AgitProp
The Associate Press found more taxpayer funded propaganda: Government video shows mock hacker attack
WASHINGTON – A government video shows the potential destruction caused by hackers seizing control of a crucial part of the U.S. electrical grid: an industrial turbine spinning wildly out of control until it becomes a smoking hulk and power shuts down.
The video, produced for the Homeland Security Department and obtained by The Associated Press on Wednesday, was marked “Official Use Only.” It shows commands quietly triggered by simulated hackers having such a violent reaction that the enormous turbine shudders as pieces fly apart and it belches black-and-white smoke.
There’s no mention in the piece how the “hackers” managed to sneak through the “tubes” to disable the local, mechanical over-rev control on that turbine, or the local control on the voltage spike that a major speed up would cause. The last major black-out was caused by the circuit breakers in the current system reacting to the surges caused by a major transmission line failure. The lack of backbone infrastructure is the problem with the electrical grid, and while the computer networking of the various electrical control systems would have helped reduce the effect of such problems, no comprehensive system exists.
This scenario posits an attack on a network that doesn’t exist, and ignores controls that do exist. They create a fantasy world and then claim to solve a non-existent problem. Someone should explain Second Life to them so they stop spending the tax money of those that live in reality.
23 comments
I think we are far more at risk of direct attack and sabotage than by internet attack and that is what the focus should be on not some virtually impossible external network centric attack.
While I have been out of the industrial control world for about 9 years I am pretty sure most of the control systems are probably that old or older and were not “net” enabled or even capable. All of the control systems use proprietary communications protocols to communicate from supervisory to individual control loops and you would have to plug a controller directly into the system to affect any change. Then as you say numerous interlocks come into play and would shut the turbine down instantly. I’ve installed several complex power control systems in paper mills that control co-generation and tie lines and they are strictly internal systems.
There are fairly extensive sensor networks but the electrical power people string wire, they aren’t going to pay for access to someone else’s network. Down here the “network” is a guy in a pick-up truck driving around and looking up.
Southern Companies, which owns Gulf Power, has their own cell network which began life as their radio network. They handle their communications through that, not the ‘Net, and you need their equipment to access it.
Most of the stuff involved is still analog because it functions more reliably in a high voltage/amperage environment.
Yeah, but you guys are card-carrying members of the Reality-Based Community, and what fun is that?
It’s been about 37 years since I wrote process control s/w, so my expertise is sadly out of date. (I never read about that plant blowing up, so I guess the s/w must have been OK.) But the whole scenario used in that propaganda video depends on viewers not having one single fucking clue how things actually work.
I realize no one can be a specialist in every technology, but is it too much to ask people to apply a reasonability test to what they see and hear? If we could just start with one simple concept, it would help: Not everything is connected to the internet!
Oh, and someone should teach AP writers about dangling participles and misplaced modifiers. That might cut down on those “simulated hackers having such a violent reaction.”
But the video makes me AFRAID! I could be forced to live in complete and scary darkness and not have my tv soaps! My ice cream could melt!
I need to throw myself into the manly macho arms of the Department of der Fatherland Security Blanket!
Because of the marvelous implementation of emergency management locally, both the main switch for the telephone system and the main control center for the electrical grid are in the mandatory hurricane evacuation zone and subject to severe threat from storm surges. The structures can survive just about any wind load, but they are not water-tight.
If they could be controlled over the ‘Net, I assure you they would be, but they are manned during hurricanes at an obscene rate of compensation.
After hurricanes they drive the grid starting from the substations.
After the wonderful job they did after Katrina, I’m sure Americans are ready to trust them.
These are the same cretins who, as you know, are depending on SDI to knock out everything from alien motherships to the sneaky brown-skinned guy putting an envelope of anthrax in my mailbox.
Under the new working conditions at the Postal Service the anthrax spores will die of old age before they reach your mailbox and they’ll have to shut down SDI because it keeps opening and closing everyone’s garage door.
