Researchers Found They Could Hack Wind Farms
wired.com
wired.com
There's a huge cultural difference between Telecom and Power.
When AT&T started out, they hired telegraph boys to operate the switches, and then after getting tired of their antics, fired them en masse and replaced them with young women. That sparked the first wave of people tampering with telecom wires to pull pranks, and the telecom sector has been familiar with that issue ever since. Phone phreaking, as in tampering with crossbar switches remotely, is at least as old as the Arab Israeli war of 1948.
Power utilities, meanwhile, have had some protection from the simple fact that even sociopaths don't like to risk their own lights going out. Even during civil wars, militias will spare the other side's power because they want to use it when they conquer the other side's territory. Power utilities have to worry about copper thieves, squirrels, and tree branches. Getting bits diddled remotely by bad actors is not something they've had to think about as long.
They should never have to worry about this.
Power plant equipment, etc., should not have networking capability. Not just no Internet, but no networking.
And storms hit far more often.
All of these plants also have some sort of SCADA system internally and turbine fields need the same (the turbines need to be connected to each other, and the operator needs to be able to control the turbines in some way: e.g. turning them off when there is an excess of power, reading power output, faults, etc.) So one way or another, communication needs to occur whether it's over an IP network or a dedicated PTP line.
If someone gets physical access it's mostly game-over unless you've got builtin hardware-level encryption between all of the internal components of the facility. If there wasn't an ethernet port in the server cabinet the hacker could just connect an RS-485 line and start sending MODBUS commands or whatever protocol the SCADA system is using.
But the article does a good job pointing out that the assumption that "the facility/network is secure" does not hold as well in distributed generation as it did for traditional power generation.
Edit: see also https://en.wikipedia.org/wiki/DNP3
TLDR: Its a business decision.
Yes & no -- the US military has used graphite bombs[0] to disrupt power systems, however in a relatively non-destructive manner.
[0] http://www.globalsecurity.org/military/systems/munitions/blu...
These mobile nuclear power plants are transportable via classic steel rail way. The reactor is about the size of a normal train car. (Although I'd guess there are many accompanying components too.) The fuel is typically enriched nuclear matter in ceramic like pellets.
A single car of unspent fuel can power NY City for a month.
Big populations impacted that depend on electricity for food, water, and waste will receive these before rural populations.
I'd be interested in the restrictions to the public in such circumstances. Rationed EV charging, no home A/C usage, community cooking centers.
In the case of wars in the last 30 years, the US military has operated on a shock and awe strategy followed by nation building. The former encouraged destroying (or crippling) power generation to cause chaos and the latter is very lucrative to American companies that come in to build the power generation afterwards. Since the US military has absurd resources, bringing in portable generators by the thousands (along with the fuel) is also easier than having to deal with existing infrastructure that was already decaying and incapable of properly supporting their logistics. During the wars in Iraq and Afghanistan, many of the power stations rebuilt by the US were never used, even for the military, and sit idle to this day.
And I don't know who the author got this idea from: "The equipment is designed for lightness and efficiency, and is often fragile as a result.", but it's not accurate. It's designed for a balance of performance, robustness, and cost. Just because the machines are not designed for repeated emergency braking or doesn't make them fragile.
Bigger picture though, next time you're out and about take a good look at your surroundings. The U.S. is huge, and much of our grid infrastructure is remote. Forget the nuclear power plant example in the article. It wouldn't be stupendously difficult to take down a major transmission line or switchyard if you were determined. Much of the world operates because people generally leave well enough alone, for better or worse.
People are quite reasonably more afraid of attack vectors that can affect huge numbers of people all at once, especially when the attacker could be anywhere in the world.
One obvious example of why that's reasonable is the recent ransomware – sure, you've always been able to easily extort $300 from someone, but now you can take money from a lot of people, and not get caught.
Hacking is something that is getting more and more likely by the day. First, WannaCry infects the world over and knocks out a hospital system. What's next? Pacemakers going offline? Insulin pumps being hacked? Hell, cars can already be hacked from a distance, internet connected cars aren't raising a risk factor by much, aside from it lengthening the distance at which you can do the hack.
