America’s Electric Grid Has A Vulnerable Back Door—And Russia Walked Through It (#GotBitcoin)

A reconstruction of the worst known hack into the nation’s power system reveals attacks on hundreds of small contractors. America’s Electric Grid Has A Vulnerable Back Door—And Russia Walked Through It (#GotBitcoin)

One morning in March 2017, Mike Vitello’s work phone lighted up. Customers wanted to know about an odd email they had just received. What was the agreement he wanted signed? Where was the attachment?

Mr. Vitello had no idea what they were talking about. The Oregon construction company where he works, All-Ways Excavating USA, checked it out. The email was bogus, they told Mr. Vitello’s contacts. Ignore it.

Then, a few months later, the U.S. Department of Homeland Security dispatched a team to examine the company’s computers. You’ve been attacked, a government agent told Mr. Vitello’s colleague, Dawn Cox. Maybe by Russians. They were trying to hack into the power grid.

“They were intercepting my every email,” Mr. Vitello says. “What the hell? I’m nobody.”

“It’s not you. It’s who you know,” says Ms. Cox.

The cyberattack on the 15-person company near Salem, Ore., which works with utilities and government agencies, was an early thrust in the worst known hack by a foreign government into the nation’s electric grid. It set off so many alarms that U.S. officials took the unusual step in early 2018 of publicly blaming the Russian government.

A reconstruction of the hack reveals a glaring vulnerability at the heart of the country’s electric system. Rather than strike the utilities head on, the hackers went after the system’s unprotected underbelly—hundreds of contractors and subcontractors like All-Ways who had no reason to be on high alert against foreign agents. From these tiny footholds, the hackers worked their way up the supply chain. Some experts believe two dozen or more utilities ultimately were breached.

The scheme’s success came less from its technical prowess—though the attackers did use some clever tactics—than in how it exploited trusted business relationships using impersonation and trickery.

The hackers planted malware on sites of online publications frequently read by utility engineers. They sent out fake résumés with tainted attachments, pretending to be job seekers. Once they had computer-network credentials, they slipped through hidden portals used by utility technicians, in some cases getting into computer systems that monitor and control electricity flows.

Researchers pieced together this account of how the attack unfolded through documents, computer records and interviews with people at the affected companies, current and former government officials and security-industry investigators.

The U.S. government hasn’t named the utilities or other companies that were targeted. The researchers identified small businesses such as Commercial Contractors Inc. in Ridgefield, Wash., and Carlson Testing Inc., in Tigard, Ore., along with big utilities such as the federally owned Bonneville Power Administration and Berkshire Hathaway ’s PacifiCorp. Two of the energy companies targeted build systems that supply emergency power to Army bases.

The Russian campaign triggered an effort by the Federal Bureau of Investigation and Homeland Security to retrace the steps of the attackers and notify possible victims. Some companies were unaware they had been compromised until government investigators came calling, and others didn’t know they had been targeted until contacted by the researchers.

“What Russia has done is prepare the battlefield without pulling the trigger,” says Robert P. Silvers, former assistant secretary for cyber policy at Homeland Security and now a law partner at Paul Hastings LLP.

The press office at the Russian Embassy in Washington didn’t respond to multiple requests for comment. Russia has previously denied targeting critical infrastructure.

Early Victims

In the summer of 2016, U.S. intelligence officials saw signs of a campaign to hack American utilities, says Jeanette Manfra, assistant secretary of Homeland Security’s cybersecurity and communications program. The tools and tactics suggested the perpetrators were Russian. Intelligence agencies notified Homeland Security, Ms. Manfra says.

In December 2016, an FBI agent showed up at a low-rise office in Downers Grove, Ill., less than an hour west of Chicago. It was home to CFE Media LLC, a small, privately held company that publishes trade journals with titles such as “Control Engineering” and “Consulting-Specifying Engineer.”

According to a CFE email, the agent told employees that “highly sophisticated individuals” had uploaded a malicious file onto the website for Control Engineering. The agent warned it could be used to launch hostile actions against others.

Steve Rourke, CFE Media’s co-founder, says his company took steps to fix the infected site. Before long, though, attackers laced other CFE Media trade publications with malicious content, according to security researchers at Accenture ’s iDefense unit and RiskIQ, a San Francisco cybersecurity company, who later analyzed details of the attack.

Like lions pursuing prey at a watering hole, the hackers stalked visitors to these and other trade websites, hoping to catch engineers and others and penetrate the companies where they worked. The Russians could potentially take down “anybody in the industry,” says RiskIQ researcher Yonathan Klijnsma.

