UPDATE Dec. 30, 2016: Chickens come home to roost.
RUSSIANS PENETRATED BURLINGTON ELECTRIC DEPARTMENT COMPUTER
DEC. 30, 2016, 11:09 PM BY ERIN MANSFIELD
Russian hackers penetrated a computer at the Burlington Electric Department that is not connected to the electrical grid, officials say. https://vtdigger.org/2016/12/30/russians-penetrated-computer-burlington-electric-dept/
Straight from Bloomberg: https://www.bloomberg.com/politics/articles/2016-12-31/russian-hacking-code-found-in-vermont-power-utility-computer
Blame it on the Russians? What? VT Digger, you fell for it. Here's how it happened, exactly as predicted:
Hacking the Smart Grid
To receive the stimulus money, utilities had to install new devices across their entire customer base quickly. Security experts said that this could lead to problems down the road–as-yet-unknown vulnerabilities in hardware and software could open up new ways for attackers to manipulate equipment and take control of the energy supply. Utilities were encouraged to install this smart-grid technology–network-connected devices to help intelligently monitor and manage power usage–through funding from the U.S. government’s 2009 stimulus package. The smart systems could save energy and automatically adjust usage within homes and businesses. Customers might, for example, agree to let a utility remotely turn off their air conditioners at times of peak use in exchange for a discount.
Smart-grid deployments involve installing smart meters in homes and businesses across a utility’s coverage area...
No excuses for BED - BED engineers and management were warned about the firewall deficiencies. Opening transmission and distribution Grid control to become interconnected via the internet without risk management protocols in place was inexcusable. It was politically forced on them to implement it by non-tech politicos, from UVM Sandia program via strategically placed vice chair of Burlington electrical Commission, to clueless council and mayor, and non-tech BED Gen Mgr. Alert residents warned the City, to no avail. BED EE Staff understood the risk, but were over-ruled.
ReplyDeleteA process that depends on random chance to avoid connecting one or more infected devices, to any grid node, that touches the entire distribution and transmission grids, is flawed – conceived by politicians who are dumb as a post about risk management and pushed by Sandia (at UVM, got money in the deal). UVM Vice Chair of the Electric Commission says: "I am doing some research as a part of the project, so I am probably biased..." Conflict of interest, ya think? BED became a UVM test lab.
UVM Annual Report 2012-2013: "UVM will receive approximately $3 million over five years to create an innovative, multi-disciplinary graduate program supporting twenty-two doctoral students who will be trained to analyze and develop smart grid systems. The University of Vermont IGERT program consists of a partnership between the University of Vermont and Sandia National Laboratories." (Sandia is Lockheed Martin.)
CONFLICT OF INTEREST: Vice Chair of Electric Commission, when smart meter purchase was made, had a research group that benefited financially from City purchase. https://www.uvm.edu/~phines/home/
ReplyDeleteThis comment has been removed by the author.
ReplyDelete