Now imagine that on every bridge. It only takes one car to bottle up a lane.
All it takes is a length of chain or some graphite powder.
SOP for fire departments responding to branches on lines that haven't brought the lines down is to call the utility then babysit the tree branch until it finishes burning.
The current passed by a tree branch depends both on the resistance of the branch and the voltage of the line. In the video I linked it was clearly enough of a short to ionize the air and cause an arc that would damage equipment quickly.
It's actually ridiculously easy to take out power for large areas with a rifle - https://www.stgeorgeutah.com/news/archive/2016/09/26/jla-tho...
As for attacking the wind turbines, I would be much more worried about a malicious actor turning off the brakes during high winds - https://www.youtube.com/watch?v=ucceQ3vS3zs
>And in the meantime, a few stronger locks, fences, and security cameras on the doors of the turbines themselves would make physical attacks far more difficult.
I mean, any time someone has physical access to your machines, you're going to lose the security fight. Full stop.
At that point, if the goal is damage or extortion, and you've walked into an unguarded and poorly secured building (or turbine), a little bit of dynamite is a WAY better bet than a network compromise.
I mean if I wanted to blow up 1000 turbines with dynamite, I would need:
* Physically drive to 1000 turbines
* Purchases 1000 sticks of dynamite
* Physically walk up to 1000 turbines
* Set up some kind of ransom remote detonator that I could set off
* Somehow monitor all 1000 turbines to see no one could defuse my bomb
* Not blow up myself while setting up the bombs
Vs if you could send 1 packet from Russia that told the turbine to go "full speed reverse" that could shred the device?
You are going to argue that those two things are the same level of effort, and we shouldn't guard against the second due to how easy the first is?
Now that's a piece of civil disobedience history I'm never gonna forget.
If you take out one wind turbine: they break often enough that it doesn't matter. They assume a few will break for mechanical reasons and that is accounted for, it hurts profits a little but probably less than their worst case failure budget has planned for. They will fix it sometime in the next few years. If you take out a lot of wind turbines, things get hard, replacing each one will take time: factories are generally booked months in advance and crews that can do this job is also not readily available.
Don't forget though that everything you do creates an effect. Take our wind turbines and they will beef up security. You are taking the risk that they notice your activities and put in some security system that catches you.
This entirely depends on location. A lot of major WECC locations are remote and would take a crew a long time to get there.
> substations fail once in a while.
What do you mean by this? Usually substations are fed from diverse lines, so a single incoming line outage, or XFMR (usually N+1) failure is able to easily be absorbed.
I don't know how much redundancy they have. I know that my power went out for a few hours a couple months ago when a substation failed. I've seen the "ball of flame" (probably just a spark, it only lasted a second) that knocked out power for a small city.
Just want to point out that there's no such thing as turning on a wind turbine at full speed reverse. It's not a fan.
Potential mechanisms for damaging one include mucking with the brakes (as in the article), changing blade pitch, disabling some kind of cooling system, etc.
Big AC windmills actually are started up as fans with their blades set to 'coarse' for maximum torque. What happens is that the grid is used to get them up to speed, they become sync-locked to the grid (same frequency) and then any excess power the wind imparts to the machine will be passed off to the grid.
If the machine would drop slightly below the 0 line of power produced the power company would still operate it as a fan until this situation persists for too long and the losses accumulate, then the mill is set to 'coarse' if the pitch is variable and allowed to coast to a stop or some low RPM waiting for the wind to pick up again.
All kinds of trickery (variable pitch, DC systems, maximum-power-point-tracking) and so on is used to expand the useful envelope.
So yes, they're also fans. But mechanical safety is a big thing in windmill design and most likely some FPGA or other hardware lock-out would stop you from being able to command a typical windmill from becoming an 8 MW desk fan.