America’s Electric Grid Has A Vulnerable Back Door—And Russia Walked Through It (#GotBitcoin)

According to government briefings on the attack and security experts who have reviewed the malicious code. That tactic enabled the Russians to gain access to ever more sensitive systems, said Homeland Security officials in industry briefings last year.

Mr. Vitello of All-Ways Excavating has no idea how the hackers got into his email account. He doesn’t recall reading CFE’s websites or clicking on tainted email attachments. Nonetheless, the intrusion was part of the Russian campaign, according to the security companies that studied the hack.

On March 2, 2017, the attackers used Mr. Vitello’s account to send the mass email to customers, which was intended to herd recipients to a website secretly taken over by the hackers.

The email promised recipients that a document would download immediately, but nothing happened. Viewers were invited to click a link that said they could “download the file directly.” That sprang the trap and took them to a website called imageliners.com.

The site, registered at the time to Matt Hudson, a web developer in Columbia, S.C., was originally intended to allow people to find contract work doing broadcast voice-overs but was dormant at the time. Mr. Hudson says he had no idea Russians had commandeered his site.

The day the email went out—the same day Mr. Vitello’s office phone lighted up in Oregon—activity on the voice-over site surged, with computers from more than 300 IP addresses reaching out to it, up from only a handful a day during the prior month. Many were potential victims for the hackers. About 90 of the IP addresses—the codes that help computers find each other on the internet—were registered in Oregon, an analysis found.

It isn’t clear what the victims saw when they landed on the hacked voice-over site. Files on the server reviewed by the researchers indicate they could have been shown a forged login page for Dropbox, a cloud-based service that allows people to share documents and photos, designed to trick them into turning over usernames and passwords. It also is possible the hackers used the site to open a back door into visitors’ systems, giving them control over their victims’ computers.

Once Mr. Vitello realized his email had been hijacked, he tried to warn his contacts not to open any email attachments from him. The hackers blocked the message.

Sneak Attack

Hackers sent bogus emails from the account of Oregon construction contractor Mike Vitello to herd recipients to a website they had secretly taken over, called imageliners.com. Hackers then used the site to seek access to contractors that do business with U.S. power utilities.

All-Ways Excavating is a government contractor and bids for jobs with agencies including the U.S. Army Corps of Engineers, which operates dozens of federally owned hydroelectric facilities.

Some two weeks later, the attackers again used Mr. Vitello’s account to send a barrage of emails.

One went to Dan Kauffman Excavating Inc., in Lincoln City, Ore., with the subject line: “Please DocuSign Signed Agreement—Funding Project.”

Office manager Corinna Sawyer thought the wording was strange and emailed Mr. Vitello: “Just received this from your email, I assume you have been hacked.”

Back came a response from the intruders who controlled Mr. Vitello’s account: “I did send it.”

Ms. Sawyer, still suspicious, called Mr. Vitello, who told her the email, like the earlier one, was fake.

The Attack Spreads

One company that got one of the bogus emails was a small professional-services firm in Corvallis, Ore. That July, FBI agents showed up there, telling employees their system had been compromised in a “widespread campaign” targeting energy companies, according to the company owner.

After receiving Mr. Vitello’s first bogus email on March 2, a subsequent Homeland Security investigative report says, an employee at the Corvallis firm clicked on the link leading to the hacked voice-over site. She was prompted to enter a username and password. By day’s end, the cyber-operatives were in her company’s network, according to the report, which hasn’t been made public but was reviewed by the researchers.

They then cracked open a portal in the company’s firewall, which separates sensitive internal networks from the internet, and created a new account with broad, administrative access, which they hid from view.

“We didn’t know about it or catch it,” says the company’s owner.

In June 2017, the hackers used the Corvallis company’s systems to go hunting. Over the next month, they accessed the Oregon company’s network dozens of times from computers with IP addresses registered in countries including Turkey, France and the Netherlands, targeting at least six energy firms.

In some cases, the attackers simply studied the new targets’ websites, possibly as reconnaissance for future strikes. In other instances, the investigative report indicates, they may have gained footholds inside their victims’ systems.

Two of the targeted companies had helped the Army create independent supplies of electricity for domestic bases.

On June 15, hackers visited the website of ReEnergy Holdings LLC. The renewable-energy company had built a small power plant that allows Fort Drum in western New York to operate even if the civilian power grid collapses. Fort Drum is the home of one of the Army’s most frequently deployed divisions and is under consideration to be the site of a $3.6 billion interceptor system to defend the East Coast from intercontinental ballistic missiles.

