in would have empty laptops. The data of interest would be going out. But not if you are looking for bid information from, say Airbus, competing with Boeing. Then your laptop is loaded with pricing data. And that gets scooped up.

China doesn't need to hack to steal much of our technology. They can just pull one unit off a production line over there before its loaded on a container ship.

Re:China tries to crack everything, news at 11 (1)

DamonHD (794830) | about a year and a half ago | (#42954685)

I've seen at least one attack per minute since I took my ISP on-line on the NSF-managed Internet ~1993 (in those days Chile and .vz were the main source IIRC) whenever I've looked. And I still get upwards of ~10,000 SPAM attempts on my mail accounts per day, at least when I could last be bothered to waste the CPU cycles and Flash write cycles to count them. Attacks across the Net are not new. I was the only UK ISP even attempting to protect my own systems with an firewall (which I wrote and we nominally made available http://www.exnet.com/ExFilter/ [exnet.com] though I don't think we sold any) for quite some time...

Rgds

Damon

Re:China tries to crack everything, news at 11 (0)

Anonymous Coward | about a year and a half ago | (#42956949)

It's the new modus operandi of the "Great Firewall of China":

1. Aggressively attack every web server in the world

2. Sysadmins block any petition coming from China

3. ???

4. Profit

The best defence is interdependence (2, Interesting)

Baron_Yam (643147) | about a year and a half ago | (#42950765)

China benefits from a functional United States. So long as the benefits outweigh any prize that would remove them in the taking, Americans are fairly safe from Chinese attack.

Re:The best defence is interdependence (2, Interesting)

Anonymous Coward | about a year and a half ago | (#42951119)

1: Does china control their military any better than the USSR did?

2: Mapping out US electrical utilities is a big deal because if you want to disable your opponents energy infrastructure you need to know where all the substations are at. Those are far more vulnerable than the power stations themselves.

3: Also there are trade secrets to acquire as well as contracts. If you know who they do business with, and you can copy their technology, then you can sell to those companies and make buko bucks doing so.

Re:The best defence is interdependence (1)

drinkypoo (153816) | about a year and a half ago | (#42951893)

Mapping out electrical utilities is not a big deal, it is trivial. It is perfectly legal to drive around the country following power lines and they can find agents who blend in and can claim to be on vacation, looking for property or whatever. If there were a serious danger of attack on us via our infrastructure someone would have done it already because it is so very unprotected.

Re:The best defence is interdependence (3, Informative)

camperdave (969942) | about a year and a half ago | (#42952029)

Mapping out electrical utilities is not a big deal, it is trivial. It is perfectly legal to drive around the country following power lines and they can find agents who blend in and can claim to be on vacation, looking for property or whatever. If there were a serious danger of attack on us via our infrastructure someone would have done it already because it is so very unprotected.

Drive around the country? Google Maps, my friend. You can follow power lines all over the place from the comfort of your living-room.

Re:The best defence is interdependence (1)

silanea (1241518) | about a year and a half ago | (#42953773)

Following power lines on Google Maps? OpenStreetMap [openstreetmap.org] , my friend. Some people have already gone to ridiculous levels of detail in mapping things that formerly would have gotten you a quick visit from your friendly domestic intelligence service. With many countries opening up their data this is only going to get worse, or better, depending on your point of view. And it is all - how fitting for the topic discussed in TFA - readily available on the Internet.

Re:The best defence is interdependence (1)

drinkypoo (153816) | about a year and a half ago | (#42954349)

Well, no, this ties in with my "someone would have done it already" idea, because they would have done it even before google maps.

Re:The best defence is interdependence (2, Informative)

kheldan (1460303) | about a year and a half ago | (#42951171)

China benefits from a functional United States

"Functional" is a very broad term. Everything could be "functional" and still be wired for demolition (in the virtual sense) at the push of a button halfway around the world, and furthermore laced with failsafes so that any attempt to tamper with it blows it all up in our faces. It could be that way right now and nobody knows it (or is telling us about it). Change the names around and think about it a moment: Someone infiltrates Iran's industrial control infrastructure in this way, and once it's completely irrevocable, issue what amounts to a blackmail notice. If it all worked as designed then Iran has no choice but to give in to any demands made, or have irrecovable damage done to their country. Now make this about the U.S. and China instead..

