NHPR did a long piece this morning. They talked about regulation, deregulation, and who was in favor of more regulation. Not once did they talk about what to do about vulnerabilities.
What to do is straight forward. Do not use the public internet to monitor or control generators, circuit breakers or other equipment. And do not use Windows computers for any of the same purposes.
Back when we were selling data acquisition equipment to the electric generating industry, I saw a remote controled generator. A big gas turbine unit was humming happily away. They had an ordinary desktop computer running a remote control program. The computer monitor showed an image of the turbine, a little arrow showed it was turning, instrument readings for oil temp, oil pressure, exhaust gas temp, rpm, amps, volts, engine pressure ratio, and more. It was about 10:30 AM, and the power station man sat down at the remote control and ordered the generator to shut down. It was a peaking plant, only run for the morning and evening power peaks, and 10:30 was the end of the morning peak period. A few key clicks, and the big turbine obediently shut down, we could see the RPM and EGT winding down on the display.
The turbine was l0cated a couple of miles away. The controller sent little messages (Start Up, Shut Down) over the internet. A computer at the remote generator listened to the internet and acted upon orders coming in from the net.
All an enemy hacker needs do, is learn the addresses and the codes used and send his own commands to the turbine. If the computer at the turbine is a Windows machine he can load his own code into it and really go to town. First step of such an invasive program is to reject all messages from it's proper owner, and only accept commands from the hacker.
The fix is simple. Connect the remote computer to the control center with a pair of your own wires, hung on your own poles, by your own people. Then the command link is secure against any sort of Internet attack. To gain control the hacker has to climb a pole and splice in a tap. Hackers are swivel chair people, they don't climb poles.
As for Windows, we all know how vulnerable Windows is to anything. The famous Stuxnet program that did great damage to the Iranian nuclear program spread via Windows "autorun" feature. Windows has so many security holes that it's beyond fixing. Computers running Linux, Unix, MAC OS, anything, can be made secure. Windows is so bad that it is beyond hope.
2 comments:
All we need to do for an example of of this problem is the movie "Live Free or Die Hard" with Bruce Willis. It gave a perfect example of what could happen to all of our infrastructure if it were vulnerable to hackers. Not a pretty picture at all.
I haven't seen that one, I'll have to put it in my Netflix queue. But the viruses (virii?) can walk off the net into to my carefully updated and anti virus protected XP desktop. They can do the same thing to Windows machines working the power grid. Don't use Windows, stay off the public Internet, and the grid will be safer.
Aviation Week published some photos of a Russian hydro electric station, both before, and after an ill chosen remote control order opened the wrong valve and caused a water hammer strong enough to wreck the place. The after photo showed generators ripped out off their mounts, the concrete floor shattered, and place looked like it had been bombed. So it's a real threat, not just something that happens in the movies.
Post a Comment