Experts Hack Power Grid

One of the most critical pieces of infrastructure in the United States today is our Power Grid. Time and time again, it has proven vulnerable to accidents. This time, however, it was vulnerable to an outside attack.

Ira Winkler, a world-renowned Information Security Expert recently addressed an RSA conference, and told them about a recent exploit; the successful penetration of a power company. Ira and his team were hired to test the security of an unnamed large power company. Through a combination of Social Engineering and Browser Exploits, his team was able to gain access to the SCADA systems used to control the power plant and distribution. This took a total of 2 days to accomplish; one day to set up, and one day to penetrate.

Many utility companies have SCADA Systems and the Administrative systems on the same network that have outside access to the internet. I have encountered places where they run on the same computers (just as Ira Winkler's team discovered). Power grids are not the only systems that run SCADA either--Water, Wastewater, Natural Gas supply--all of these vital and critical infrastructure components run control systems. The fortunate thing with the latter list is that they are nowhere near as interconnected as the Power Grid; but imagine dumping raw sewage from a lift station into a populated area, or cutting off the water supply to a city--or worse; opening all of the floodgates on a dam upstream of a populated area.

The DOE through its' subsidiary agency, the Federal Energy Regulatory Commission, recently published a set of standards designed to secure this critical part of the infrastructure. Many power companies, however, have alluded to the fact that they are running older SCADA software that could fail to adhere to strict guidelines for patching or security management. FERC's response is merely that the power companies are expected to upgrade their systems; something that should have been happening all along.