ReEnergy, owned by private-equity investor Riverstone Holdings LLC, suffered an intrusion but its generating facilities weren’t affected, says one person familiar with the matter. The Army was aware of the incident, said a spokesman, who declined to provide additional details.

That same day, the hackers began hitting the website of Atlantic Power Corp. , an independent power producer that sells electricity to more than a dozen utilities in eight states and two Canadian provinces. In addition to downloading files from the site, the attackers visited the company’s virtual private network login page, or VPN, a gateway to the firm’s computer systems for people working remotely, the report says.

Atlantic Power said in a written statement it regularly encounters malicious acts but doesn’t comment on specifics. “To our knowledge, there has never been a successful breach of any of the company’s systems,” it said.

Around midnight that June 28, the hackers used the Corvallis company’s network to exchange emails with a 20-person carpentry company in Michigan called DeVange Construction Inc. The emails appeared to come from an employee called Rick Harris—a persona fabricated by the attackers.

eVange Construction’s systems already may have been compromised. Applications to energy companies from nonexistent people seeking industrial-control systems jobs came from DeVange email addresses, according to security experts and emails reviewed by the researchers. Bogus résumés were attached—tweaked to trick recipients’ computers into sending login information to hacked servers.

The researchers identified at least three utilities that received the emails: Washington-based Franklin PUD, Wisconsin-based Dairyland Power Cooperative and New York State Electric & Gas Corp. All three say they were aware of the hacking campaign but don’t believe they fell victim to it.

A DeVange employee says federal agents visited the company. The company’s owner, Jim Bell, declined to discuss the incident.

That June 30, the hackers sought remote access to an Indiana company that, like ReEnergy, installs equipment to allow government facilities to operate if the civilian grid loses power. That company, Energy Systems Group Ltd. of Newburgh, Ind., a unit of Vectren Corp. , declines to say whether it was hacked but says it has a robust focus on cybersecurity.

The company’s website says one of its customers is Fort Detrick, an Army base in Maryland with a complex of laboratories that defend the nation against biological weapons. Fort Detrick referred questions to Army officials, who said they take cybersecurity seriously but declined to comment further.

As the summer of 2017 wore on, the attackers took aim at companies that help utilities manage their computer control systems. On July 1, the attackers used the Corvallis company to attack two English companies, Severn Controls Ltd. and Oakmount Control Systems Ltd. Next, they attacked Simkiss Control Systems Ltd. also in England, and accessed “account and control system information,” according to the government report.

Simkiss’s website says it markets tools that allow technicians to have remote access to industrial control networks. Among its customers are big electrical equipment makers and utilities including National Grid , which runs electric transmission lines in Britain and parts of the U.S., where it owns utilities in New York, Rhode Island and Massachusetts.

Oakmount, Severn and Simkiss declined to comment, and National Grid says its cybersecurity processes are “aligned with industry best practice.”

By that fall, the hackers returned to Dan Kauffman Excavating in Oregon, breaching its network on Sept. 18, according to the firm. They appeared to lurk quietly for a month. Then, on the night of Oct. 18, emails blasted out to roughly 2,300 of the company’s contacts. The message said, “Hi, Dan used Dropbox to share a folder with you!” and contained a link that said, “View folder.”

Among the recipients: employees of PacifiCorp, a multistate utility; the Portland, Ore.-based Bonneville Power Administration, which runs 75% of the Pacific Northwest’s high-voltage transmission lines, and the Army Corps of Engineers.

Federal officials say the attackers looked for ways to bridge the divide between the utilities’ corporate networks, which are connected to the internet, and their critical-control networks, which are walled off from the web for security purposes.

The bridges sometimes come in the form of “jump boxes,” computers that give technicians a way to move between the two systems. If not well defended, these junctions could allow operatives to tunnel under the moat and pop up inside the castle walls.

In briefings to utilities last summer, Jonathan Homer, industrial-control systems cybersecurity chief for Homeland Security, said the Russians had penetrated the control-system area of utilities through poorly protected jump boxes. The attackers had “legitimate access, the same as a technician,” he said in one briefing, and were positioned to take actions that could have temporarily knocked out power.

PacifiCorp says it takes a multilayered approach to risk management and that it wasn’t compromised by any attack campaigns.

