Power grid is found susceptible to cyberattack
An emerging network of intelligent power switches, called the Smart Grid, could be taken down by a cyberattack, according to researchers with IOActive, a Seattle security consultancy.
IOActive researchers have spent the past year testing Smart Grid devices for security vulnerabilities and have discovered a number of flaws that could allow hackers to access the network and cut power, according to Joshua Pennell, IOActive's CEO. Smart Grid devices are small computers that are connected to the power grid, giving customers and power companies better control over the electricity they use. There are about 2 million of these devices currently deployed, but many more are expected to be added in coming years.
IOActive and independent security researcher Travis Goodspeed concluded that these Smart Grid devices could be used to spread malicious code.
In the hands of a malicious hacker, this code could be used to cut power to Smart Grid devices that use a feature called "remote disconnect," which allows power companies to cut a customer's power via the network.
IOActive briefed the U.S. Department of Homeland Security on its findings Monday and is advising the utilities industry to better test the systems before deploying them in the real world.
News of IOActive's research was first reported by CNN, ensuring that the security of the Smart Grid will get a lot of public attention as the U.S. moves forward with plans to add another 17 million of these devices over the next few years.
The robustness of U.S. power networks has been a hot-button issue after a technical glitch in 2003 caused a cascading power failure in the eastern United States and Canada that affected 55 million people.
Hackers have eyed power systems before. Last year, the U.S. Central Intelligence Agency confirmed that criminals had hacked into computer systems via the Internet and cut power to several cities in countries outside of the U.S.
The IOActive research will probably never be released publicly: Many of these devices are already deployed and it would be too dangerous to make the bugs known. Pennell said that his team's work was not focused on one particular device maker and that they were able to confirm a number of the theoretical vulnerabilities identified by Goodspeed, who has researched vulnerabilities in the Texas Instruments MSP430 chip used by some Smart Grid devices.
In 2007 Goodspeed demonstrated that it was possible to write a worm that could spread among Msp 430 chips, which are used by some Smart Grid device makers, according to Goodspeed.
Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world
On Twitter now
energy
Powered by Twitter
jfruh
Apple syncing patent can't come soon enough
pasmith
New Twitter features borrow from 3rd party clients
Esther Schindler
Open Source Changes the Software Acquisition Process
mikelgan
How to set up continuous podcast play on the new iTunes
David Strom
Five important Windows 7 mobility features
sjvn
Guard your Wi-Fi for your own sake
Sandra Henry-Stocker
Grepping on Whole Words
Sidekick: The Good News & the Bad News
Either way you look at it Microsoft Data Center management did not follow standards or best practices in this failure. In which case it makes me wonder more about the outsourcing of corporate data much less personal data.
- mburton325
Join the conversation here
Quick, practical advice for IT pros. Made fresh daily.
Want to cash in on your IT savvy? Send your tip to tips@itworld.com. If we post it, we'll send you a $25 Amazon e-gift card.












