Hackers Are Targeting Nuclear Facilities, Homeland Security Dept. And F.B.I. Say

https://www.nytimes.com/2017/07/06/technology/nuclear-plant-hack-report.html

by danijelb • 9 years ago

111 122 9 years ago

nytimes.com

watertorock• 9 years ago

I'd imagine every piece of infrastructure is targeted that can be.

What's going to be done about it is the real question.

nthcolumn4• 9 years ago

True but a wind farm taken over by hackers is still just a wind farm not a thermonuclear weapon.

DennisP2• 9 years ago

A nuclear plant taken over by hackers isn't a thermonuclear weapon either.

packetized• 9 years ago

This might be the most top-heavy title I've ever read, given the economy of words. "Hackers Are Targeting Nuclear Facilities, Say Homeland Security Dept. and F.B.I." would be much more balanced - or am I just off my rocker?

milkytron• 9 years ago

This made me wonder if articles purposely place more meaning words closer to the front to get attention of viewers sooner.

I'm no expert in journalism by any means, and I guess this comment has nothing to do with the article itself, but it did spark some curiosity.

nthcolumn4• 9 years ago

Indubitably any facility of sufficient complexity or strategic value will draw more or less continuous unwanted attention from foreign state actors. 'Targeted by hackers' could include port scans and phishing attempts. What with the recent, perhaps only perceived, upsurge in activity it is hard to know whether this is complete bunk, nsa-script-kiddie open season or something even more sinister. It is sad that the agencies in question no longer enjoy the level of trust by the public they once had.

narrator• 9 years ago

Whenever I see (nytimes.com) after a URL I know that there's some big long bill that's been sitting in a drawer somewhere that's going to suddenly get pulled out of that drawer and will be voted on next week and this is just setting the stage for it.

late2part• 9 years ago

Thanks for posting this. Reminding us of correlations like this is important. Sometimes we can't see the forest for the trees. Thank you.

pgwhalen• 9 years ago

Interesting, can you point to previous examples of this phenomenon? Would love to see the correlation.

CodeWriter235• 9 years ago

The most obvious would be The Patriot Act, some 342 pages presented to Congress just 6 days after 9/11.

tree_of_item2• 9 years ago

When has this happened previously? I'm not sure what you're implying.

1001101• 9 years ago

... or it's the eve of the first Trump/Putin meeting at the G20.

BoiledCabbage• 9 years ago

You're implying that most articles on nytimes are written to preemtively lay support for future bills? That seems like a pretty strong statement that'd need at list a hint of evidence with it.

Has this been a pattern? Do you have examples? Are there stories that the nytimes covers that other papers don't cover that suddenly become bills? What inspired this?

Your post comes across as a lot of innuendo without providing any support... at all.

beachbum8029• 9 years ago

Go to bed, ny times reporter.

awad• 9 years ago

What sites do you trust?

weq2• 9 years ago

Exactly.

hackers? since may? ie. when all the shadow_brokers exploits were released that any script-kiddy could point and click at a box and pwn it..?

the article implies these are nation state actors trying todo harm. a BS article trying to push a political agenda.

protomyth2• 9 years ago

Since May, hackers have been penetrating the computer networks of companies that operate nuclear power stations and other energy facilities, as well as manufacturing plants in the United States and other countries.

Wolf Creek officials said that while they could not comment on cyberattacks or security issues, no “operations systems” had been affected and that their corporate network and the internet were separate from the network that runs the plant.

Good, I'm glad they are not insane, but I also hope they have pretty stringent rules to keep personnel from plugging in unverified devices. Stuxnet should be a lesson to all.

dreamcompiler2• 9 years ago

They're not insane; they're just lying. 15 years ago it was believable that control networks were airgapped from the Internet. But today, the likelihood that some low-level tech has plugged a wifi router into the control network for his own convenience approaches 100%.

jerrylives• 9 years ago

https://arstechnica.com/security/2015/10/report-finds-many-n...

DrScump• 9 years ago

Airgapping alone isn't enough, as the success of Stuxnet demonstrated.

flukus4• 9 years ago

15 years ago the world was still coming to grips with cyber security, in the desktop realm it was a race to install and patch windows xp before it became infected with malware.