Hurricane on demand, the evil part of me now wants to know what would happen. At a guess it wouldn't do much because the mechanism is rated to produce an X amount of power so it likely can handle sourcing it as well as long as enough air flows over the coils of the generator. As soon as those get too hot the failsafe will kick in again and the mill goes flat (totally neutral blade setting, the machine won't be moved by the wind like that) and stops.
When the wind is blowing really, really fast the controller will change the pitch of the blades to prevent them from spinning too fast. Prevent that and it redlines, resulting in anything from worn parts to catastrophic failure of the structure.
"Full speed reverse?" You could perhaps increase fatigue overtime. Some wind turbines can start spinning to get to a more favorable position in their power curve, I'm not aware of utility grade ones being able to do that, or go "full speed" enough to cause physical damage.
I have some experience with network access in a UK wind farm. They were extremely paranoid about network security.
if the API is literally foolproof, then great. But an API that can cause no damage does not make a lot of sense to be paired to a device that has poor network security.
Security in these systems are dedicated network circuits and firewalls configured to only allow access on a specific port, from a specific IP address on a specific port.
Old technology our fusion reactors all run TypeScript compiled down to WebAssembly with some Elm interop.
Mostly the Elm is there so our devs can go to conferences and look down on others for not using Elm, I mean why else would you adopt new technology if not for that?.
At that point, there ain't shit you can do to stop an attacker with software based security. A human being, sitting in front of the hardware, is going to win.
Also, it's not that easy to damage these things. There certainly are cases where you can add wear and tear, decrease life span, and if the weather is cooperating, cause catastrophic failure. But it's certainly not a sure thing, and in most of the failure modes they outlined, you'd have plenty of time to shut them down and get a tech on site.
A little bit of dynamite (or any sort of improvised explosive) is cheap, readily available, and requires the same physical access, only it happens to be a far more reliable way to cause failure...
I do wonder if the lack of security is because of budget constraints (i.e. it was proposed by engineers but rejected by management as a needless cost), or if everyone didn't even think that there would be the potential of a breach and the possibility of exploitation?
then its taken out of the hands of those that want to secure it. If you take two companies one developing a secure and working product and the other just developing a working product capitalism will weed out the secure product and pass the insecure one. This is because it is cheaper to create, will get to market more quickly and be easier to configure.
As these sorts of attacks are rare and there is no established and straight forward legal framework to economically punish those without security; the company with least security almost always wins. Then when someone does show the security holes the tendency is just to arrest them in order to keep this awful system going. :D
I'm not entirely sure how we start to fix this.
This needs to be solved at regulatory level. High computer security standards need to become part of whatever work and product safety rules companies already have to follow. But that doesn't look like is going to happen soon, so as an alternative...
Did Maersk recover from that ransomware attack two days ago?
I sincerely hope they didn't. We need an economically meaningful clusterfuck to get people to pay attention.
Related: I think the only way for security to get taken seriously, by both companies and governments alike, is to have someone do some high-profile, damaging hacks "pro bono". Now I would hope such actors stay away from power systems due to risk of loss of life (don't want to disrupt traffic, or hospitals). But this was yesterday on Morning Paper:
https://blog.acolyer.org/2017/06/28/an-experimental-security...
I'd say industrial robots could be a good target. If someone started shutting down the plants of some prominent manufacturers of non-life-critical products, maybe enough people would lose money for someone to start treating it seriously...
I'm not even sure they're wrong per se. In theory (!!) a benevolent watchful government can promote liberty and protect its citizens (or in my case The Queen's subjects).
Somewhat-to-mostly, yes. http://gcaptain.com/maersk-operational-update-on-cyber-attac...
Still, it undoubtedly cost them a lot. The question is did it cost them more than the prevention would have?
You say of course, they only needed to be up-to-date on patches. But there's a cost to that, and we don't know that they don't insure (or self-insure) against IT disasters (they likely do, given their size and scope).
It is more than budget constraints though. I have primarily determined that budget constraints, while a factor, are a side-effect issue of a more root cause. Namely, a lack of representation for the IT department to the decision makers, whether that be a board of directors, the C-levels, etc.
The problem is two-fold.
