Hacking has already begun with the smart grid and the manufacturers of smart meters
October 01, 2012We been writing here warning about the potential problems caused by smart-meters (i.e., the smart grid networking). We've warned that the installation of smart-meters can put customer data at risk. Turns out that there have already been examples of this vulnerability. We recently published an article about power companies in Australia selling "detailed information about electricity customers' power usage, which gives insights into when a house is occupied, is being shared with third parties including mail houses, debt collectors, data processing analysts and government agencies."
And we've talked about individual hacking into the smart grid network to invade consumers' privacy.
Now we learn the worst fears are already coming true: A foreign power taking control of our power grid. John Leyden, writing at The Register, a British cyber watchdog group reportsAn espionage attack on Telvent - the maker of power-grid control systems and smart meters - has been linked to a prolific Chinese hacking crew.
Telvent, a division of Schneider Electric, has admitted hackers breached its corporate network, implanted malicious software and lifted sensitive project files. The raid spanned Telvent systems in the US, Canada and Spain according to a letter sent to the company's customers this month.
< a href="http://pubads.g.doubleclick.net/gampad/jump?iu=/6978/reg_security/front&sz=300x250|300x600&tile=2&c=22UGo2CqwQrMoAAF9YrdUAAAAM&t=ct%3Dns%26unitnum%3D2%26pos%3Dtop%26gunit%3Dus_top_mpu%26test%3D0" target="_blank">
Criminals can now study the documents for vulnerabilities in the systems, and potentially devise attacks to sabotage nations' electricity distribution networks.
Telvent boasts that it has "built a customer base second to none in the energy industry", adding: "Our systems now manage over 60 percent of the total hydrocarbon movements in North and Latin America and control transmission and distribution of over 140,000 GWh through worldwide electrical grids."
Investigative reporter Brian Krebs, who first revealed the breach, said the blueprints described Telvent's OASyS SCADA [supervisory control and data acquisition] product, a technology that offers power companies a means to bridge legacy systems to next-generation "smart grids".
Clues such as references to particular domain names and malware left behind by the spies match the digital fingerprints of a Chinese hacking crew called the Comment Group, which is linked to previous cyber-espionage campaigns, according to researchers at Dell SecureWorks.
Telvent has cut data links between at-risk portions of its internal network and clients' systems as a precaution while it probes the breach. Police have been called in to investigate the attack, according to this statement supplied to Sophos:
Telvent is aware of a security breach of its corporate network that has affected some customer files. Customers have been informed and are taking recommended actions, with the support of Telvent teams. Telvent is actively working with law enforcement, security specialists and its affected customers to ensure the breach has been contained.
Dale Peterson, founder and chief of industrial control security specialist Digital Bond, spelled out the kinds of information present in the lifted documents.
"Some project files contain the 'recipe' for the operations of a customer, describing calculations and frequencies at which systems run or when they should be turned on or off," he told WiReD.
"If you're going to do a sophisticated attack, you get the project file and study it and decide how you want to modify the pieces of the operation. Then you modify the project file and load it [onto a company's control system], and they're not running what they think they're running." Click here to go to the original source. The article also contains links to other useful articles.