Today if infrastructure is not 100% airgapped (and even that isn't necessarily enough) then it should be considered criminal negligence.

mirkules3• 9 years ago

If you did that in my previous company, you would get a visit from IT and a good tongue-lashing from your manager within 15 minutes of doing that. As a 20-something, it seemed like an overreaction. As a 30-something, it seems perfectly reasonable.

threepipeproblm• 9 years ago

This seems unlikely, based on a past experience writing software for a nuclear facility.

While nothing is unassailable, everything I experienced made me feel generally better about the approach these people took to safety. They wouldn't allow people to use spreadsheets to make decisions... literally this was not allowed, you had to have an app with testing and verification systems. Also, they pointed large automatic weapons at me while searching every crevice of my car, using long sticks with mirrors and various other instruments. It was a relief to see that they take security and reliability more seriously than any other kind of outfit I've worked for, ever. The monitoring had monitoring.

drewmol• 9 years ago

I've sure seen a lot of PR statements regarding cyber security that read: "We can't comment on X. That being said, here's a vauge comment on X that sounds reassuring and highlights our competency!"

madaxe_again• 9 years ago

Wasn't wolf creek one of the addresses from that link a year or so back with insecure VNC installs open to the internet? There was quite a bit of critical infrastructure on there, wide open, iirc.

imglorp• 9 years ago

Note that just penetrating the office/business network is highly valuable, because there's probably technical information on there like training materials, blueprints, operations guides, procedures, etc. This can help the attackers immensely to get past the airgap and once they get past the airgap.

astrodust8• 9 years ago

The US administration is under the impression that they can wage a conventional war against an adversary like North Korea, yet this is the same nation-state actor that is claimed to have hacked into Sony.

If North Korea is attacked militarily expect hell to be unleashed online. What we've seen is just experiments, not actual attacks. A full-out war could be vastly more damaging.

thehardsphere5• 9 years ago

Please. "Hell online" is going to be trivial compared to the thousands who will die in the first hours of the conventional artillery shelling of Seoul. Let's not pretend that some leaked emails are in any way going to be as bad as that.

And frankly, hacking into Sony is not that hard to do.

cmurf• 9 years ago

The casualties will, and should, stun people. The Korean War, 1950-1953, total civilians killed/wounded: 2.5 million (wikipedia), and cost $341 billion in 2011 dollars (Congressional Research Service).

And then there will be a massive refugee problem on both sides.

flukus4• 9 years ago

Last week Maersk was shutdown worldwide for 24 hours, how long do you think major cities can keep going without that cargo coming in? How long can the keep going if the water or electricity supply was compromised?

As terrible as a shooting war in Korea would be, it's still a lot better than a potential full scale cyber war.

astrodust8• 9 years ago

I honestly don't know what's worse. Shelling Seoul, which will be bad don't get me wrong, or killing the power grid and water systems of entire countries. The latter could utterly cripple logistical systems and lead to a total melt-down of society if there was enough panic brewing. If there's shelling you can evacuate the city, you can head out of range of the guns. There's nowhere to hide from electronic warfare if your entire society depends on power, fuel and computers.

This isn't about leaked emails or advance copies of movies, it's about attacking and permanently damaging large portions of infrastructure. If you can fiddle with a power plant you can destroy generators, transformers, and other extremely expensive equipment that could months to source, fabricate, transport and replace under ideal conditions. They don't have a warehouse full of spare turbines just sitting around.

Stuxnet showed what can happen if you pin-point target a particular system. If you broaden the scope of your targets, if you don't care about collateral damage, the stakes are very, very high.

Hacking into Sony wasn't hard and I have a sneaking suspicion that most infrastructure control systems are as bad or worse.

The black-out in eastern North America in 2003 shows how suddenly things can change if the grid goes down. That only lasted a day and yet the economic destruction was significant. Imagine if not only were the power plants offline, but they were crippled in such a way they couldn't come back without serious repairs. That is a possibility here. Months without power, without water.

