Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Security Power News

Hackers Broke Into Brazil Power Grid Operator's Website Last Thursday 85

Posted by kdawson from the wolf-no-really-this-time-i-mean-it dept.
An anonymous reader writes "A week ago, 60 Minutes had a story (we picked it up too) claiming that hackers had caused power outages in Brazil. While this assertion is now believed to be in error, hackers were inspired by the story actually to do what was claimed. Last Thursday, they broke into ONS, the operator of the grid (Google translation; Portuguese original). DarkReading has specific details on the SQL injection vulnerabilities the hackers probably used."
This discussion has been archived. No new comments can be posted.

Hackers Broke Into Brazil Power Grid Operator's Website Last Thursday More

Hackers Broke Into Brazil Power Grid Operator's Website Last Thursday

Comments Filter:

  • full disclosure (Score:1, Insightful)

    by sopssa ( 1498795 ) *

    And, two days after the blackout, the systems analyst Maycon Vitali, 23, revealed in the blog "Hack'n'roll" to a login page of the ONS revealed error in the validation data. The flaw could allow a hacker to send command to the database and find sensitive data from ONS.

    The failure was published in the newspaper Folha de S. Paulo on Monday (16).

    This is exactly why full disclosure is not good.

    • Re:full disclosure (Score:5, Insightful)

      by mr exploiter ( 1452969 ) on Tuesday November 17, 2009 @08:20PM (#30137676)

      And, two days after the blackout, the systems analyst Maycon Vitali, 23, revealed in the blog "Hack'n'roll" to a login page of the ONS revealed error in the validation data. The flaw could allow a hacker to send command to the database and find sensitive data from ONS.

      The failure was published in the newspaper Folha de S. Paulo on Monday (16).

      This is exactly why full disclosure is not good.

      How so? If two days after the vulnerabilty was exploited causing millions of dollars of damage they *still* don't fix it, then the public has the right to know how much the security of the systems sucks. It may be the only way to prevent this from happening again.

      • Re: (Score:3, Insightful)

        by Runaway1956 ( 1322357 ) *

        Agreed. Sometimes the only way to motivate people to fix a problem is to embarrass them in public. FFS, no part of any critical operation should ever be exposed to the internet, period. If is't sensitive, keep it isolated from everyone - including your billing departement, public relations, sales, and even the company officers. Whenever they need to see something sensitive, they can pick their lead arses up, and move to an office dedicated to the internal workings of the company. When they are ready to

        • Re:full disclosure (Score:5, Informative)

          by mitoyarzun ( 1428713 ) on Tuesday November 17, 2009 @10:46PM (#30138830)
          Here in Chile a guy reported the government about a serious bug on their outsourcing website (chilecompra.cl), they ignored him for months, and he made the bug public (you were able to know your competition's offer to the government just by changing a GET parameter).

          He was condemned by a court for breaking the law, more info here [fayerwayer.com] (spanish)

          What kind of action should one take in those cases? Has this happened before in other countries?

          • Re: (Score:1, Interesting)

            by Anonymous Coward

            What kind of action? Leave the country, then report it. Any government that paranoid of a situation such as you describe is up to something.

            • Sounds to me like they screwed up, and now they're covering themselves. It sounds much better if they can say some nasty hacker brought the problem to their attention by trying to break in, as opposed to it being shown that they ignored an innocent guy who was willing to help them for months. Never attribute to malice what can be explained by stupidity (I think that's the quote). Or in this case laziness.

              This seems like the way a lot of people would react, so you're probably right that getting out of the

          • Instead of coming forward after having made this bug aware and seen no activity in months, obviously making sure the first time to point out possible solutions to the case to make repairs quick and easy, I would have posted it in the underground and let the rest of the script kiddies do their job...this would have been done under a new assumed log on name and done from within a internet cafe where I had never been before...also make sure that cafe has no internal cameras, and pay for the service in cash.

            Unf

          • I may have run into this exact situation in US government websites. Also, I have found many other serious bugs in financial websites. I document some on my blog [blogspot.com], but I am seeking advice on how to handle, and monetize my future findings.