..oh, and here comes some dickheads modding me down to "-1, troll" or "-1, flamebait". Yeah, yeah, whatever.

Re:The best defence is interdependence (0)

Anonymous Coward | about a year and a half ago | (#42952613)

What is the problem teasing the control freak... If the grid was decentralize it wouldn't be a problem.
Put solar panel on each house or power cell in each building and keep the big power station for the industries. It would also be good against wars if each home can be auto sufficient. Oups! it would not satisfy the 21st century God called Economy.

Re:The best defence is interdependence (1)

crutchy (1949900) | about a year and a half ago | (#42953345)

Oups! it would not satisfy the 21st century God called Economy.

it's funny how so many americans think so highly of their "economy"

won't be long and the american economy will be back to the barter system, and there won't be any need to secure the electricity grid because it won't be running because nobody will be able to afford to pay for it

maybe i'm a kook, but everyone who calls out economic bubble bursts in advance are kooks before it happens

Re:The best defence is interdependence (0)

DNS-and-BIND (461968) | about a year and a half ago | (#42952941)

Foreign trade is becoming less and less important to China. Besides, Chinese get extremely emotional and do not think rationally when it comes to the topic of America. They become hateful and want to destroy. Sort of like liberals in that sense.

Re:The best defence is interdependence (1)

kilfarsnar (561956) | about a year and a half ago | (#42956433)

China benefits from a functional United States. So long as the benefits outweigh any prize that would remove them in the taking, Americans are fairly safe from Chinese attack.

This was my first thought. What possible motive would the Chinese have for wanting to bring down the US power grid? Do they want the value of the dollar to plummet? The US and China are economically interdependent. Sure, they want to spy on us. But everyone spies on everyone these days. This supposed threat is just fear mongering.

Paranoia (0, Troll)

Anonymous Coward | about a year and a half ago | (#42950915)

Amercians are so paranoid about socialism and communism. As an outsider looking it it's like a neurosis for your country.

America is the Hegemony of the world, you are the belligerent sabre rattlers, not China. You have released viruses that have taken down other countries power generation systems already.

Stay inside your own fucking country for once.

Re:Paranoia (0)

Anonymous Coward | about a year and a half ago | (#42951013)

Yawn.

Nuke China (-1)

Anonymous Coward | about a year and a half ago | (#42951035)

Problem solved.

Re:Nuke China (0)

Anonymous Coward | about a year and a half ago | (#42951831)

Finally a solution.

Re:Nuke China (1)

Skapare (16644) | about a year and a half ago | (#42951889)

Then where are we going to get cheap stuff?

Enron is the only entity to bring down the grid (0, Offtopic)

Anonymous Coward | about a year and a half ago | (#42951059)

Repeat after me.

The only succesfull attack on the US power grid was perpetrated by Enron, and it was to make money. They shut down entire sections of the grid to make a profit. There were rolling blackouts not because of 'hackers' but because of Enron. And almost nobody went to jail for it, and alot of the same guys wound up in the subprime mortgage business after Enron went belly up. And most of them never saw any consequences either. They just got richer.

Wake up people. We are doing more damage to ourselves than China could ever dream of. They are simply waiting for us to finally implode (with 14 trillion dollars of debt, it wont take long)

China shouldn't be the concern (2, Interesting)

Anonymous Coward | about a year and a half ago | (#42951121)

The problem comes from the previous generation of smart meter addressing which included broadcast groups and whose keys were managed by the utilities via HSMs. The tech is solid, but when you are dealing with utilities whom have very little real sophistication on the IT side dealing with crypto technologies they don't understand, bad things can and will happen.

Get access to the HSM at the provider, or the smart cards they've backed up keys onto, and you can forge a packet that will trigger a significant number of meters. All that could go away if we simply required truck rolls for turn-offs, but that is the most marketable aspect that drives adoption (that and turning on 8 confusing pricing tiers which they help shift the "blame" for a high bill from the utility charging more to the user who "chose to run that A/C during the hottest time of the day".

Grr.

So when do people lose their jobs... (1)

LoadWB (592248) | about a year and a half ago | (#42951229)

...over this bullshit? How many times do we have to hammer into managers and security teams alike that this shit is serious? When do we just start replacing ineptitude with people who give a shit?

bailout baby. bailout! (1)

decora (1710862) | about a year and a half ago | (#42951485)

bailout - its the New Capitalism.