JKCalhoun2• 9 years ago

Agreed. Maybe I'm ignorant but the cyber-war doomsayers sound to me a bit like the Y2K doomsayers.

Now, when cars/trucks become fully self-driving ... now you have a scary scenario ripe for hackploitation.

thehardsphere5• 9 years ago

Aren't hackers always targetting Homeland Security and nuclear facilities? Hasn't this been the plot of 24 for over a decade now?

daxorid• 9 years ago

Yes, but it becomes a much higher media priority when the entire intelligence community begins to agitate for WW3 with Russia.

I knew before clicking that there would be a baseless nod to *Bear attribution in this article, and it certainly didn't disappoint.

tree_of_item2• 9 years ago

What makes you think they are "agitating" for WW3 and not simply responding to actual aggression by Russia?

CodeWriter235• 9 years ago

Yep, could be a great opportunity to study the attackers by fronting each plant with a honeypot whilst making sure the real systems are air-gapped and require a two people with physical keys to insert a USB stick into the one system that has them.

oldandtired• 9 years ago

As long as the systems controlling infrastructure (of any kind) are network accessible, they are internet accessible. Hence, they will be attacked.

Convenience always works to the attackers gain, and convenience is the name of the game for engineers and managers and support staff. Unless the system is physically isolated and protected and there is no kind of networking available, it is effectively crackable. Even if physically isolated, staff can still be bought.

crb002• 9 years ago

I translate that into contractors aren't required to warranty their embedded components. Rewrite the contracts.

ams6110• 9 years ago

Most US nuclear plants were built in the 1970s. How much "computer networking" do they really have?

cocoablazing• 9 years ago

Non-safety-critical components in the steam plant are likely to have networked PLC control. While nuclear probabilistic safety assessments support that licensed reactors can safely endure casualties involving such components, the safety system is subject to failures and crippling the plant and causing a reactor transient is likely a good enough result.

topspin2• 9 years ago

Every nuclear power plant in the US has an NRC mandated Safety Parameter Display System. These were retrofitted after the TMI-2 meltdown. The SPDS is supposed to provide a concise view of critical parameters to avoid the sort of confusion that led to the TMI-2 incident.

In 2003 Davis-Besse had its SPDS disabled by SQL Slammer, a worm that congested the network on the site. So in answer to your question, yes these 1970s plants do indeed have devices interconnected in the contemporary manner, and compromises of these networks have already produced reportable events.

The core components of our power reactors are not at the mercy of software; operators have authority over reactor protection systems that are deliberately independent of complex digital controls. Nevertheless, a clever attacker could probably engineer enough confusion or interfere with ancillary systems badly enough to produce a notable incident such as a SCRAM. That would certainly make headlines and lead to a prolonged investigation.

Is it possible that greater damage could be done? Anything is possible. If so I'd imagine it might involve cooling pools, their circulation and alarms... who knows. Given enough time, knowledge and planning it might be possible to cause a serious problem.

tbihl• 9 years ago

If a power plant scrams, how long is the subsequent startup? Do they have any sort of fast recovery procedure?

dsfyu404ed• 9 years ago

Maybe I won't have to wait for sea level rise to wipe my hometown off the face of the earth, some jerk in Russia will pop the nuclear plant that's up-wind and it'll be uninhabitable.

dilemma• 9 years ago

Of course they are. They hate your freedom.

So long and thanks for the propaganda, NYT.

jpitz• 9 years ago

There must be subtext here that I don't understand.

fatbird2• 9 years ago

The NYT was one of the chief cheerleaders for the Iraq War, both through Judith Miller being an outright mouthpiece for Bush administration propaganda, and more generally through being a friendly media outlet of "balanced" thinkpieces that set the stage for popular support for a non-declaration-of-war (the AUMF) that allowed Bush to invade Iraq based on some nebulous threat of a WMD attack in the U.S. that was never real.

Animats3• 9 years ago

I'm worried. I've been following the Maersk outage. The world's biggest shipping line still hasn't fully recovered. Their less automated ports were down for several days. LA and NJ finally came back up about two days ago, but operations are still partially manual and they're running longer hours trying to cope.