            The last time I found a large bug at a large online trading account (with a pink logo), I gave up the bug, and signed an NDA. They barely fixed the problem and they didn't listen to my other advice. When the FBI got involved... well, let's just say it is interesting what they

    • Re: (Score:3, Insightful)

      by cosm ( 1072588 )
      Seriously? You must work for the government..

      Your solution: Hide or pretend the vulnerability doesn't exist, or ignore the possible ramifications of its exploitation and further promote shoddy programming practices.
      The better solution: Make the vulnerability public so that the company is forced to do something about it immediately, hence preventing any threats (pending their programming practices improving).

      Full disclosure puts the responcibility on the company to keep their products/services secure,

      • Re: (Score:1, Informative)

        by Anonymous Coward

        Uh oh, best watch out or the Anti-Sec will destroy you... hahaha.

        Oh i bet those kiddos will be all over this story.
        Hey there AS, how'ya doin? You want some candy?

        • Re: (Score:2)

          by Khyber ( 864651 )

          Anti-Sec couldn't hack their way into a Menuet box if they had physical access.

          Fucking script kiddies.

      • Hey everybody, I found a big red button that will blow up the world! I'm going to make its location public so that the governments are forced to fix this little vulnerability.

    • Anyone that knows anything about the utility systems (power, water, gas, sewer) knows they are run by the most insecure systems out there. There have been reports of SCADA vulnerabilities for years (GOOGLE it yourself) and many concerns expressed (http://www.darkreading.com/blog/archives/2009/04/scada_security.html).

      Once someone can get out of a compromised system and onto a utilities internal SCADA network they have total control. The best place to practice is on a relatively insecure 2nd or 3rd world netw

  • actually (Score:5, Informative)

    by Anonymous Coward on Tuesday November 17, 2009 @07:46PM (#30137270)

    the hackers invaded the _website_, the ONS network of computers that actually control the system is private and not connect to the internet.

    • Re:actually (Score:4, Interesting)

      by TubeSteak ( 669689 ) on Tuesday November 17, 2009 @08:43PM (#30137908) Journal

      the hackers invaded the _website_, the ONS network of computers that actually control the system is private and not connect to the internet.

      They may not have hacked the power grid, but TFA says the website has all kinds of fun docs which, I'm assuming, any smart hacker would go after in order to study up on their target.

      Never forget that the next best thing to an insider is the freakin' manual.

      • Re: (Score:1, Informative)

        by Anonymous Coward

        If your security consists of hiding the manual... You're doing it wrong.

    • It's a whole different ballgame if they are using vlans to isolate the control network. Then a hacker just has to penetrate a router or take advantage of poor vlan isolation in some switches. Plus, you're bound to have at least a few employees who just have to have their machine connected to both networks at the same time and think using two network cards is safe.

  • closed systems (Score:3, Funny)

    by Haxx ( 314221 ) on Tuesday November 17, 2009 @07:48PM (#30137298) Homepage

      One would think critical power networks would be close systems.

    • Re:closed systems (Score:5, Informative)

      by John Hasler ( 414242 ) on Tuesday November 17, 2009 @08:10PM (#30137566) Homepage

      > One would think critical power networks would be close systems.

      Read the article. What was broken into was the "corporate network" of the organization that runs the system. The control system was not broken into and in fact appears to be protected by an air gap.

      • The control system was not broken into and in fact appears to be protected by an air gap.

        AFAIK, no country has a power grid whose network is airgapped.
        Even worse, almost everyone is using very old dial-up systems somewhere in their network.
        Their only security is "do you know the phone number"

        Considering that the hackers got a bunch of manuals off the website,
        I'm guessing they now have those phone numbers.

      • What was broken into was the website of the organization that runs the system.

      • Of course! And no employee on an internal system has ever:
        • Installed their own wireless access point to get internet access
        • Dicked about with patch leads to "fix the network"
        • Ever done anything which can well and truly render useless any security system put in place (Hamachi / Tor installation?)

        Air gaps are only good if it's not air at all, but brick.

    • Re:closed systems (Score:5, Informative)

      by nametaken ( 610866 ) on Tuesday November 17, 2009 @08:10PM (#30137576)

      FTA...