Gary Dodd, Bonneville’s chief information security officer, says he doesn’t believe his utility was breached, though it appears to have received suspicious emails from both All-Ways Excavating and Dan Kauffman Excavating. “It’s possible something got in, but I really don’t think so,” he says.

The Army Corps says it doesn’t comment on cybersecurity matters.

Going Public

The U.S. government warned the public about the hacking campaign in an October 2017 advisory. It attributed it to a shadowy group, sometimes called Dragonfly or Energetic Bear, that security researchers have tied to the Russian government.

In March 2018, the U.S. went further, releasing a report that pinned responsibility for the hostile activities on “cyber actors” working for the Russian government, saying they had been active since at least March 2016. Governments generally have shied away from naming countries involved in cyberattacks, not wanting divulge what they know.

In April 2018, the FBI notified at least two companies by letter that they appeared to have received malicious emails from All-Ways Excavating’s Mr. Vitello.

One was Commercial Contractors of Ridgefield, Wash., which helped renovate an office for the Bonneville Power Administration. Eric Money, the company’s president, says employees thought they had resisted the tainted emails. But the researchers found that a computer with an IP address linked to the company visited Mr. Hudson’s hacked voice-over site the day of the attack.

The other company notified by the FBI, Carlson Testing of Tigard, Ore., has done work for utilities including Portland General Electric, PacifiCorp, Northwest Natural Gas and the Bonneville Power Administration.

Vikram Thakur, technical director of security response for Symantec Corp. , a California-based cybersecurity firm, says his company knows from its utility clients and from other security firms it works with that at least 60 utilities were targeted, including some outside the U.S. About two dozen were breached, he says, adding that hackers penetrated far enough to reach the industrial-control systems at eight or more utilities. He declined to name them.

The government isn’t sure how many utilities and vendors in all were compromised in the Russian assault.

Vello Koiv, president of VAK Construction Engineering Services in Beaverton, Ore., which does subcontracting for the Army Corps, PacifiCorp, Bonneville and Avista Corp. , a utility in Spokane, Wash., says someone at his company took the bait from one of the tainted emails, but his computer technicians caught the problem, so “it was never a full-blown event.” Avista says it doesn’t comment on cyberattacks.

Mr. Koiv says he continued to get tainted emails in 2018. “Whether they’re Russian or not, I don’t know. But someone is still trying to infiltrate our server.”

Last fall, All-Ways Excavating was again hacked.

Industry experts say Russian government hackers likely remain inside some systems, undetected and awaiting further orders.

Updated: 1-26-2022

What Happens When Russian Hackers Come For The Electrical Grid

Emergency training at a restricted facility off Long Island has aimed to minimize the potentially catastrophic effects of a cyberattack on U.S. power infrastructure.

Five times over three years, a desperate scenario has played out on Plum Island, an isolated spit of land just off the northeastern tip of New York’s Long Island. A large part of the power grid has gone down, leaving the population in the dark and critical facilities such as hospitals growing desperate. A team of utility operators and cybersecurity experts scrambles to get the grid back up, while hackers try to keep it down.

Each emergency was a drill held by the Defense Advanced Research Projects Agency (Darpa), the Pentagon’s moonshot research arm. Its goal was to expose utilities accustomed to dealing with hurricanes, blizzards, and other challenges to the reality of a successful cyberattack on the U.S. electrical grid.

Concern about such an event has been mounting within the U.S. government for years. Darpa began laying the groundwork for its drills in mid-2015, part of a five-year, $118 million project called Rapid Attack Detection, Isolation and Characterization Systems—or Radics—after chilling congressional testimony the previous year from then-National Security Agency Director Mike Rogers.

Rogers told lawmakers that hackers had been breaking into U.S. power utilities to probe for weaknesses and that Russia had been caught planting malware in the same kind of industrial computers used by power utilities.

“All of that leads me to believe it is only a matter of when, not if, we are going to see something dramatic,” he said.

The problem has seemed especially urgent in recent months, following a series of ransomware attacks on U.S. facilities and rising tension with China and Russia. Russian troops are massed on the border of Ukraine, a country whose power grid has been hit twice by Russian cyberattacks. Last year the White House launched a 100‑day sprint to accelerate longer-term projects fortifying America’s power infrastructure against similar attacks.

In late December, U.S. officials privately warned utilities they could be targeted if relations with Russia deteriorate, telling them their security teams shouldn’t take the holidays off, according to two people familiar with the briefing. On Jan. 11, U.S. officials publicly called on utilities to comb their networks for signs of Russian intrusions.