Their most automated port, Maasvlakte II in Rotterdam, is still processing imports only; no exports. Some containers there are stuck in the stacks; they have a list of which containers can be reached. They're requiring paper customs forms and a paper commercial release, instead of their usual paperless system. Earlier, they were so down that the automated cranes could not unload ships. This is what Maasvlakte II looks like in normal operation. There are no people on the quay at all. All those cranes and AGVs are automated.[1]

Maersk's financial side is still down. They're not sending out invoices, which means zero revenue. They just announced a price cut, to keep shippers. Some of their phone and email systems are still down. The booking side is now up, so they can take new shipping orders.

This is the first time we've seen real-world outages of this magnitude. It may not be the last.

(Where's the Flexport guy who posts on here? He has to deal with all these problems. Flexport is a freight forwarder, which means that when something goes wrong with freight they are forwarding, it's their problem to fix it.)

[1] https://www.youtube.com/watch?v=zm_rlLyelQo

flukus4• 9 years ago

How is this not bigger news? I assumed the lack of coverage meant that everything was back to normal.

Had this been several of the big shipping companies at once the world would be reeling by now, especially economically.

heartbreak• 9 years ago

Smaller than global shipping, but I purchase pet food for veterinary clinics and Royal Canin (subsidiary of Mars) is still not at 100%. Their order fulfillment and accounting were hit.

I suspect this hit many B2B companies that we're not hearing about because they're small and we aren't customers.

Animats3• 9 years ago

Maersk has been emphasizing that they're back up at most of their ports, but not emphasizing that the really big automated ones, Elizabeth NJ, LA, and Rotterdam were hit hard. The mainstream press gets their info from press releases. Most of the press coverage reads "Maersk says". I have yet to see an article where someone went down at the docks to find out what's going on, or called a union rep, or talked to truckers.

There's coverage on gcaptain.[1] Mentions on Reuters.[2] There's lots of coverage on the sites that cover container shipping. Most of the people in that business are probably working overtime right now. With Maersk down, cargo all over the world had to be re-routed.

All the status info is on line, but not in a journalist-friendly form. Maersk has a temporary "Operational Update" page.[3] You have to read through a lot of material to see what's up and what's down. As of late today, almost everything is at least limping along except at Maasvlakte II in Rotterdam. Their web site for booking and tracking has a banner which says "Submit Shipping Instructions and Booking are available but without email confirmation. Tracking, Online Quote and Binder are unavailable. Schedules last updated 27th Jun so may be inconsistent." This is not "back to normal".

Here is the Port Authority of New York and New Jersey's latest alert page for truckers: [4] That's a good read, because it's a no-bullshit source of info. Somewhere at the Port Authority, there's someone with a clue who gathers that info and gets it out. Staying open late and operating Saturday is not normal. Maersk APM's status page for LA is totally bogus; it hasn't changed in the last week.[5] The online gate webcams at Maersk's port in LA are still down.

(I've followed this subject because I'm interested in mobile robots which do something useful. Maersk's Maasvlakte II terminal is one of the largest mobile robot operations in the world. Probably the biggest by tonnage. Downtime on this scale is a major event in robot history.)

[1] http://gcaptain.com/maersk-hopes-full-cyber-recovery-early-n... [2] https://www.reuters.com/article/us-cyber-attack-maersk-idUSK... [3] http://www.maersk.com/en/operationalupdate [4] https://www.paalerts.com/recentmessages.aspx [5] http://www.apmterminals.com/en/operations/north-america/los-...

mbrock• 9 years ago

"I assumed the lack of coverage meant that everything was back to normal."

