News for hackers. Stuff that matters.

A comment on The 'cyber-attack' threat to London's Olympic ceremony. Parent comment

Re:The 'cyber-attack' threat to London's Olympic ceremony by xyzzy123 on Monday July 08, 2013 @08:32AM (#6006392)
Not sure about the UK exactly, but in countries I'm familiar with there are specific government agencies and initiatives for assisting critical infrastructure providers. They're doing their best.

The threat isn't entirely hype. Stuxnet basically proved that dropping a grid is do-able.

Not sure how you'd do individual companies, but the power grid as a whole is a lot more fragile than you might think.

The industry is taking things seriously, but there are a lot of problems to sort out. Fixing legacy network architectures takes time, and a lot of critical systems never get patched. That's before you factor in espionage or 0day.

[ Parent | on HN ]
Re:The 'cyber-attack' threat to London's Olympic ceremony by arethuza on Monday July 08, 2013 @08:47AM (#6006448)
"Stuxnet basically proved that dropping a grid is do-able."

Didn't Stuxnet target very specific Siemens SCADA systems, unless our grids all run the same controllers and the same software (which they might well do, I have no idea) - surely an attack like that would be difficult to scale?

[ Parent | on HN ]
Re:The 'cyber-attack' threat to London's Olympic ceremony by _mulder_ on Monday July 08, 2013 @09:09AM (#6006541)
Yeh, good job Siemens don't make anything to do with power grids.

Oh no... http://www.energy.siemens.com/hq/en/power-transmission/ http://www.energy.siemens.com/hq/en/fossil-power-generation/ http://www.siemens.co.uk/en/news_press/index/news_archive/20...

[ Parent | on HN ]
Re:The 'cyber-attack' threat to London's Olympic ceremony by arethuza on Monday July 08, 2013 @11:08AM (#6007119)
Yes, I am rather familiar with Siemens as a company.

What I meant was, how diverse are the control systems for national grids. If they are highly diverse then they are going to be more difficult to target, if they are all the same generation kit from the same vendor then the threat will be higher.

Which one is it?

[ Parent | on HN ]
Re:The 'cyber-attack' threat to London's Olympic ceremony by xyzzy123 on Monday July 08, 2013 @02:57PM (#6008466)
In my limited experience (n = 6) I've not seen the same control system twice. I believe this is because the systems I looked at were built at quite different times. This probably varies a lot between countries.

So your point is valid, but diversity doesn't help if the overall resilience of the grid is so low that attacking a few carefully chosen targets could cause a massive blackout.

[ Parent | on HN ]
Re:The 'cyber-attack' threat to London's Olympic ceremony by xyzzy123 on Monday July 08, 2013 @09:01AM (#6006519)
You don't need to take out hundreds of plants.

Typically you might only need to cause a few targeted failures at the right time, and if you do this in a nasty way you can cause a cascading failure, taking out key transmission lines or other nodes in the network.

* http://en.wikipedia.org/wiki/Cascading_failure

* Structural Vulnerability of the North American Power Grid - http://arxiv.org/pdf/cond-mat/0401084v1.pdf

* Risk-aware Attacks and Catastrophic Cascading Failures in U.S. Power Grid - http://www.ele.uri.edu/nest/paper/Globecom_2011.pdf

It's a very "Dr Evil" topic, I know...

[ Parent | on HN ]
Re:The 'cyber-attack' threat to London's Olympic ceremony by SideburnsOfDoom on Monday July 08, 2013 @08:42AM (#6006427)
> The threat isn't entirely hype.

But the idea that someone was actually planning to do this to the Olympics opening ceremony probably was hype.

[ Parent | on HN ]
Re:The 'cyber-attack' threat to London's Olympic ceremony by xyzzy123 on Monday July 08, 2013 @08:46AM (#6006446)
Probably - and I don't think this justifies widespread spying either.

The source of the info isn't stated, but it's more likely to be a case of "forensics panic" or on-site network sensors going off than anything else.

[ Parent | on HN ]