RE: [SLUG] Fw: [SCAD] Hacker took over control of a Russian gas SCAD system?

From: Ken Elliott (kelliott4@tampabay.rr.com)
Date: Thu May 06 2004 - 19:59:27 EDT


>>Easy ? Maybe in the computer side but try playing with a Schweitzer relay
>> for a while and then tell me they are easy.

Well, if you set all the time/curves to random values, they would have a
devil of a time finding the faults.

<translation for all the not-power guys>
These relays control big "circuit breakers". If a line "faults" (shorts
out), you don't want all the breakers tripping at once. They all see the
same amount of power, so the closer you are to the end, the quicker you trip
open the breaker. That way, the closest upstream breaker will trip
quickest. So, to find the fault, you start at the breaker and go
downstream. If they are all set random, you might trip a breaker way
upstream from the fault. So when they notice breaker #4 tripped, and the
downstream breaker #5 didn't, they assume the fault is located between #4
and #5. The actual fault might be downstream of #6, but if #5 and #6 were
set to wait longer than #4, then #4 will trip before #5 and #6.
</translation>

Actually, I was thinking you could just send "open switch" commands and see
if your UPS works. I saw an S&C padmount with a Cat-5 cable sticking out
under the pad. Yep, Ethernet. The switches used them to route power in
case of faults. A guy with a lap top could cause lots of trouble with that.
But the installers had no clue about it. Why would they?

Ken Elliott
1832 Lombardy Dr.
Clearwater FL 33755
cell 727-698-0276

http://web.tampabay.rr.com/kelliott4/
=====================
-----Original Message-----
From: slug@nks.net [mailto:slug@nks.net] On Behalf Of Frank Roberts - SOTL
Sent: Thursday, May 06, 2004 8:19 AM
To: slug@nks.net; Ken Elliott
Subject: Re: [SLUG] Fw: [SCAD] Hacker took over control of a Russian gas
SCAD system?

Boy did you hit the nail on the head with NO security.

Easy ?
Maybe in the computer side but try playing with a Schweitzer relay for a
while and then tell me they are easy.
http://www.selinc.com/

Frank

PS: You could get several PhD trying to understand a Schweitzer relay.

On Wednesday 05 May 2004 19:58, Ken Elliott wrote:
> SCADA systems are easy. No security of any kind. The controls will
> simply accept any command issued by anyone. Did you know our electric
> grid is SCADA-based?
>
> Worse, the US helped install the same stuff in Afganistan, so anyone
> who knows that system has a pretty good understanding of ours...
>
> Ken Elliott
>
> =====================
> -----Original Message-----
> From: slug@nks.net [mailto:slug@nks.net] On Behalf Of Bill Canaday
> Sent: Wednesday, May 05, 2004 6:45 PM
> To: slug@nks.net
> Subject: Re: [SLUG] Fw: [SCAD] Hacker took over control of a Russian
> gas SCAD system?
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Wednesday 05 May 2004 01:55 pm, you wrote:
> > On Sunday 02 May 2004 09:56, John Saunders wrote:
> > > http://gtiservices.org/security/riskassess/gazprom_attack_04261999
> > > .d oc This report no longer seems to be online, but you might
> > > contact Bill Rush at GTI/AGA to get a copy.
>
> This sounds an awful lot like the purported CIA exploit of the Soviet
> natural gas lines of a few years ago. Separate incidents or an urban
> myth in the making?
>
> Bill
> - --
> http://cannaday.us (genealogy)
> http://organic-earth.com (organic gardening) Uptimes below for the
> machines that created / host these sites.
> 18:42:00 up 4:30, 4 users, load average: 0.26, 0.29, 0.18
> 18:35:01 up 2:36, 2 users, load average: 0.00, 0.00, 0.00
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.3 (GNU/Linux)
>
> iD8DBQFAmW5nSvjcx4uv21sRAoamAJ4rMf1YSt9EWAmjT/fARb9p/6LVtwCfbRjj
> le7u1JwrYjPH1NyhyCU2208=
> =ath/
> -----END PGP SIGNATURE-----
>
>
> ----------------------------------------------------------------------
> - This list is provided as an unmoderated internet service by
> Networked Knowledge Systems (NKS). Views and opinions expressed in
> messages posted are those of the author and do not necessarily reflect
> the official policy or position of NKS or any of its employees.
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.651 / Virus Database: 417 - Release Date: 4/5/2004
>
>
> ----------------------------------------------------------------------
> - This list is provided as an unmoderated internet service by
> Networked Knowledge Systems (NKS). Views and opinions expressed in
> messages posted are those of the author and do not necessarily reflect
> the official policy or position of NKS or any of its employees.

-----------------------------------------------------------------------
This list is provided as an unmoderated internet service by Networked
Knowledge Systems (NKS). Views and opinions expressed in messages posted
are those of the author and do not necessarily reflect the official policy
or position of NKS or any of its employees.

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.651 / Virus Database: 417 - Release Date: 4/5/2004
 

----------------------------------------------------------------------- This list is provided as an unmoderated internet service by Networked Knowledge Systems (NKS). Views and opinions expressed in messages posted are those of the author and do not necessarily reflect the official policy or position of NKS or any of its employees.



This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 17:49:35 EDT