Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security IT

Wind Power Firm Sees No Evidence of Hack 99

Posted by CmdrTaco from the why-can't-we-all-get-along dept.
alphadogg writes "One day after a hacker posted screen shots and data to a hacking mailing list, saying he had broken into a New Mexico wind turbine facility, the company that runs the turbines says it has seen no evidence of a computer intrusion. The hacker, who calls himself Bigr R, made the claims Saturday, posting screenshots of the facility's management interface, screenshots of an FTP server and project management system, as well as Web server info and configuration data from a Cisco router."
This discussion has been archived. No new comments can be posted.

Wind Power Firm Sees No Evidence of Hack More

Wind Power Firm Sees No Evidence of Hack

Comments Filter:

  • Language (Score:3, Interesting)

    by bezking ( 1274298 ) on Monday April 18, 2011 @08:02AM (#35854558)
    If you look at the screenshots he posted (example [imageshack.us]) you'll see that some of the screens were in the German language or a derivative thereof. Why would a New Mexican power plant have its systems in German!?

    • Quoting The Previous F Article

      "If this is a hoax, it's really well done".

      Is *Faking* break-ins the new L33T?

      • I think the recent escapades of "Anonymous" has fired up the imaginations of a lot of wannabes. So yes, faking it is the new 1337 -- for some people.

      • Re: (Score:2)

        by Lumpy ( 12016 )

        Among the script kiddies? yes, yes it is.

      • Re: (Score:2)

        by Anrego ( 830717 ) *

        Is *Faking* break-ins the new L33T?

        Oh it always has been. From the kids who copy+pastes stuff from their windows system file into msn messanger so his/her friends think they are being "hacked", to people using hostnames to determine where someone lives on IRC and try to scare them with the information...

    • Re:Language (Score:5, Interesting)

      by 0100010001010011 ( 652467 ) on Monday April 18, 2011 @08:16AM (#35854690)

      Germans Make Good Stuff.

      Seriously, if you start getting into high level automation of PLC and other industrial systems, there are only a few key players in the game. Siemens [siemens.com] is one of those companies. Sure enough, if you search for SINAMICS S120, the Siemens page is the first hit.

      How often do you dump your error codes into 5-10 languages? If you go to Europe and use a piece of GE technology you'll probably get errors in English.

      • Re: (Score:2)

        by Lumpy ( 12016 )

        Allen Bradley is out there quite heavy. in fact I saw far more of it than siemens stuff.

        • Re: (Score:1)

          by mooboy ( 191903 )

          Allen Bradley is out there quite heavy. in fact I saw far more of it than siemens stuff.

          AB is big in the US only. Siemens is by far the largest controls systems provider internationally.

        • Doesn't really matter, SINAMICS S120 is clearly Siemens gear.

      • Germans Make Good Stuff.

        No shit, look at the ShamWow! Vince wasn't kidding.

      • Re: (Score:2)

        by Themer ( 994454 )
        All of the Siemens PLC error codes come out in English for English interfaces. I have used them extensively.

      • Re: (Score:1)

        by Anonymous Coward

        Wait, I seem to recall something in the news recently about some security problems with Siemens controllers in some industrial equipment. Something about a virus or worm getting into software on the computers that ran the facility, and from there into the controller software itself, where it proceeded to mess up the industrial gear. I'm having a little trouble remembering the details, though. Hmmm... it was all in the news a while ago. I think maybe the problems were in Iran?

    • Re: (Score:3)

      by shish ( 588640 )
      Looking at that example, a more confusing thing comes to mind: why would their systems be built with MS-Paint o_O?

      • Hahahahah.. I didn't consider the screenshots worth looking at until you said that.. that's some extremely unprofessional interface design.. geez.

        • Re: (Score:1)

          by Anonymous Coward

          that's some extremely unprofessional interface design

          Actually that's highly professional. Industrial/professional UIs are never pretty because it's not a requirement. Why waste time and money on making things pretty? These aren't consumer products where the buyer first and foremost looks at how it looks instead of what it does.

          • There's a difference between "not pretty" and "shitty". Right angled lines would have been better than freehand in MS paint. It would have taken all of 3 seconds more, and look infinitely better.

          • Re: (Score:2)

            by tlhIngan ( 30335 )

            that's some extremely unprofessional interface design

            Actually that's highly professional. Industrial/professional UIs are never pretty because it's not a requirement. Why waste time and money on making things pretty? These aren't consumer products where the buyer first and foremost looks at how it looks instead of what it does.