Secretary of the Army Christine Wormuth recently told reporters that the power grid would also be a target in a conflict with China over Taiwan.

The drills on Plum Island starkly illustrated the chaos hackers could unleash. Attackers hijacked critical safety equipment, shut down communications, and sent fake data to confuse operators making crucial decisions. Utilities that were once confident they could keep from being hacked are no longer so sure.

“What we’ve seen as a country is the adversary is going to be successful,” says Walter Weiss, Radics’ program manager. “The issue then is, what do you do next?”

While the government periodically practices such scenarios, utility operators rarely do. Until it ended in 2020, Radics offered the 15 utilities that participated near-real-world conditions to test new technologies, some of which they’ve since implemented.

It also jolted them out of any complacency they may have had, says Brian Lynn, a lead trainer for PJM Interconnection LLC, the country’s largest grid operator, who advised Darpa throughout the program. “Anyone who was there really had their eyes opened up,” he says. “And they were able to go back as a firsthand witness to each of their companies and say, ‘Hey, this is a real thing.’ ”

Most histories of cyberattacks on physical infrastructure start with Stuxnet. The 2010 attack, believed to have been carried out by the U.S. and Israel, destroyed more than 1,000 Iranian nuclear centrifuges by manipulating the industrial computers that controlled them. Modern power grids are also heavily computerized, making them more resilient during storms and other weather-related disruptions but also opening new vulnerabilities for cyberattacks.

Russian hackers carried out the first major cyberattack on a nation’s electricity grid in late 2015, taking down part of the Ukrainian national grid for six hours. The following year they staged another attack on Ukraine, infiltrating a transmission substation north of Kyiv and tripping every circuit breaker, briefly severing the flow of power to a section of the city.

The hack was meant not only to punish Ukrainians but also to show what Russia could do to other adversaries, according to Andy Bochman, senior grid strategist at the Idaho National Laboratory and one of the top U.S. experts on cyberthreats to the grid. “Both attacks in Ukraine were demonstrations,” he says. “And the whole world was watching.”

Shortly afterward, Russian malware was discovered inside as many as 10 U.S. utilities, including the operator of a nuclear plant in Kansas. Government officials hastily convened a series of secret briefings with utility executives, prompting the power companies to spend months scrubbing their systems, according to three people familiar with the incident.

The U.S. Department of Energy continued briefing power company executives, warning that, among other things, potential adversaries had been caught manipulating grid components during manufacture, according to two people familiar with the briefings’ contents.

Although the most sophisticated attacks are likely to come from nation-states, the spate of ransomware attacks over the past year shows how widely the ability to paralyze physical infrastructure through cyberattacks has spread, says Ang Cui, founder of Red Balloon Security and a participant in the Plum Island exercises. “What an attacker can do to these embedded devices today makes Stuxnet look like caveman technology,” Cui says.

Hackers who want to bring down a grid would likely manipulate the computers that keep it in balance. Operating a modern grid requires constant realignment to make sure the amount of power sent into the system is equal to the power that households, businesses, and other customers pull from it.

Eric Hittinger, an expert in energy policy who’s an associate professor at Rochester Institute of Technology, likens this process to a bicycle rider constantly shifting her weight to stay upright. If that balance is disrupted badly enough, he says, “everything starts to fall apart. Different parts of the system will start to turn off in unpredictable ways. You end up with cascading failures. You fall off the bike.”

This can happen because of natural events, such as the winter storms in Texas last year, when electricity heading into the grid fell after the weather took power stations offline. The Electric Reliability Council of Texas, the organization that operates the grid, responded by shutting off power in major population centers, averting a cascading collapse by just minutes, according to three people who reviewed data from the incident.

One of the hardest parts of a grid failure is repowering it following a collapse, and the biggest outages could require a tricky maneuver known as a black start, which involves restarting the grid without power from outside the blackout zone.

A particularly nightmarish scenario—and the one that Darpa simulated in its drills—would be a cyberattack where hackers stay in the system and repeatedly disrupt the restart process. In this situation, a blackout that would’ve lasted hours could extend to weeks.

“When it comes to cyber, it’s like you’re repairing the damage from the hurricane while it’s still on top of you,” says PJM’s Lynn. “And I just can’t fix it and know it’s going to hold. I’ve got to keep asking, ‘Did I miss something? Is something still infected?’ ”

“You have to get your systems operations guys, who don’t speak cyber, to talk to your cyber guys, who don’t speak systems operations”

The first drill on Plum Island took place in 2018, with subsequent exercises occurring until October 2020. The action centered on Fort Terry, a now-abandoned part of New York City’s coastal defenses.