      "ONS was notified last week of this problem. They've confirmed that, indeed, its Website was hacked. It claims to have fixed the SQL injection problems and that there was no danger because there was no connection between its Website network and back-end control network."

    • I work in IT at an energy company whose systems are tightly integrated with "the grid" and I can testify that someone with the right knowledge (or even someone well versed in the art of social engineering) could wreak havoc on the power lines here in the U.S.

  • Really.... (Score:4, Insightful)

    by Darkness404 ( 1287218 ) on Tuesday November 17, 2009 @07:50PM (#30137340)
    Really -no- critical system be it power, heating, cooling, etc. should be on the internet. A local network is sufficient with the main computer controlling the other computers not being connected to the internet. How hard is it to understand?

    • Maybe they just got into the company web site or billing system.

      But even so imagine that the operator of the system wants to save $$$ by outsourcing maintenance to Indian or Chinese companies. They would have to get in with a VPN. If the tradeoff is between money and security, money wins.

      • Re: (Score:1)

        by maxume ( 22995 )

        When it comes to security, the trade off is always between money and security.

      • > Maybe they just got into the company web site or billing system.

        That would appear to be the case.

        > If the tradeoff is between money and security, money wins.

        Not when security failures cost real money.

        • >> If the tradeoff is between money and security, money wins. >Not when security failures cost real money. /facepalm

    • Re:Really.... (Score:4, Informative)

      by nametaken ( 610866 ) on Tuesday November 17, 2009 @08:12PM (#30137594)

      They were not. Read the article.

      "there was no danger because there was no connection between its Website network and back-end control network"

    • Re:Really.... (Score:5, Insightful)

      by Itninja ( 937614 ) on Tuesday November 17, 2009 @08:17PM (#30137642) Homepage
      Keeping a few connected computers off the larger WAN is easy enough. But as those computer grow in number it can become more difficult to prevent someone, somewhere from opening up ssh, ftp, rdp, or some other connection-type. Then the whole LAN becomes susceptible to the evils of WAN baddies.

      And don't even get me started on the lack of physical security on 'secure' systems. If you can touch it, it's insecure.

      • Perhaps you want to think this through again?

        How can ssh connect two isolated networks? Linux software is pretty powerful, but I don't think it extends to stringing wire and installing routers.

        • Depends what hardware it's running on :D

        • Re:Really.... (Score:4, Interesting)

          by Itninja ( 937614 ) on Wednesday November 18, 2009 @12:34AM (#30139672) Homepage
          I've seen this happen. An engineer needed to get some files from his laptop to a Linux server. Since the server was not on the WAN he decided to use a USB drive, which was fine. Except that what he inserted was not a USB drive, but a USB wireless adaptor (he didn't know that). He spent over an house trying to get the 'drive' to work and then (for reasons unknown to me) left the adaptor in the server...maybe he forgot I don't know. It was there for over a week before anyone discovered it.

          I am told by the security people that the adaptor defaulted to 'ad-hoc' mode and could have easily been paired with passerby outside in the parking lot who had the know-how (and presumably the right credentials).
      • VPNs?

      • Many of these systems are locked in sheds alongside the larger transformer/switching sites. Cut the padlock and you have access to a Windows 2000 SCADA system that is on their SCADA network. Many of these also have modems and PCAnywhere. It really is scary.

    • Re: (Score:2, Informative)

      by cdesousa ( 1426699 )
      You should read the article (or the translation) first.... That is exactly how the system is implemented. The original article says

      "A rede operativa é blindada, separada da internet e operada via comando de voz", segundo informou a entidade

      In English,

      According to the organization, "The operative network is secure, is separated from the internet, and is operated by voice command"

      The article also says that the hackers got into the operative network but not in the operative network.

      • "The operative network is secure, is separated from the internet, and is operated by voice command"

        The "voice command" part bothers me a bit.

        "Dear Aunt: let's set so double the killer select all". Whatcouldpossiblygowrong?

    • Re: (Score:2, Interesting)

      by mr exploiter ( 1452969 )
      That's not how things work in practice. Remote monitoring from anywhere in the world is too tempting. You can take a look at what kind of thing SCADA vendors are selling to realize things are getting worse before they're getting better.

