bugtraq - DOE Releases Interim Report on Blackouts/Power Outages, Focus on Cyber Security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 21 Nov 2003 01:58:25 -0800
From: "Geoff Shively" <gshively@...x.com>
To: <full-disclosure@...ts.netsys.com>, <bugtraq@...urityfocus.com>
Cc: "Andre Ludwig" <andre@...b-portal.com>, <cta@...in.net>,
   <tlarholm@...x.com>
Subject: DOE Releases Interim Report on Blackouts/Power Outages, Focus on Cyber Security

The Department of Energy (http://www.energy.gov) has released a interim report on the Aug 14th power outages.

http://energy.gov/engine/content.do?PUBLIC_ID=11860&BT_CODE=DOEHOME&TT_CODE=SPOTLIGHTDOCUMENT

*remote terminal units (RTU)
*distributed control systems (DCS)
*supervisory control and data acquisition (SCADA)

Straight to the good stuff, security.... which starts on page 29, (phase 2 of failure matrix) the SWG (Security Working Group, or Star Wars Galaxies ;) outlines that computer failure was a primary cause of the blackouts. Logging systems failed first, 3 Remote Terminals (RTUs) failed along with unspecified 'dial-ups'. Can anyone shed some light on what 'dial-ups' they are talking about?

~~~~~~~~~~~ Key Events ~~~~~~~~~~~ 
The first computer failure was to logging and alarm systems. 

14:14 EDT: The control room operators lost the logging and alarm function.
14:20 EDT: Several remote location console failed
14:41 EDT: The primary control system server hosting the alarm function failed/ Its applications and functions were passed over to a backup server that was standing by.
14:54 EDT: The back-up computer failed, and all functions that were running on it stopped.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Refresh rates of screens displaying critical data were reduced on an average of 1 to 3 seconds, and slowed as long as 59 seconds per screen. For data that changes hundreds of times a second, I would say that renders the terminals useless.  Quite similar to what Sandia National Laboratories (http://www.sandia.gov/) illustrates here, misrepresentation or spoofed data being displayed: http://www.pbs.org/wgbh/pages/frontline/shows/cyberwar/view/

Sadly this report is over 130 pages, but draws no definitive links or cause to the failures. In one paragraph malice activity is being denounced, the next it's said that investigations are inconclusive and need more effort.

At least they admit all over the report that the SCADA, DCS, RTU, and EMS systems are all insecure and highly vulnerable- something that many pledged was untrue when this topic first surfaced.

Cheers,
Geoff Shively
CTO
PivX Solutions
24 Corporate Plaza #180
Newport Beach, CA 92660
http://www.pivx.com
gshively@...x.com
949-720-4628

PivX defines "Proactive Threat Mitigation. Get a FREE Beta Version of Qwik-Fix (tm)
<http://www.qwik-fix.net>

Content of type "text/html" skipped