June 26, 2002

11:43 PM

Do you fear a cyber-attack by Al Qaeda? Seems that several businesses and governmental system infrastructures have had higher than normal traffic routed from the middleast snooping around protected systems. Is this more political rhetoric for stronger control over electronic transmissions?
posted by nakedjon (23 comments total)

Is it just me, or does this article seem a little questionable? Not only can the terrorists hack the systems so easily, but the police are all precogs that can guess their intentions.
posted by ttrendel at 11:59 PM on June 26, 2002

"The new threat bears little resemblance to familiar financial disruptions by hackers responsible for viruses and worms. It comes instead at the meeting points of computers and the physical structures they control. U.S. analysts believe that by disabling or taking command of the floodgates in a dam, for example, or of substations handling 300,000 volts of electric power, an intruder could use virtual tools to destroy real-world lives and property."

I never thought of that. If anyone here has some knowledge of these types of systems, how feasible does this sound?
posted by homunculus at 12:26 AM on June 27, 2002

Do you fear a cyber-attack by Al Qaeda?

Not really, no.
posted by delmoi at 12:29 AM on June 27, 2002

disabling or taking command of the floodgates in a dam, for example, or of substations handling 300,000 volts of electric power, an intruder could use virtual tools to destroy real-world lives and property."

Thats one think I have never understood about the hacking fear mongering. Why are damn flood gates and power station controls even connected to the internet?
posted by Iax at 12:50 AM on June 27, 2002

Flood gates like to order from Amazon too.

The whole article is pretty skethy on details. It starts off with some very circumstantial evidence, and just extrapolates it.
posted by salmacis at 12:54 AM on June 27, 2002

Our local Department Of Land Administration (DOLA) didn't have any sort of internet presence until a few years ago. Before that if you wanted a copy of a certificate of title you could eaither fax the request to them or use a *terminal* (as in old-skool BBS) connection. This was post Y2k. I seriously doubt any of these old goverment departments have critical systems on the net. Back in '95 workers at Westrail (goverment railways) were lucky if they had an Internet email address. Seven years is a short time in the public service.
posted by krisjohn at 1:36 AM on June 27, 2002

After reading the entire article, experiencing fits and starts of paranoia, the author finally gets to the point:

"It doesn't matter whether it's al Qaeda or a nation-state or the teenage kid up the street," he said. "Who does the damage to you is far less important than the fact that damage can be done. You've got to focus on your vulnerability . . . and not wait for the FBI to tell you that al Qaeda has you in its sights."

Hogwash. The hacking of the English language is what we must be on the watch for. . .

Thats one think I have never understood about the hacking fear mongering. Why are damn flood gates and power station controls even connected to the internet?

them damn flood gates better not mus up my fourth of july bbq.

;-)
posted by crasspastor at 2:00 AM on June 27, 2002

If anyone has connected such systems to the net and the systems become compromised, I will personally travel to their house and kick them in the shins repeatedly while calling them a moron.

At the very most, I can *maybe* imagine some sort of status or other information being sent *out* to the net, but there are ways to set things up so that information can only physically flow in one direction. Can anyone think of any reason whatsoever that allowing information from the net *in* to such systems would be beneficial?

Maybe the terrorists are just going to use the old standby of social engineering, which is far more effective than cracking in some cases. "Uh, yes, this is, um... Joe. I'm a supervisor. You're going to have to open all of the floodgates simultaneously... so we can run a test... on them."

I suppose in either case we're fine as long as the people responsible for these things aren't morons. Sometimes I wonder, though...

Attention, people who work in facilities that can cause large numbers of deaths: IF YOU ARE RIDICULOUSLY STUPID, PLEASE QUIT YOUR JOB. America thanks you for your sacrifice.
posted by whatnotever at 4:16 AM on June 27, 2002

"What is new and dangerous is that most of these devices are now being connected to the Internet."

Actually, nuclear power plants can run just fine on clunky but reliable old computers which aren't connected to the Internet. So cyber-induced meltdowns are not necessarily going to be a problem. I suspect one point of this scare-mongering material is to start tech-crazed IT people thinking a new direction, that unplugging mission-critical computers from the net, and sneaker-netting physical backups can actually be a really good idea.
posted by sheauga at 7:16 AM on June 27, 2002

It's the wolf! It's the wolf! Ban the Internet, it's Eeeeeevil!


Is it me, or does this all sound an awful lot like the Y2K scaremongering?
posted by briank at 7:28 AM on June 27, 2002

We have much more to fear from script kiddies and bored teenagers designing Outlook email viruses than Al Qaeda's 'l33t hax0rs'.
posted by insomnyuk at 8:01 AM on June 27, 2002

Our system defenses are in an infantile stage of development. Attacks upon them reveal weaknesses that can then be addressed, contributing to the evolution of stronger systems. Failure to anticipate various types of attacks is just that, a failure on the part of those with that responsibility. The attacks themselves, then, serve as a backup line of defense. In the long run, we will be much better defended for them.