The first problem is the management types are failing to understand that they need that representation to help guard from issues like these. Instead they often see more people as in their way and extra salary costs, and I have seen a disturbing trend the past 10 years or so of straight up gutting IT departments, often replaced by half-assed msp type consultants and highly overworked t1 and t2s.
Second, is that the kinds of people that should be filling that role, often don't want to or don't have the business background to do it properly. Over on /r/sysadmin, ask how many senior sysadmins don't even have a CTO or CIO to report to, and instead are reporting straight to a CEO or even to a CFO. Often, when a CTO is hired, they are too far on the MBA side to do the department justice, or they are simply too focused on trying to be a techy often spending too much of their time pretending to be a programmer or something similar. Many of the sysadmins spend an inordinate amount of their time either supporting the business and trying to keep up with industry movement, to the point they often are failing to bridge the business-political gap that exists. They often understand the issue, but fail to put in to upper-management in a way that convinces them, which often leads to resentment or apathy over time, not to mention increased burn-out.
I think there is a lot of opportunity to fix these issues though. A good sysadmin who transitioned into an MBA style program and then attempted to take a CTO/CIO role could really shine. In general I feel like the role of CTO/CIO is ripe for a huge turnover of fresh blood able to push more radical changes needed to survive the future.
Another potential solution is in IT workers forming some type of actually useful or powerful union. LOPSA just doesn't cut it. We have seen union busting in the past, but the IT workforce is in a huge position of power to get a real union going, and hopefully with mechanisms to protect from the degredation and devolution other union forces have endured.
The bottom line is this, in the end, these problems are managements fault, and until management is punished monetarily, legally, or through some other mechanism, they will not change their ways.
bonus: you would be surprised at how many IT departments don't even have a budget (IE aren't given the numbers, or not in a proper form, etc. They get told to make proposals and they either get rejected or approved. You can guess which happens more.)
second bonus: excess proprietary black boxes and reliance on third-party support breeds contempt for security. Misconfigured or lazily configured crap because everyone is cutting corners.
Their "hack", which requires physical access, is about as practical as throwing a physical spanner in the mechanics.
EDIT: I'd like to point out, there are reasons why you might want to be able to access the SCADA system of other wind turbines, from the network access of one wind turbine, which would be to allow wind-yaw optimising wind lidar systems to optimise the yaw of other, local, turbines.
Now, there are some great arguments to be made that software security in those buildings should also be improved, but that literally doesn't matter if someone has physical access. At best you're delaying.
Physical access trumps everything. There is no software on the planet that can prevent a determined attacker with physical access.
Software attacks are often far far amplified and harder to trace than their in person counterpart.
The whole freaking article is about companies paying specialists to see how secure their farms are.
My issue is that the article glides past the "physical access" part to focus on the "scary cyber weapons" part.
That's bullshit. If it was a remote exploit from an internet connected machine, sure: that's scary.
This wasn't that.
At some point you are going to have to focus on the network part of security. Getting physical access to one Google server shouldn't allow you to bring down all of Google.
They seem to have discovered a conference that will give them a platform to promote themselves by banging on about known security problems while providing zero actionable advice towards finding more weaknesses or preventing future weaknesses.
Nah, I guess you're right. Those aren't a novel discovery either.
Just blast with full power a recording of ultrasonic bat noises to the turbines.
But as others pointed out, if you have physical access, of course you'll be able to do something nefarious.
Then, wind farms are offline all the time, for all different reasons, so this would actually not that big a deal (apart from the owner of course). And that you are able to hack into the protocols, it is not really surprising, since most of the stuff has no authentication at all. You could of course filter for the MAC addresses of the devices, but this is so much hassle for any maintenance personnel that I doubt that it is in place in that many places.
Additionally, at least in Europe, most of the wind farms are rather small, so we are talking about a few turbines at once. The large ones have actually often enough dedicated staff which will look after them.
That would not help security wise.
I generally describe it as the digital equivalent of swapping the plates on your car.
What year is this?
Pick two.
What you should be saying is that secure software isn't cheap, and management doesn't see a point in spending extra money