Of considerably greater importance is the race... (0)

Anonymous Coward | about a year and a half ago | (#42951611)

...to secure a large scale carbon-free energy supply. Sadly, few seem interested, or even cognizant of the fact that a secure and abundant energy supply is critical for our prosperity and collective well-being.

Even if we do lose the race, hopefully the Chinese will be willing to sell us thorium molten salt reactors, so that we can maintain some level of society. (and no, renewables and conventional nuclear will never be large scale; far too expensive, and incapable of rapid scaling.)

Internet Air Gap (1)

tokiko (560961) | about a year and a half ago | (#42951621)

Mr. President, we must not allow... an Internet air gap!

Outsourcing...what could possibly go wrong? (1)

patmandu (247443) | about a year and a half ago | (#42951801)

And I'll give you two guesses where the original coding work was outsourced to...

Mistakes happen (1)

Skapare (16644) | about a year and a half ago | (#42951875)

Firewalls are pretty vulnerable. In order to really defend a network, you can never make a mistake. And everybody makes a mistake from time to time And once they are in, they are hard to get out.

Much focus needs to be made on things like well made interfaces and quality documentation that has no ambiguities or errors. Many times mistakes are made because something just wasn't clear enough, and it was interpreted to be something other than what it really is. Security itself is hard in part because of so many parameters and settings. For example some value being entered might be unclear whether it is the name of something, or is being used to search for something, or is being used as a match expression. Some effort also needs to be made in security systems to reduce the configuration complexity. The more complex something is to configure, the more that creates the opportunity for a mistake.

SCADA Systems Are Connected For a Reason (1)

Anonymous Coward | about a year and a half ago | (#42952077)

By definition a SCADA Master system is connected to any number of remote units spread all over geography. The physical links that make up this network are also extremely vulnerable as encrypted SCADA protocols are as yet fairly rare. For a cash strapped utility with a limited number of technicians, being able to remotely connect to equipment in difficult to reach places becomes very attractive.

put down the slants (1)

noshellswill (598066) | about a year and a half ago | (#42952081)

Heh there ..you .. libertoonian slut. Biz-Nazi bitch. Yeah that's right yo  cosmopolitan $$$.hoe with the drool-face grin.  You invited  our deadliest enemy --- the chi.coms into the American industrial production/distribution pathway ... they corrupted it to put a few pennies in yo pocket.  Now they corrupt our information pathways. A fifth column  buried in far as their tit and need to be dug out.  Nice feckin-A work Jackson. I'd see your azzwhole flogged red ...  for a start .....EOF

Re:put down the slants (0)

Anonymous Coward | about a year and a half ago | (#42955379)

Uhm. Yeah. You might want to get back on those meds.

Existing Systems... (1)

Anonymous Coward | about a year and a half ago | (#42952505)

are already compromised? Set up new security using compromised systems; it's the long con.

Useless (0)

Anonymous Coward | about a year and a half ago | (#42954209)

A 3rd world grid, where the cables are hanging from wooden poles don't need Chinese hackers.

A drunk missing the curb, squirrels, ice rain, snow, a storm, dry-rot or termites do the job quite well.

lazy and stupid (1)

slashmydots (2189826) | about a year and a half ago | (#42955793)

Don't put the systems that control the power grid on the internet! Or if you do, make them read-only. If they have to be networked, ever heard of a VLAN? Hell no they haven't because they hire outsourced 3rd party contractors to write this stuff and they don't have to officially deal with it after the check clears. They don't necessarily have to sit there and manage it and deal with the software and control systems on a daily basis. And they certainly aren't the best or brightest programmers, they're just the fastest and laziest. If they were, they'd be working at a better job than a contractor or public company. All we need are people who have the first clue about security to design the control systems for the power grid and we're set.

lol (1)

fazey (2806709) | about a year and a half ago | (#42956611)

Well, before now it wasnt affordable. All the money is in politics. =x

I also wonder about the quality of engineer they hire when they design these systems. Why arent they behind firewalls with ACLs that only allow a what NEEDS to communicate with it. Why arent there secondary boxes, so they can be patched as 0days come out? Why are they running software that has been reported to be riddled with vulnerabilities?

if you find yourself patching THAT often... its time to find new software written by security minded people.
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?
or Connect with...

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>