Incidentally, that seems like a pretty fundamental issue with news in general.

gcb02• 9 years ago

to be honest, I'm following them in the hopes that they crash and burn and that this makes everyone else pay due attention to security.

but I also can't quit the paranoid thought that this would be the perfect cover to conduct a secret operation requiring tons of material delivered all over the world. it's much easier to abuse/manipulate/bribe when everyone users paper records.

nthcolumn4• 9 years ago

Unbelievable! This kind of victim-blaming has to stop. Maersk were infected because they downloaded software updates! Their software provider got pwned and malware was delivered past their firewall. How is it their fault? How do they deserve to burn? I suppose it would be the plant's fault if some stuxnet variant were to irradiate the eastern seaboard? You seem to have conveniently forgotten that it was the US government who created the means here. And what is Maersk's Total Cost Of Ownership(TM) looking like now? Perhaps the best strategy for them and all companies now is to trust only themselves and to only consider non-proprietary software in future. The idea that some aircraft carriers are running Microsoft is chilling enough. None of the SCADA for nuclear power plants will be on Windows thankfully.

piker• 9 years ago

Why has the stock been unaffected?[1] Am I looking at the wrong ticker, is the stock propped up by Denmark, etc. or is this a bit alarmist?

[1] https://www.bloomberg.com/quote/MAERSKB:DC

sfifs• 9 years ago

go short?

nonbel3• 9 years ago

"This is what Maasvlakte II looks like in normal operation. There are no people on the quay at all. All those cranes and AGVs are automated.[1] ... [1] https://www.youtube.com/watch?v=zm_rlLyelQo"

This looks like scale models to me. Check eg 32 seconds in.

chinathrow2• 9 years ago

This looks like scale models to me.

That's the tilt-shift effect, but according to the video producer, it's real footage.

Franciscouzo• 9 years ago

It's called tilt-shift effect, it's usually simulated by adding two blur bands on the top and bottom of the image. It can be done with a special kind of camera lens, but it's not usually done that way because of their price.

strictfp• 9 years ago

Government warfare is really the worst thing that has ever happened to the internet. I wish they would leave this old-fashioned territorial thinking to rot in the material world.

skepticaldrunk• 9 years ago

I hate to be that guy, but you know that the internet as we know and love it today started out as ARPAnet, right? The internet was domesticated, not weaponized.

IIAOPSW3• 9 years ago

I'm skeptical that there's a real threat to nuclear facilities. I've visited reactors before and seen first hand that the control rooms are all still based on analog components. The reason for the analog components is precisely because they are reliable and unhackable. When it comes to physical security, I can't think of a harder place to break into than a nuclear power station. You're not going to sneak in that's for sure. This reeks of manufactured consent. Are you afraid of hackers yet?

kuschku2• 9 years ago

You're not going to sneak in that's for sure.

Wasn't one of the IS terrorists of Paris employed in Belgium at a nuclear powerplant?

IIAOPSW3• 9 years ago

I literally do not know anything about this. Didn't even know Belgium had a nuclear power plant. Source please?

I can't speak for Europe, but I know in America even if you worked at the place you're not pulling off an attack. You're not going to sneak a gun past the check point. If you do somehow sneak in a gun or a knife, you're not going to live very long before the guards kill you. You're not going to get into someplace where your keycard/job status doesn't let you. Overall the most likely outcome is you trigger an unscheduled reactor shutdown and throw your life away. I can't imagine anyone making a 6 figure reactor job salary throwing their life away. Money > religion.

coldtea• 9 years ago

Sorry, why are "Nuclear Facilities" on the internet in the first place? Or the FBI for that matter...

If they mean they are targeting some public facing BS server for some website they keep, OK, who cares...

But anything functional and touching controls should be very well out of bounds...

notspanishflu• 9 years ago

Rubén Santamarta is going to talk about vulnerabilities that affect widely deployed radiation monitoring devices in nuclear facilities.

"The purpose of this talk is to provide a comprehensive description of the technical details and approach used to discover multiple vulnerabilities that affect widely deployed radiation monitoring devices, involving software and firmware reverse engineering, RF analysis, and hardware hacking."

That will be July 26 at Black Hat USA 2017.

Go Nuclear: Breaking Radiation Monitoring Devices https://www.blackhat.com/us-17/briefings/schedule/index.html...

dmix• 9 years ago

If this was the 50s or 60s the government would never allow a talk like this to happen. Anything to do with nuclear was kept as a black art. Fortunately that paranoia has lifted so we can have safer systems.

Hackers Are Targeting Nuclear Facilities, Homeland Security Dept. And F.B.I. Say

Related Stories