Attention, people who work in facilities that can cause large numbers of deaths: IF YOU ARE RIDICULOUSLY STUPID, PLEASE QUIT YOUR JOB.

Hey, you leave Homer Simpson alone!
posted by rushmc at 8:18 AM on June 27, 2002

homunculus: First, they're talking more about the fact that power systems, emergency response communications grids, and others are digitally controlled today. In this respect they're not talking about the internet, even though taking that sentence out of the article's context it sounds like a roundabout way of describing routers and backbones.

Second, a system does not need to be explicitly connected to the internet in order to be compromised. One of the threats would be an overwhelmed 911 system. There are already tens of thousands, possibly hundreds of thousands, of compromised computers on the net that are regularly used for denial of service attacks using the net itself. If someone controlled a thousand computers, that would probably be plenty to initiate modem calls to a particular 911 system at a predetermined time. Thus a system that is not itself on the internet is made vulnerable due to a net-based denial of service attack. You can't take the 911 system off the telephone grid, of course.

Third, again dealing with communications, some of the interest described is in breaking into and hacking telephone switches. They are really much like routers for the telephone network (though there are key design differences that make the two incompatible), and once again, you can't take them "off the net" -- or they become useless. A telephone switch will always be physically vulnerable to hacking.

Fourth, a control system for a given infrastructure element -- say, a dam's floodgates -- need not itself be connected to the net. That doesn't mean it isn't vulnerable. Imagine an attack where the dam controls are activated by a secure telephone line between the control center and the dam, and an attacker waits until the dam floodgates are completely open -- then launches a communications network denial of service such that the remote control capability is broken. Obviously in this case there would generally be staff on hand locally and manual overrides; but not all dams have 24/7 staffing, either.

Fifth, a system itself may be completely secure in other ways, but the control interface is not. This was the nature of a threat a few years ago to the California power grid. The computers in the central office ran software that made a secure connection to the control system and permitted remote operation of power system elements. There was a cyber attack (I think in this case a random sub7-type take-over of a PC) that would have permitted someone to take over the PC that ran the "secure" control interface. There were other safeguards in place, but imagine someone watching you work on this software for a day or two, grabbing your password, understanding the interface and how to get in, then waiting until you go home for the night and miming what you just did.

As a network administrator, I take all of these threats seriously. I had a remote capability at a previous client that nobody knew about because of the overlap and confusion regarding projects and consultants. I could dial into a terminal server, switch over to my desktop PC, and from there I could access every application and file server in a multi-billion dollar company. This was protected by multiple passwords and the access was mainly hidden within a set of scripts that I used, but the vulnerability was there. My boss and I kept quiet about this because we knew that if they forced me over to the centralized remote capability of this company, we'd have to rewrite the scripts and probably create a web interface, for which there wouldn't be any money. So we'd be effectively screwed out of our remote -- and if there were an emergency they'd have to wait the 90 minutes between the time I'd be paged and the time I could get out of bed and drive there to deal with whatever had blown up (and my boss would catch hell the next day for the delays). Eventually, though, a successor consultant got control of that terminal server, completed whatever it was being used for, and the whole thing was shut down with little warning. As I say, we had passwords and multiple gateways, but we were essentially relying on security through obscurity here, which is never a good idea in the long run. In any event, that was a vulnerability that had nothing to do with the internet yet could have resulted in a serious compromise for the company if someone had found out about it and known how to exploit it.

We can turn off all these communications or other remote control capabilities, but then you face the problem of making properly trained personnel available and the higher costs associated with that, not to mention the loss of interactivity among systems, such as the power systems that constantly communicate with each other to keep incoming and outgoing electric power at the expected levels -- because if they go up or down significantly the other system will have a big problem. (The great New York blackout of the 1970s wasn't caused by a shortage of power, but by a power overload that tripped defensive shutdowns.) It's pretty much the same argument that applies to physical transportation nodes like the Detroit-Windsor tunnel. You can close it, sure, but how do you solve the problem of the ~ million people who cross it every day?

Of course none of this threat is limited to al Qaeda, and in everyday situations the script kiddies are a bigger problem. But in a real war there is no doubt that we would face cyber attacks; and I believe we are in a real war. I'm not willing to rely on the idea that al Qaeda are a bunch of screw-ups to protect lives.
posted by dhartung at 8:44 AM on June 27, 2002

Good post dhartung, but I don't really think cyber attacks are Osama's 'style'. I just don't.
posted by insomnyuk at 10:08 AM on June 27, 2002

Gosh, what neat ideas on how to bring civilization to a screeching halt. Thanks for sharing!

