More on Generators and SCADA Hacking

The recent generator hacking demonstration from the Department of Homeland Security continues to generate discussion among Internet security experts. Ira Winkler, a former National Security Agency analyst and author, has done extensive "white hat" penetration testing of computer systems running the U.S. power grid. In a column at Internet Evolution, Winkler said the "Project Aurora" demo - in which DHS staff used an electronic attack to destroy a large diesel generator, apparently by altering the engine's operating cycle and causing it to malfunction - couldn't be expanded to threaten the power grid.

But vulnerabilities in power control systems known as SCADA (Supervisory Control and Data Acquisition) offer plenty of other avenues for skilled hackers to damage the grid, according to Winkler, who described a test he conducted 10 years ago on a utility company's network:

In discussions of the generator attack and SCADA hacking, many people are surprised that these kind of systems can be accessed via the Internet. Aren't they managed by some secure internal network?

Winkler addresses this in his post at Internet Evolution:

Winkler writes that hackers have also been able to gain access through modems connected to critical systems for maintenance purposes, or wireless access to allow load tracking so power companies can buy and trade power with other companies. "In order to know the available capacity, you have to eventually connect to SCADA systems," said Winkler. "So there is even an outside connection engineered into the power grid."