    • Re: (Score:1, Interesting)

      by Anonymous Coward

      And yet, your bank probably uses internet based VPNs for their ATMs, because they are cheaper to run than dedicated lines.

  • SQL injection? (Score:3, Funny)

    by XanC ( 644172 ) on Tuesday November 17, 2009 @07:50PM (#30137344)

    Somebody's fired.

  • Do you believe in Coincidence? (Score:3, Funny)

    by matty619 ( 630957 ) on Tuesday November 17, 2009 @07:51PM (#30137354)

    60min does a story on the security of Brazil's power grid, Brazil says its not true, a few days later, they have the worst power outage in a decade, and now this story.....

    • It's like that James Bond movie, where they report the news quickly because they are the ones causing the news? I think its Tomorrow Never Dies but I can't be sure.

  • Or maybe... (Score:3, Insightful)

    by Monkeedude1212 ( 1560403 ) on Tuesday November 17, 2009 @07:53PM (#30137372) Journal

    They were so good the first time they left no trace of their doings and even framed it on some other probable cause.

    One of the hackers (I'm guessing the one who likes polo shirts) obviously thought it'd be way cooler to take public credit. They have now revoked his invitation to DEF CON.

  • Hey Vinny, give Tommy a little ride....... make sure it looks like an accident.

  • Conspiracy theorys abound! (Score:5, Insightful)

    by Anonymous Coward on Tuesday November 17, 2009 @08:20PM (#30137680)

    This is ridiculous. You can easily hack into their corporate website, but there is no way hackers got into the Brazilian power grid management system, because there is no such automated system in the first place! The central agency controlling the grid Operador Nacional do Sistema (ONS) operates the center by calling their buddies on generating station over private phone lines. Unless you are a very good voice impersonator and know all the necessary protocols, you will not get very far. That's when lack of technology is a plus.

    • Yes, but it's not clear what information was exposed in this breach. With the right names, phone numbers, and procedures, I suppose you could cause some disruption.

  • Misundestood news (Score:2, Informative)

    by aylons ( 924093 )
    Hackers didn't broke into the ONS (national power grid operator) system. They have broken into its web site, and this has happened days after the blackout. And the website, naturally, has nothing to do with the operational servers. There are no evidences whatsoever that last Thurday's blackout was caused by an online attack.
  • All of these breaches in power grids are only one more reason for the government to reward/subsidize off-grid (self-sufficient, solar-powered) homes.

  • Breaking News (Score:5, Funny)

    by lupine ( 100665 ) * on Tuesday November 17, 2009 @08:43PM (#30137920) Journal

    Today hackers gained access to my bank account and increased the ballance to 100 millions dollars without alerting authorities.
    Actually that didn't happen. My bank account is perfectly secure. There are no hackers anywhere that are smart enough to do such a thing.

  • I'm sure I can't be the only one who saw this and thought, "You told us this, what, a week ago?". Goddamn moderators.

    I think these guys were trolling jaded /. readers for kicks

  • Wrong summary (Score:5, Informative)

    by Tellarin ( 444097 ) on Tuesday November 17, 2009 @09:35PM (#30138308) Homepage Journal

    Well, first of all, the 60 minutes episode about blackouts in 2005 and 2007 provides absolutely no proof or other data about those blackouts being caused by hackers, except for two anonymous sources that suspect it was.

    Second, there was no breach in the grid network, at least not know so far. What happened was that the ONS (the Brazilian electric grid operator) website was hacked.

  • hackers were inspired by the story actually to do what was claimed.

    ***sigh***
    Some "hackers, or more accurately some script kiddies . The diggification of slashdot is not at all a good thing.

  • Mod story down (Score:2, Informative)

    by acid06 ( 917409 )

    Hackers didn't "break into the grid" or anything close to that. They defaced the *website*, that's it.
    While that is surely a shame for them, is nothing even close to a real worry.

    No power outages were caused at all (and, in fact, couldn't be caused).

    Now please quit posting uninformed crap.

  • That's why no one hacked the electronic voting system!! The good guys were busy having fun sql-injecting stuff in some "bigger" system..

Slashdot Top Deals

E = MC ** 2 +- 3db

Close