DOE Releases Interim Report on Blackouts/Power Outages, Focus on Cyber Security

From: Geoff Shively (gshively_at_pivx.com)
Date: 11/21/03

  • Next message: Norbert Bollow: "help needed with DotGNU security review (was Re: ..researchers org..)" 
    To: <bugtraq@securityfocus.com>
Date: Fri, 21 Nov 2003 02:17:24 -0800

    The Department of Energy (http://www.energy.gov) has released a interim
    report on the Aug 14th power outages.

    http://energy.gov/engine/content.doPUBLIC_ID=11860&BT_CODE=DOEHOME&TT_CODE=SPOTLIGHTDOCUMENT

    *remote terminal units (RTU)
    *distributed control systems (DCS)
    *supervisory control and data acquisition (SCADA)

    Straight to the good stuff, security.... which starts on page 29, (phase 2
    of failure matrix) the SWG (Security Working Group, or Star Wars Galaxies ;)
    outlines that computer failure was a primary cause of the blackouts. Logging
    systems failed first, 3 Remote Terminals (RTUs) failed along with
    unspecified 'dial-ups'. Can anyone shed some light on what 'dial-ups' they
    are talking about?

    ~~~~~~~~~~~ Key Events ~~~~~~~~~~~
    The first computer failure was to logging and alarm systems.

    14:14 EDT: The control room operators lost the logging and alarm function.
    14:20 EDT: Several remote location console failed
    14:41 EDT: The primary control system server hosting the alarm function
    failed/ Its applications and functions were passed over to a backup server
    that was standing by.
    14:54 EDT: The back-up computer failed, and all functions that were running
    on it stopped.
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Refresh rates of screens displaying critical data were reduced on an average
    of 1 to 3 seconds, and slowed as long as 59 seconds per screen. For data
    that changes hundreds of times a second, I would say that renders the
    terminals useless. Quite similar to what Sandia National Laboratories
    (http://www.sandia.gov/) illustrates here, misrepresentation or spoofed data
    being displayed:
    http://www.pbs.org/wgbh/pages/frontline/shows/cyberwar/view/

    Sadly this report is over 130 pages, but draws no definitive links or cause
    to the failures. In one paragraph malice activity is being denounced, the
    next it's said that investigations are inconclusive and need more effort.

    At least they admit all over the report that the SCADA, DCS, RTU, and EMS
    systems are all insecure and highly vulnerable- something that many pledged
    was untrue when this topic first surfaced.

    Cheers,
    Geoff Shively
    CTO
    PivX Solutions
    24 Corporate Plaza #180
    Newport Beach, CA 92660
    http://www.pivx.com
    gshively@pivx.com
    949-720-4628

    PivX defines "Proactive Threat Mitigation. Get a FREE Beta Version of
    Qwik-Fix (tm)
    <http://www.qwik-fix.net>

  • Next message: Norbert Bollow: "help needed with DotGNU security review (was Re: ..researchers org..)"