Softest Target, Powergrid: Hacked Often

Report: U.S. electrical grid hacked repeatedly over past decade

WashingtonExaminer: State-backed hackers have probed and gained control of networks in parts of the electrical grid at least a dozen times over the last decade, according to officials.

“The grid is a tough target, but a lucrative target,” Keith Alexander, a former director of the National Security Agency, told the Associated Press. “The number of sophisticated attacks is growing. There is a constant, steady upbeat.”

Intrusions have come from China, Russia and Iran. Rather than trying to inflict immediate damage, officials say, the perpetrators have been trying to probe for vulnerabilities and stow away in critical systems.

“If the geopolitical situation changes and Iran wants to target these facilities, if they have this kind of information it will make it a lot easier,” Robert Lee, a former U.S. Air Force cyberwarfare operations officer, told the AP. “It will also help them stay quiet and stealthy inside.”

One specific incident cited by the AP involved Calpine Corp., a power producer with 100 power plants operating in 18 states and Canada. Experts say that information stolen from one of Calpine’s contractors was used to gain access to the company’s systems in 2013, and added that to the best of their knowledge, the perpetrator may still have access to Calpine’s systems today.

Citing another incident, the Wall Street Journal reported on Sunday that Iranian hackers gained control over the operating system of a small dam less than 20 miles from New York City. Officials from the FBI looked into the incident at the Bowman Avenue Dam in Rye, New York, in 2013.

The Department of Homeland Security would not confirm that event, but said in a statement that it was continuing “to coordinate national efforts to strengthen the security and resilience of critical infrastructure” and “working to raise awareness about evolving threats and promote measures to reduce risks.”

Part of the problem is that the technology powering critical infrastructure is often decades old.

“Some of the control systems boot off of floppy disks,” said Patrick Miller, who formerly performed hydroelectric dam cybersecurity for the U.S. Bureau of Reclamation and Army Corps of Engineers. “Some dams have modeling systems that run on something that looks like a washing machine hooked up to tape spools. It looks like the early NASA stuff that went to the moon.”

Intelligence officials have consistently cited the nation’s critical infrastructure as its most significant modern vulnerability in cyberspace. “My No. 1 threat that I see here is the threat to our critical infrastructure,” National Counterintelligence Executive William Evanina told the Washington Examiner in November.

Adm. Mike Rogers, the director of the National Security Agency and head of U.S. Cyber Command, has expressed the same sentiment.

“It is only a matter of ‘when’ that someone uses cyber as a tool to do damage to the critical infrastructure of our nation,” Rogers said in October. “I’m watching nation-states, groups within some of that infrastructure.

“At the moment, it seems to be really focused on reconnaissance and attempting to understand the characteristics of the structure, but it’s only a matter of time I believe until someone actually does something destructive,” Rogers added.

***

How it was found?

SAN JOSE, California (AP) — Security researcher Brian Wallace was on the trail of hackers who had snatched a California university’s housing files when he stumbled into a larger nightmare: Cyberattackers had opened a pathway into the networks running the United States’ power grid.

 

Digital clues pointed to Iranian hackers. And Wallace found that they had already taken passwords, as well as engineering drawings of dozens of power plants, at least one with the title “Mission Critical.” The drawings were so detailed that experts say skilled attackers could have used them, along with other tools and malicious code, to knock out electricity flowing to millions of homes.

Wallace was astonished. But this breach, The Associated Press has found, was not unique.

About a dozen times in the last decade, sophisticated foreign hackers have gained enough remote access to control the operations networks that keep the lights on, according to top experts who spoke only on condition of anonymity due to the sensitive nature of the subject matter.

The public almost never learns the details about these types of attacks — they’re rarer but also more intricate and potentially dangerous than data theft. Information about the government’s response to these hacks is often protected and sometimes classified; many are never even reported to the government.

These intrusions have not caused the kind of cascading blackouts that are feared by the intelligence community. But so many attackers have stowed away in the largely investor-owned systems that run the U.S. electric grid that experts say they likely have the capability to strike at will.

And that’s what worries Wallace and other cybersecurity experts most.

“If the geopolitical situation changes and Iran wants to target these facilities, if they have this kind of information it will make it a lot easier,” said Robert M. Lee, a former U.S. Air Force cyberwarfare operations officer.

In 2012 and 2013, in well-publicized attacks, Russian hackers successfully sent and received encrypted commands to U.S. public utilities and power generators; some private firms concluded this was an effort to position interlopers to act in the event of a political crisis. And the Department of Homeland Security announced about a year ago that a separate hacking campaign, believed by some private firms to have Russian origins, had injected software with malware that allowed the attackers to spy on U.S. energy companies.