            I've grown to think that the more expensive and/or specialized the program, the worse the UI is. And it's not about making the UI "pretty" but more "usable".

            Sure the program is design

    • Sinamic is a Siemens product. Siemens is one of the larger producers of controls for industry. I use a number of their products at my job. It's not uncommon for these types of controls to offer multi-language support. I wonder if that wasn't part of this guys hack.
      I don't know much about the Siemens "front end" though, as the plant I work for uses a different control interface.

    • If you look at the screenshots he posted (example [imageshack.us]) you'll see that some of the screens were in the German language or a derivative thereof.

      English?

      • If you look at the screenshots he posted (example [imageshack.us]) you'll see that some of the screens were in the German language or a derivative thereof.

        English?

        Yes.

    • ABB also makes DCS systems and they are a swiss company (ie: speak German).

      Another poster already pointed out Siemens as well.

    • If you look at the screenshots he posted (example [imageshack.us]) you'll see that some of the screens were in the German language or a derivative thereof. Why would a New Mexican power plant have its systems in German!?

      Because if the hacker got into anything, it was the honeypot that he/she was meant to get into.

    • Not unheard of. Here in California, I actually have a injection molding press at my factory that has its control screens set for English, but it still spits out some German words from time to time.
    • That looks more like a page from a manual rather than a screenshot, though. Wold have expected the screenshot to look more like this [siemens.com].
    • Germany manufacture a lot of mechanical parts and also have a strong industrial relationship with mexico. It is not unlikely that the hacker was employed in some part of the process of building the plant.

      It should also be noted how major the difference is between a hack at a wind farm and a hack at a nuclear power facility, even a fake hack. Whats the worst you could do if you hacked a wind turbine? Well you could probably break it given the right wind conditions.

  • None of this means it didn't happen (Score:5, Insightful)

    by royallthefourth ( 1564389 ) <royallthefourth@gmail.com> on Monday April 18, 2011 @08:04AM (#35854576)

    It's possible that the IT staff who failed to secure the networks and websites also lack the expertise to detect an intruder. It's certainly not easy, and if they were able to cleanly socially engineer (or perhaps guess) passwords to get it done, there may be no way to detect it at all.

    • Re: (Score:2)

      by Anrego ( 830717 ) *

      One day seems a bit quick to do an investigation.

      That said, I do think this was probably a hoax.

      • Re: (Score:3)

        by afidel ( 530433 )
        Not really, with a good IDS system you should have no trouble. We log everything that happens on our server and DMZ vlan's to a Network General box and could easily pull up all conversations between the firewall and any server box, or any workstation and any DMZ box. I would hope critical infrastructure such as a SCADA system is at least as well monitored.

        • Re: (Score:2, Insightful)

          by Anonymous Coward

          I am sorry to disappoint you, having worked at a company developing SCADA systems... these systems are developed a bit like this:

          Assumption 1: SCADA systems... should be on a completely separate infrastructure.
          Assumption 2: If the system is on a separate, secure infrastructure... we have no need for additional security measures.

          Reality-check 1: 'I want to see what they h*ck is going on at the site when I'm at home!!!'
          Reality-check 2: Nobody listens to the security-conscious-g

        • Re: (Score:2)

          by Lumpy ( 12016 )

          No it's not. Most do not have any IDS let alone any decent networking. Most SCADA systems are lowest bidder and competent IT and networking staff are not in the equation at those price levels.

          • Re: (Score:2)

            by afidel ( 530433 )
            Sweet, well then when they get hacked and cause widespread outages I hope they get fined megabucks for every minute of downtime and are sued by their critical contract customers for gross negligence. Someone needs to force these guys to do things in a competent manner and apparently a decade of being warned about cybercrime hasn't been sufficient so I guess the only way they will listen is if it hits their bottom line.

            • Re: (Score:2)

              by Anrego ( 830717 ) *

              so I guess the only way they will listen is if it hits their bottom line

              Even then, probably not. The cost of even a major incident is going to be less than doing it properly in the first place.. and the government is gonna be bailing them out, not fining them!

              It's a shitty system and it's all gonna fail one day ... but no point deluding ourselves to the reality of the current situation.

              Did you not see die hard 4!

    • Re: (Score:3, Funny)

      by Anonymous Coward

      I would argue that the burden of proof is on the hacker, and not on the power company.

