Category Archives: Energy

Energy, Security

Stuxnet: Anatomy of a Virus Sensational Video

2 Comments

I disagree with about 90% of this video, and find it annoying that they do not cite references — who says there were 20 zero-days? There were only 4, and even that is debatable, as I’ve said before. It’s a shining example of how speculation has filtered its way into to fodder for sensational videos.

Oooh, scary.

I do not understand how they can avoid mentioning that the guy who is credited with having the most detailed and first knowledge of Stuxnet — Ralph Langner — calls it “very basic”. He even explains how antivirus company researchers, infamous for hyping the threat, are wrong in their analysis.

Stuxnet attack very basic. DLL on Windows was renamed and replaced with new DLL to get on embedded real-time systems (controller). It was not necessary to write good code because of the element of surprise — only had to work pretty well

Nate Lawson gives probably the best and more authoritative explanation of Stuxnet available anywhere, which also contradicts the scary video. Unfortunately, he made a major marketing mistake. He called his blog post “Stuxnet is embarrassing, not amazing“. It’s a post with a modest and realistic view of the code.

Rather than being proud of its stealth and targeting, the authors should be embarrassed at their amateur approach to hiding the payload. I really hope it wasn’t written by the USA because I’d like to think our elite cyberweapon developers at least know what Bulgarian teenagers did back in the early 90′s.

What he should have called it was something like “What the next Stuxnet will look like” or “How Stuxnet could be 100x more powerful”. That would have given him the same level of buzz or even more than the nonsense peddled in the above video.

And what this video should have said is that Iran was infected by a low-grade attack because they had poor security management practices and were compromised by an insider. I mean what are the chances that the nuclear program would have succeeded anyway, given that maintenance failures and rust in thousands of centrifuges also was causing them problems? Or to put it the other way, what are the chances that a high-rate of failure of centrifuges was unanticipated, as explained by the Institute for Science and International Security (ISIS).

The destruction of 1,000 out of 9,000 centrifuges may not appear significant, particularly since Iran took steps to maintain and increase its LEU production rates during this same period. […] One observation is that it may be harder to destroy centrifuges by use of cyber attacks than often believed.

Although the attack was well planned and targeted to exploit a specific set of issues, it leveraged weak and known-bad controls such as unnecessary services, poor isolation/segmentation and no host-based monitoring. It is truly scary too see over and over again (for more than 10 years now) that nuclear energy companies rely on obfuscation and self-assessment more than a set of security best-practices to address risks. Calling Stuxnet sophisticated gives the Iranians far too much credit for their defences and just plays into the hand of those who want to escalate international political conflict.

Energy, Security

Siemens Security Advisory (SSA-625789)

Leave a comment

The Siemens CERT has posted a formal response to two CVSS level 7 vulnerabilities found in the SIMATIC S7-1200 CPU

  1. Replay attack. An attacker can sniff the traffic and then send it again to issue a command to the same controller.
  2. Denial of service for Firmware Version 02.00.02. Scanning the communication interface causes it to stop.

S7-1200

Workarounds, until the firmware is updated, are to disable unnecessary services and segment the network.

As a temporary measure, it is recommended to disable the web server. The ability to disable the web server is available in TIA Portal Version 11. In addition, it is important to ensure your automation network is protected from unauthorized access using the strategies suggested in this document or isolate the automation network from all other networks using an air gap.

Energy, Security

Pentagon Officially Recognizes Energy as Security Issue

Leave a comment

The US military has finally addressed energy risks in its planning, as explained by Federal News Radio

The Pentagon sent its first-ever operational energy strategy to Congress Tuesday, laying out the military’s intent to begin treating energy as a critical military capability.

The goal is to stop focusing on energy as merely a market commodity that must be purchased in order to sustain the department’s various missions.

Defense leaders think that change in thought processes could ultimately reduce the military’s demand for petroleum and promote the development of energy alternatives, with the Pentagon as a new leader in the market.

This marks a huge shift in American policy from the Bush Administration; the government’s investment in the current wars could soon spur much faster innovation in energy efficiency and reduced civilian dependency on oil.