My homeland defense shopping list: Pringles' cans, for driveby info browsing of apartment complexes with Middle Easterners; extra tin cans and string, to be dropped off at my local 9-11 dispatch center, Takyon Capsule device designed to interfere with externally imposed electromagnetic hyperspatial mind control frequencies (available via the Leading Edge International Research Group). Howcome we keep publishing stuff like The Great Cyberwar of 2002 with nothing but a little note, "Kiddeez, don't try this at home?"
posted by sheauga at 10:09 AM on June 27, 2002

believe it or not i hold an FCC card. Having worked at a larger market radio station, power is critical. as are alot of other factors. Our response time was at worst 15 minutes (at tower, not station, that was under 30 seconds) for non infra damage. The reducendy system dhart so well puts is dead on, but the dam example would almost beg to have someone locally available at all times (this is for smaller units, the large ones have snipers i'd bet at this point) My point being that one would have to be sophisticated enough to attempt this, plus have "mr-mrs. local dam operators" code. (hmmm-DRAFT FISHERMAN. hey, they like to watch)
posted by clavdivs at 10:11 AM on June 27, 2002

dhartung, thanks for opening the floodgates of your brain, that really helps in understanding the situation.

insomnyuk, I'm less worried about Osama than I am about teenagers who watch and enjoy the Danny Pearl video.
posted by homunculus at 10:16 AM on June 27, 2002

I'm just disturbed by the thought of clavdivs in a position of authority!

(sorry, clav...)
posted by salmacis at 10:45 AM on June 27, 2002

sheauga: Because Security Through Obscurity never works (in the long run), and because Full Disclosure does. Consider Scenario A, where a hacker is trying to break into a system whose vulnerabilities are known to the vendor, Macrosoft; known to the hacker, a former employee of Macrosoft; but not known to the administrator. For Macrosoft you could substitute "the government" or "a small panel of experts with security clearances".

clavdivs: A license? I would rather have expected you were tagged with an FCC Part 15 interference label. </tease>
posted by dhartung at 10:51 AM on June 27, 2002

I can't say true or false, except to tell what was said to me from a consultant. He was employed (later when I met him he was kept on as a consultant, and made frequent trips to LA, me being from there is how we met) to set up all the technology for the largest Sheriff's Department in the World. From communication down to their surveillance. He set up their entire digital system, yet they did not want to protect it, money budget was his guess. From whom, the criminals. He told them repeatedly, that you could go to any Radio Shack to buy equipment and make some modifications to surveillance the sheriffs' surveillance, of you. Basically any time they pulled your name or other info, you could set bells and whistles to let you know. Now how could they infiltrate, just like they do to your home with a van full of equipment, parked out front. And this he thought would never seem suspicious at a sheriff station. Yes, not every criminal would do this, except rich drug dealers who they were after, right. Well this may seem hypothesis, yet this from the man who laid out there system. This was about 10 years ago, and my understanding with radio shack it's your name they want for sending you a flyer. Try returning something without a receipt, they still have no record. Just something to gnaw on.
posted by thomcatspike at 12:10 PM on June 27, 2002

clarify, mid-level large station. power changes, meter reading, cleaning the CARTs'. etc. entry level stuff. FUN. radio is fun.period. I'm proud of my card. anyone can get one. Broadcasting badges are the key. get that higher level stamp. and whats strange...the cable guy just showed up whilst this was in preview. (A man is here with papers says youngest daughter) wrong address, wants us to sign up. really, i have a witness, two really...and now his photo. computers are fun. life is good.
posted by clavdivs at 2:19 PM on June 27, 2002

thomcat: I completely believe it, understanding that we're talking about a plaintext packet-switching wireless network. This month's Business 2.0 (article not online yet) details the technology investments of South American drug cartels. One Colombian bust turned up no drugs, but instead a network with an AS/400 at its heart that turned out to be pumping through the telephone records of the national phone company, which were being used to find out who in their organization was talking with the police or civilians calling tip lines. Other examples (from disparate cases) were planes using fuzzbusters and GPS to determine the extent of US coastal radar, a packet-switching text-messaging network with encryption that was used to send instructions, warnings, etc. to various operatives, semi-submersibles which could approach coasts without detection by radar or just monitor police activity, and the coup-de-grace which is the move to fully operational diesel submarines. Sure, not every criminal cartel is that sophisticated, but clearly -- some are.
posted by dhartung at 3:47 PM on June 27, 2002

If anyone here has some knowledge of these types of systems, how feasible does this sound?

There was a situation last year where someone "hacked" into the computers in an Australian Sewage Treatment Plant and released all the chemicals and shit into the local waterway (he was caught).

Simply put - if its controlled by computer, there's always away to hack it.
posted by Neale at 6:53 PM on June 27, 2002