“keeps opening and closing everyone’s garage door” I just saw that on the evening news, and have been LMAO. I hope some of those garage doors belong to the “if you aren’t guilty, you have nothing to fear” crowd.
A number of the garage door companies decided it wouldn’t be noticed if they used a then unused military frequency. A couple of years ago the military started deploying equipment that does use that frequency band and it has been a zoo around here.
Actually, Bryan, the frequency range in question, according to hams of my acquaintance, was always listed as “multiple use” with the military as only one user, and garage door openers were one of the “multiple uses” allowed for that frequency. A few years back the military decided they wanted the frequency and kicked everybody off of it. That was no big deal for the hams, they’ve simply moved to other frequencies. By and large it will not be an issue for modern garage door openers either, they use a different frequency set and require use of an authentication code before they’ll operate the garage door. But that doesn’t address the older already-installed infrastructure of garage doors that were using those frequencies.
Finally: My brother is in the industrial controls business. He has designed installations for water systems and gas pipelines, but electrical controls have similar requirements. The systems *are* Internet-accessible, relying on IP over cellular modems gatewayed to the Internet via whatever methods are handy — but rely on proprietary protocols and proprietary software that is not easily hacked, and all that happens if you manage to crash the control computer is, uhm, well, nothing. Well, somebody might be required to actually manually shut off the valve if the pump needs servicing. If you manage to hack in and shut a valve, the overpressure safeties on one or more pumps will cut out, and, well, nothing happens. Pumps themselves have “on” and “off”. If pumps are “off”, the water towers continue to feed the city from downstream, and alarms start going off at my brother’s company, and they reboot the computer and if it happens again send someone out to the control hut to disconnect the computer from the Internet until they can figure out what’s happening.
In short, only an idiot would design a system that could be physically destroyed via hacking into a computer, and that doesn’t describe folks in the industrial controls biz, who are paranoid to a fault. Given how buggy computer software is, any company that doesn’t have physical fail-safes in place is run by morons. I suppose “Idiot” and “Moron” describes the DHS too…
Ah, I see the problem. There may be places where these innovations have occurred, and there are thousands of programmers in this area working on government contracts, but trying to get anything as modern as networked switching in the civilian area of the Florida Panhandle is a pipe dream, and I don’t mean tobacco.
We have fiber all over for the military, but civilians can’t lease it because the local phone companies and cable companies aren’t interested. There are still service areas where caller ID isn’t available with the telephone service because the local switches don’t support it. The information infrastructure is world-class on the bases and third world in the rest of the area. Given all of the opportunities to upgrade by the hurricanes you would have thought it would be otherwise, but they keep patching things together.
All of the systems control stuff I did was in New York, and networking the systems for process control couldn’t over-ride local switches or safeguards. There isn’t a major motor, compressor, pump, turbine, or generator that doesn’t have multiple cut-out switches for different conditions. I have never seen a major machine in a factory that didn’t have a large red “kill” switch on it.
It would be nice if they did something about chemical plants and storage facilities, if they wanted to actually provide some protection with our money.
My brother’s company is using the infrastructure they developed for servicing the oil industry to service public utilities. Some of that infrastructure is pretty whack. They had to buy their own phone company (one of the little local ones) to get access to the long distance network, and they occasionally have to bounce things around via microwave to get them to a point where they can access a POP. I was not aware that other companies in other states were not capable of doing this. Basically all the big public utilities in Louisiana (with the exception of Entergy) have these kinds of automated systems in place, largely because the PUC has been pretty proactive in requiring the Bell System to provide open access to other phone companies. But the notion of making a turbine explode via a command sent through the Internet is just plain ludicrous. It’s been 20 years since I worked in the controls field in an oil refinery and gas pipeline setting, but one thing I do recall is that there’s overpressure and other such fail-safes all over the freakin’ place to make sure that nothing disasterous can happen, and you can NOT override them with Internet commands — they’re direct-wired or mechanical in nature. Believe me, they’re direct wired — I remember being up to my knees in freakin’ mud in a pouring rain feeding that big-ass bundle of wires through conduits bigger around than my legs (we had a ditch witch pulling on the other end). Rubber boots aren’t so hot when the mud gets deeper than the boots, that was one day I coulda used hip waders :-}. My understanding from talking to my brother is that it isn’t so different today.