The remote island, which is also home to a high-security lab used to study contagious animal diseases, is accessible only by a ferry behind a guard post; the 100 or so participants in each drill spent a week to 10 days there, returning each evening to hotels on Long Island. Employees from utilities and people from National Guard units role-played at their day jobs, while Darpa brought in cyberwarfare experts to act as the hackers.

Participants are loath to reveal many details for fear of giving attackers useful information, but among the biggest challenges was a culture clash between seasoned utility operators and experts in cybersecurity. “You have to get your systems operations guys, who don’t speak cyber, to talk to your cyber guys, who don’t speak systems operations.

And that’s just very challenging,” says Donnie Bielak, a colleague of Lynn’s at PJM who also consulted on the exercises. He remembers the initial attitude of a shift operator from New York as typical: “Basically, he arrived saying, ‘All right, all you cyber nerds, hands off, I got this.’ ”

Once the exercise started and the power went off, though, the inadequacy of the typical recovery techniques became clear. The attackers manipulated data coming from sensors—showing a circuit breaker as open when it was closed, for example. Even unsophisticated-seeming tricks were disruptive.

In one case, attackers dimmed the brightness on a device’s screen, leading recovery crews to waste time misdiagnosing what seemed like dead equipment. In another, operators accustomed to checking the status of components with an online app were flummoxed when the hackers disabled the portal so they couldn’t log in.

At the beginning of one exercise, Weiss reminded a group of cybersecurity experts of their own lack of preparedness by simply flipping the circuit breaker to the conference room where they were gathered. Anyone who hadn’t brought extra laptop batteries or had forgotten a headlamp was basically out of commission.

The exercises generally started with failure, followed by slow progress as the defenders learned to work with experimental technology developed for Radics—and how to operate in their new, contested environment. Eventually, Bielak says, the utility workers who initially brushed off the cybersecurity experts began to work closely with them.

Defenders had to come up with procedures to clean each substation of malware, for instance, before connecting it to the larger grid. If they missed anything, the hackers might flip a breaker at the wrong moment or send manipulated data that could confound the recovery effort.

Even seeming victories were fleeting. During one exercise, defenders managed to restore the grid and reestablish the operations of the model utilities. Power began flowing again to key sites across the island, Weiss recalls, and everyone involved erupted in cheers. A few moments later the grid came crashing down again.

“The collateral damage can sometimes be far different than what the intent was”

Radics, like many Darpa programs, had a limited run, and the exercises ended when the program did. Some of the test equipment remains, and the Energy Department continues to test cybersecurity technologies on the island. But most of the utility workers are no longer involved, a situation that Lynn worries will result in participants letting their newfound skills go stale. “You want that muscle memory,” he says.

Even if they were to continue, the Plum Island exercises involved a small number of utilities, and experts are concerned that the country remains unprepared for a dangerous and unpredictable threat. The situation on the Ukrainian border highlights how foreign conflict raises the likelihood of an attack.

Even an attempt to apply political pressure by conducting a limited cyber operation could set off failures beyond the attackers’ control, according to Tim Roxey, former security chief for North American Electric Reliability Corp., the grid regulator. “The collateral damage,” he says, “can sometimes be far different than what the intent was.”

Plum Island has had some lasting tangible effects. The National Rural Electric Cooperative Association, whose members are mostly small, not-for-profit operators, recently began using a new security tool that it first tested on Plum Island, according to NRECA Chief Scientist Emma Stewart.

Once fully deployed, the tool, called Essence, will help the co-op members, which have comparatively small security budgets, detect cyberattacks on some of their most sensitive equipment.

Cui, whose company makes some of the tools that were tested on Plum Island, says the U.S. has a long way to go in preparing for cyberattacks and in training the utility workers who will be on the front lines.

His team recently examined several common industrial computers used to control the grid and uncovered serious design flaws that could be leveraged by hackers. To prove his point, his team remotely hijacked one of the devices and shut off power to a scale model he built of Manhattan.

“How at risk is this country? Maybe a better question is: How much have we done to prevent something like those scenarios at Radics from happening?” Cui says. “I think it’s pretty clear that we haven’t done nearly enough.”

America’s Electric Grid Has A Vulnerable Back Door—And Russia Walked Through It (#GotBitcoin)

Related Articles:

Your Questions And Comments Are Greatly Appreciated.

Monty H. & Carolyn A

Leave a Reply Cancel reply