    • The problem is that most oversights in security will be continue to be missed when the site is reviewed. The same people who didn't think using postit notes on monitors to keep track of passwords wouldn't think that was a problem even after 90% of their workforce are carrying in cellphones with cameras built in every day.

    • Re: (Score:3)

      by Lumpy ( 12016 )

      They checked the windows 98 gateway machine and their virus scanner did not find anything. There is no way he got in, the AV software said so!

    • It's possible the guy got in. The evidence he presents is far from conclusive. It's possible he didn't. The operator says there's no evidence for it. Without conclusive evidence, all we can do is idly speculate, which makes this topic perfect for Slashdot.

      The way in, apparently, was through a Cisco border router. It only takes a moment to check the router logs. Both successful and failed logins are recorded. Resetting the log leaves evidence. If the site is competently managed, the log events are

  • This whole thing smelled funny from the beginning.

    • I'm not so sure. Couldn't this be Iranian retaliation for Stuxnet?

      • Re: (Score:2)

        by necro81 ( 917438 )
        Probably the Iranians have bigger targets than the SCADA network for a privately-owned wind farm in New Mexico. Stuxnet was targeted at a key facility of the Iranian nuclear infrastructure: a non-overt attack on the Iranian military and government. I would expect if the Iranians were pissed at us over that they would attempt to retaliate in kind.

  • Not Really (Score:1, Interesting)

    by Anonymous Coward

    They're trying to goad an emotionally immature hacker into providing even more evidence.

    Making the criminals do the investigative legwork .. now that's smart policing.

  • Wind Turbine Firm hack confirmed: "Oh wait, never mind. We found his rootkit on port 31337 going out from our webserver! D'oh!"

  • Simple Message (Score:2, Insightful)

    by scubamage ( 727538 )
    Absence of evidence is not evidence of absence.

    • Re: (Score:1)

      by Anonymous Coward

      You could be a lawyer for the RIAA!

    • Re:Simple Message (Score:4, Informative)

      by LordLimecat ( 1103839 ) on Monday April 18, 2011 @08:18AM (#35854708)

      And if youll note, it doesnt say "there was no hack", but that "they see no evidence".

    • Re: (Score:1)

      by mooboy ( 191903 )

      Absence of evidence is not evidence of absence.

      Perhaps, but crappy evidence is evidence of crap, IMHO. Take a look at the dude's screen shots. Any power company using such poorly put together screens, with no interesting status info, no proper overview screen with worthwhile data, isn't really a power company, but some kiddies dream.

  • Otherwise I imagine the hacker will try to put up a demonstration.

    i wonder what can be done with access to that system.

    • -send turbines spinning under power -starting changing earth's rotational axis -Neptunian winters -God help us
  • Is that the most likely scenario is that this guy is for real. And isn't that, as a former employee, he has old configs stored somewhere that he still has access to (like a personal laptop). As well as screen shots related to training material. Nah this guy that was just fired and has offered up no real-time evidence is probably telling the truth. Just because that would make it more interesting.
  • Cause Norton Anti-Virus sez so!
  • It's a non-denial denial!
  • It's "cracker [catb.org]", not "hacker". Come on /. You should know better.

  • He was just that good (Score:3)

    by JTsyo ( 1338447 ) on Monday April 18, 2011 @10:08AM (#35855728) Journal
    You can't backtrace him.

    • You can't backtrace him.

      Maybe they can't, but just wait until they get the CyberPolice on his trail! They can backtrace anyone.

      • Maybe they can't, but just wait until they get the CyberPolice on his trail! They can backtrace anyone.

        True enough, and the consequences will never be the same. He done goofed.

  • I'm not sure if NextEra is saying it didn't happen, they can't tell, or they are refuting that the screenshots were taken due to a 'hack'. Either way, some of the information looks too credible. For example, NextEra provides output data from wind farms and this data goes into various OASIS systems. One screenshot shows what are presumably OASIS files from as recent as last week. All NextEra would need to do is double check those files, make sure that timestamps and sizes match what exists and that is proof.

  • Stupid... (Score:3)

    by WaffleMonster ( 969671 ) on Monday April 18, 2011 @11:43AM (#35856746)

    If BigR is really a former disgruntled employee he might as well have just posted his full name and address along with the dumps.

    The response by Benji on the seclist mailing list sums it up: "so how long do you give yourself before you're in prison?"

  • I hacked slashdot. As evidence, i found this in the slashdot servers:

    0x38a7fe1a

Slashdot Top Deals

Been Transferred Lately?

Close