Saturday, January 19, 2008

Is This For Real?

I'm not sure if this is real: CIA Admits Cyberattacks Blacked Out Cities:

The CIA on Friday admitted that cyberattacks have caused at least one power outage affecting multiple cities outside the United States.

Alan Paller, director of research at the SANS Institute, said that CIA senior analyst Tom Donahue confirmed that online attackers had caused at least one blackout...

Paller said that Donahue presented him with a written statement that read, "We have information, from multiple regions outside the United States, of cyber intrusions into utilities, followed by extortion demands. We suspect, but cannot confirm, that some of these attackers had the benefit of inside knowledge. We have information that cyberattacks have been used to disrupt power equipment in several regions outside the United States. In at least one case, the disruption caused a power outage affecting multiple cities. We do not know who executed these attacks or why, but all involved intrusions through the Internet."


Two points: 1) This statement mentions cities outside the US, not inside. 2) Since when does the CIA release information like this in a letter to SANS?

9 comments:

Anonymous said...

While the statement was apparently made, it was at a public conference, *not* in a letter to SANS. Not sure where Information Week got that (maybe in a copy of the prepared speech?).

The latest edition of SANS NewsBites (http://www.sans.org/newsletters/newsbites/newsbites.php?vol=10&issue=5) and today's entry in the SANS ISC (http://isc.sans.org/diary.html?storyid=3867) have more info.

- stretch

Richard Bejtlich said...

stretch, I saw both sources already. However, I am seeing confirmation from someone named as a CIA spokesman here:

A CIA spokesman Friday declined to provide additional details.

"The information that could be shared in a public setting was shared," said spokesman George Little. "These comments were simply designed to highlight to the audience the challenges posed by potential cyber intrusions."

Anonymous said...

Whether or not it's true, it smacks of an attempt to heighten awareness of the weaknesses of SCADA. Is there some legislation on the table dealing with SCADA? Perhaps detailing new regulations on the power industries to secure SCADA better?

Statements like this don't happen in a vacuum.

Bert JW said...

It has been a while since a real hacker scare helped keep people panicked and afraid ... :P

Anonymous said...

I had the "pleasure" of seeing Mr. Paller speak this past week and I must say I've had about enough of his nonsense. He sits in his ivory tower and spouts off about things he truly doesn't comprehend. He leaks information to the press and proceeds to cite those same articles in his presentation. What a clown, not sure why anyone trusts him with anything.
-Griz

Steven Andrés said...
This comment has been removed by the author.
Steven Andrés said...

That's an interesting comment, on whether it's just a stunt to direct attention to new legislation. As luck (or coincidence) would have it, last Thursday the FERC (Federal Energy Regulatory Commission) "...approved mandatory reliability standards for protecting physical and electronic access to control systems, training personnel on security matters, reporting incidents, and recovery planning from a cyber incident."

see NY Times

Landon Lewis said...

My guess is that Allan Pallar was trying to leverage his inside contacts (at the CIA in this case) to come out with this press release prior to his 3rd or 4th SANS SCADA Summit. He's always on his soap box with regards to SCADA and I'm sure the labs pat him on the back for it as well. They do teach most of his SCADA courses that have some technical content. I continue to put a lot of these "press" items that contain SCADA into the FUD category.

Anonymous said...

By law the CIA can't look within, only without (well, we know there are some exceptions to this, but generally that's the case), so they better not be in a position to comment on what's happening in the US with regard to SCADA security. The FBI would have to comment on what is happening in this regard inside the US, they are the internally-facing parallel of the CIA, at least in theory.