All of the infrastructure improvements that come are paid for by developers for St. Joe Paper and their work to the East of us. Sprint/Embarq bought the old Central Telephone system and there isn’t even a local office in the county. The two western-most counties have Bell South/ATT, but they are rural outside of the city of Pensacola.
We are between a cluster in Mobile and the St. Joe cluster to the East. That’s why the military pulled all of the fiber in for communications, the existing system can’t handle what’s needed.
The fiber trunk is laid in the I-10 right-of-way with branches for various military facilities coming down from the North.
The main electrical trunk follows US-98 along the coast line, so it gets blown down.
The bases have feeds both from the US-98 lines and other lines from Alabama.
This is a messed up area of the US as far as utilities because we are built out. The military reservation surrounds the civilian area, and there is no more growth possible, so the utilities don’t upgrade.
The use of microwave is restricted by the military and their test ranges which extend out into the Gulf. Broadcast television signals are regularly interrupted by aircraft flying through the signal making cable or satellite a requirement.
Who needs a hacker to down the power grid?
We had a major wildfire nearly knock us back to Ludditeville.
oh, and not to mention AT&T cutting the wires the other day in Tennessee which had air traffic controllers in the Memphis area using their cellphones to other centers to guide the planes in.
scattered thoughts…
scada systems are vulnerable, largely because they came along before anybody worried about internet security [companies do spend more on security than coffee] but it looks like a fairly simple fix [firewallz? whuzzat?] the problem is in the huge number of systems that need fixing.
they’ve already been working on it for awhile, like you say, why now? what’s about to come up that they need to scare us about? i suppose it’s possible that utilites are dragging their feet a bit, and the government is trying to scare them into moving faster on this.
utilities do have all kinds of backups and redundancies, and one turbine blowing up isn’t likely to start a whole cascade of turbines and such blowing up, but when de-regulation happened a lot of them started cutting corners here and there, so maybe they’re a bit weaker than we think they are.
the ones i worry about are the nuclear plants and the chemical plants and refineries, things that would make a big boom if something got out of contol.
Air traffic control is the most vulnerable system there is and they still don’t have adequate protection on that, even though it has been hacked, albeit by accident. The broken cable in a wireless world is absurd for a major government facility that already uses radio communications. The mind boggles.
Most of the utility stuff I’ve seen deals with monitoring more than control, Hipparchia, and major machines are still made with the analog safety switches when shipped.
They never scare business. They never push business. They certainly aren’t going to suggest that business spend any money just to keep the nation safer, unless the tax credits are twice the cost of the changes.
Before we worry about ‘Net security, they should do something about physical security at chemical and nuclear sites.
When I was living in SoCal a guy fell off his boat, or something, and swam ashore at the San Onofre nuclear power plant. He couldn’t find anyone for hours to help him.
Most of the utility stuff I’ve seen deals with monitoring more than control
shhhh. they don’t want us to know that. oh, and no need to worry about physical plant security. once we pull out of iraq, some [cough cough] security companies will be looking for work.
That’s a happy thought for a morning, Hipparchia – trigger happy people in a chemical plant.
i do like things that go boom!, but that particular scenario is not a happy place to be.
I’ve always loved how they tend to build Interstate overpasses around chemical plants. I don’t think anyone can work fast enough to prevent the effect of a car flying off an I-95 off ramp and crashing into a working plant.
taking car bombs to a whole new level. great, now we’ll have a national no-drive list.
y’know, the only vehicles i’ve ever actually seen fly off of those ramps have been tanker trucks. that should make a nice little conflagration.