SCADA Hacking Video Leaked to Press

(No Ratings Yet. Rate It!)

 Loading ...

Drudge linked to a story about a video the AP has showing a hacker attack on a SCADA system at a mock-up powerplant.  Not sure why this video was leaked, but it shows what can happen if an intruder manages to shut down computers that control or monitor critical infrastructure.

In this image from video released by the Department of Homeland Security, smoke pours from an expensive electrical turbine during a March 4, 2007, demonstration by the Idaho National Laboratory, which was simulating a hacker attack against the U.S. electrical grid. (AP Photo/Dept. of Homeland Security)

From the AP here:

A government video shows the potential destruction caused by hackers seizing control of a crucial part of the U.S. electrical grid: an industrial turbine spinning wildly out of control until it becomes a smoking hulk and power shuts down.

The video, produced for the Homeland Security Department and obtained by The Associated Press on Wednesday, was marked “Official Use Only.” It shows commands quietly triggered by simulated hackers having such a violent reaction that the enormous turbine shudders as pieces fly apart and it belches black-and-white smoke.

The video was produced for top U.S. policy makers by the Idaho National Laboratory, which has studied (SCADA systems.)

“They’ve taken a theoretical attack and they’ve shown in a very demonstrable way the impact you can have using cyber means and cyber techniques against this type of infrastructure,” said Amit Yoran, former U.S. cybersecurity chief for the Bush administration. Yoran is chief executive for NetWitness Corp., which sells sophisticated network monitoring software.
 
“It’s so graphic,” Yoran said. “Talking about bits and bytes doesn’t have the same impact as seeing something catch fire.”

The Idaho National Laboratory is huge.  It is a giant facility where they recreate SCADA systems from all around the country in order to study and know their vulnerability and weaknesses so we as a nation can better protect ourselves post 9-11.

Lots of people think that our critical infrastructure like our power systems can’t be hacked-  that they are run on separate networks and not connected to the internet.  Well, the networks may be separate, but I know of two incidents. 

I blogged about the Pennsylvania SCADA system that was hacked because an employee hooked up his own botnet-infected laptop to it.  In another incident, a SCADA system failed at FirstEnergy in Ohio during the height of the SQL Slammer worm in 2003.  The system that failed was a unix-based host, but were engineers dealing with slammer on other systems instead of monitoring control systems?