Energy, History, Security

The Last Mountain

1 Comment

Movie PosterThe official selection of the 2011 Sundance Film Festival now is open in select cities. It will only play for a few days.

The Last Mountain documents the effects of coal companies on the environment, health and jobs in America.

  • Almost half of the electricity produced in the U.S. comes from the burning of coal.
  • In the last decade the coal mining industry spent more than $86 million, the railroad industry spent $350 million, and coal burning electric utilities spent more than $1 billion on political campaigns and lobbying.
  • Each year emissions from coal-fired power plants contribute to more than 10 million asthma attacks, brain damage in up to 600,000 newborn children, and 43,000 premature deaths.
  • The health and environmental costs associated with mining, transporting and burning coal, as reported by a new Harvard Medical School study, are estimated to be $345 billion annually – or more than 17¢ per kilowatt hour. These costs are often referred to as “externalities” since they are costs borne by the public which are not reflected in the price of coal-fired electricity.
  • Per the Harvard Medical School report noted above, the cost of coal electricity goes up by approximately 17¢ per kilowatt hour, totaling 23.1¢ – or nearly three times that of wind – if you include the following costs borne by the public: Air Pollution Illnesses, Mercury Poisoning, Health Damages from Carcinogens, Public Health Cost to Appalachia, Climate Change Impact.

Wow, coal costs triple when you account for impact on health? And it’s linked to criminal activity?

Over the past 10 years they’ve destroyed 1.4 million acres illegally. They’ve flattened 500 of the biggest mountains in West Virginia. They’ve illegally buried 2,200 miles of rivers and streams. They detonate the equivalent explosive power every week of the Hiroshima bomb, just in West Virginia.

The data being compiled brings to mind the movement that eliminated coal in London, England.

That city used to think that it had a naturally heavy fog, until they realised that it was a toxic cloud from burning coal. Change really came only after catastrophe, like the deadly winter of 1873

London is famous for its smoky, dirty skies and “pea-soup” nights wrapped in heavy fog. For many, the fog provides a romantic setting for mystery and intrigue, but even Sir Arthur Conan Doyle’s famous character, Dr. Watson, describes the fog as a “greasy, heavy brown swirl…condensing in oily drops upon the window panes.” During this winter, the fog lasted from November to February. In the week following the worst of it, deaths rose 75%.

Then there was the deadly winter of 1952

…a toxic mix of dense fog and sooty black coal smoke killed thousands of Londoners in four days. It remains the deadliest environmental episode in recorded history.

The so-called killer fog is not an especially well-remembered event, even though it changed the way the world looks at pollution. Before the incident, people in cities tended to accept pollution as a part of life. Afterward, more and more, they fought to limit the poisonous side effects of the industrial age.

[…]

Everyone in London walked blind for the next four days. By the time the smog blew off on Tuesday Dec. 9, thousands of Londoners were dead, and thousands more were about to die. Those who had survived no longer spoke of London’s romantic pea-soup fog.

Killer Coal in London

The effect of coal on London was captured by artists and writers of the time. Their work has become a reference point that still shows up today when discussing pollution, as found in a recent article by the New York Times:

There is a Dickensian feel to much of the region. Roads are covered in coal tar; houses are coated with soot; miners, their faces smeared almost entirely black, haul carts full of coal rocks; the air is thick with the smell of burning coal.

There are growing concerns about the impact of this coal boom on the environment. The Asian Development Bank says it is financing pollution control programs in Shanxi because the number of people suffering from lung cancer and other respiratory diseases in the province has soared over the past 20 years.

The difference in America clearly (pun not intended) seems to be that killer coal effects are being spread out over rural communities (the last mountains, lakes, streams) instead of cities and so it is hidden — taking much longer to be accounted for and traced to human decision.

Obvious lessons from history, such as Dickensian London or even a more recent Kathmandu, apparently are not enough to motivate the US to properly regulate coal, reduce harm and seek less costly (e.g. cleaner) alternatives.

“You won’t believe that this is America….and now it’s what we imagine Hell to be.” — Emmylou Harris