|
|
Supervisory Control and Data Acquisition, or SCADA, stands for large-scale distributed remote processing systems that gather data in real time to control critical industrial, infrastructure, or facility processes and equipment. SCADA is used in power plants as well as in oil and gas refining, telecommunications, transportation, and water and waste control.
Stories about intruders who damage the power grid or any other key SCADA infrastructure frequently make the headlines. In the past, and like in Mexico in 2007, extraterrestrial creatures and flying saucers were occasionally blamed.
Since then, our enemies have changed. The Wall Street Journal reported in April that a federal audit of critical infrastructure facilities in the U.S. power industry had been compromised with software that would allow the attackers to disable key elements of the national power grid. “The Chinese have attempted to map our infrastructure, such as the electrical grid,” a U.S. senior intelligence official said on the occasion. One year ago, the CIA claimed that a cyberattack had caused a multicity power outage at an unspecified location outside the United States. The CIA story broke on May 14. It’s rumored that Hydro-Quebec was also a target of cyberspies.
Last week, I discovered a video posted on YouTube in November 2008.
We can see two guys hacking a central light system and then playing space invaders on it!
I have some doubts about the technical aspects of these light-show “attacks” on unprepared buildings. But fake or not, the video confirms that hackers and cybercriminals have got their eyes on SCADA networks. Perhaps the first demo was just for fun, but the others will have less juvenile goals. An attack can involve nationwide damage, a terrible effect on the public’s morale, and huge financial losses. Modern SCADA networks are more vulnerable than ever because they use open networking standards (such as TCP/IP), are now deployed under less secure operating systems (Windows), are connected to other networks (including Internet), and cannot be easily updated and rebooted.
For SCADA, which typically allows only a closely defined list of applications to run, a security approach that includes whitelisting can be a good solution. McAfee’s recent acquisition of Solidcore will help our customers in this area.
|
|
I think, that instead of McAfee causing panic, and average users going into panic, they just have to thank this video (fake or not) for having them thinking about how unsure their systems are, and that they should improve security on them ASAP.
I have to laugh. I can understand your average person seeing that video and thinking it was real, but someone who is supposed to be a professional? Come on. I’m a university student who has built a couple of computers and fixed the family computer a few times, and I knew it was fake in the first dozen seconds, before I even knew what it was they were faking. The motherboard they’re plugging into that panel has no RAM and, even if it did, it’s not on because the CPU fan isn’t spinning. The other guy was turning a screwdriver in an open power supply which, while quite dangerous if you’re not properly insulated, will accomplish exactly zero. Add to that the ‘initializing’ countdown that is obviously fake (no real, cobbled-together script or program would have something flashy like that) later on and the speed with which the lights respond, it should be obvious to you that this is a complete fake. In fact, it was done as a viral marketing attempt.
While I don’t deny that infrastructure attacks are definitely something that need to be looked at and protected against (SCADA uses windows, seriously?) alarmist stuff like this accomplishes nothing and just gets uninformed people scared.
Then again this is McAfee, the company that proudly produces the single worst anti-virus program on the market.
Come on, people. Since when do flourescent lights turn on fast enough to support the moving images in this video? This is obviously fake.
c’mon guys, this is totally fake, done as a promotion.
not hackers, not cybercriminals, just a couple of creative guys with a video camera and editing tools trying to make a name for their pr/ad business.
Please let’s dial it down a bit and concentrate on actual threats.
Wow, is that for real, pretty scary. Were those guys caught if real? I’d love to know!
Maybe we just shouldn’t be checking our gmail from the diesel generator!
Submit your own comments / message for this post