“You want to be stealth,” said Lillian Ablon, a cybersecurity expert at the RAND Corporation. “That’s the ultimate power, because when you need to do something you are already in place.”

The hackers have gained access to an aging, outdated power system. Many of the substations and equipment that move power across the U.S. are decrepit and were never built with network security in mind; hooking them up to the Internet over the last decade has given hackers new backdoors in. Distant wind farms, home solar panels, smart meters and other networked devices must be remotely monitored and controlled, which opens up the broader system to fresh points of attack.

Hundreds of contractors sell software and equipment to energy companies, and attackers have successfully used those outside companies as a way to get inside networks tied to the grid.

Attributing attacks is notoriously tricky. Neither U.S. officials nor cybersecurity experts would or could say if the Islamic Republic of Iran was involved in the attack Wallace discovered involving Calpine Corp., a power producer with 82 plants operating in 18 states and Canada.

Private firms have alleged other recent hacks of networks and machinery tied to the U.S. power grid were carried out by teams from within Russia and China, some with governmental support.

Even the Islamic State group is trying to hack American power companies, a top Homeland Security official told industry executives in October.

The attack involving Calpine is particularly disturbing because the cyberspies grabbed so much, according to previously unreported documents and interviews.

Cybersecurity experts say the breach began at least as far back as August 2013.

Calpine spokesman Brett Kerr said the company’s information was stolen from a contractor that does business with Calpine. He said the stolen diagrams and passwords were old — some diagrams dated to 2002 — and presented no threat, though some outside experts disagree.

Kerr would not say whether the configuration of the power plants’ operations networks — also valuable information — remained the same as when the intrusion occurred, or whether it was possible the attackers still had a foothold.

The hackers stole user names and passwords that could be used to connect remotely to Calpine’s networks, which were being maintained by a data security company. Even if some of the information was outdated, experts say skilled hackers could have found a way to update the passwords and slip past firewalls to get into the operations network. Eventually, they say, the intruders could have shut down generating stations, fouled communications networks and possibly caused a blackout near the plants.

They also took detailed engineering drawings of networks and power stations from New York to California — 71 in all — showing the precise location of devices that communicate with gas turbines, boilers and other crucial equipment attackers would need to hack specific plants.

Cylance researchers said the intruders stored their stolen goods on seven unencrypted FTP servers requiring no authentication to access details about Calpine’s plants. Jumbled in the folders was code that could be used to spread malware to other companies without being traced back to the attackers’ computers, as well as handcrafted software designed to mask that the Internet Protocol addresses they were using were in Iran.

Calpine didn’t know its information had been compromised until it was informed by Cylance, Kerr said.

Iranian U.N. Mission spokesman Hamid Babaei did not return calls or address questions emailed by AP.

Cylance notified the FBI, which warned the U.S. energy sector in an unclassified bulletin last December that a group using Iran-based IP addresses had targeted the industry.

Homeland Security spokesman SY Lee said that his agency is coordinating efforts to strengthen grid cybersecurity nationwide and to raise awareness about evolving threats to the electric sector through industry trainings and risk assessments. As Deputy Secretary Alejandro Mayorkas acknowledged in an interview, however, “we are not where we need to be” on cybersecurity.

That’s partly because the grid is largely privately owned and has entire sections that fall outside federal regulation, which experts argue leaves the sector poorly defended against a growing universe of hackers seeking to access its networks.

As Deputy Energy Secretary Elizabeth Sherwood Randall said in a speech earlier this year, “If we don’t protect the energy sector, we are putting every other sector of the economy in peril.”

 

A Money Trail: Iran to Hamas to Islamic State

For Hamas and Islamic State, the common enemy is Egypt. Prime Minister Netanyahu of Israel spoke truth to power on this relationship months ago.

Analysis: Money Trail Leads From Iran to ISIS, by Way of Hamas

TheTower: A report published Monday in Ynet that documents ties between Hamas and the Sinai-based branch of ISIS also shows Iran’s role in supporting ISIS.

Israel’s security establishment has pointed out a clear paradox in this dangerous collaboration: the bulk of Hamas’ financial support comes from Iran, which is persistently fighting ISIS in Syria and Iraq. Many Iranians have already been killed on the frontline of this battle. Furthermore, the Iranians are specifically funding the Gaza front against ISIS’s Sinai branch – via Hamas.

The Times of Israel reported in September that Iran, in expectation of the sanctions relief it would receive under terms of the nuclear deal, was smuggling “suitcases of cash” to Hamas so that the terror group could upgrade its arsenal.

Since the deal was signed, Iran has significantly increased its financial support for two of the largest terror groups in the region that have become political players, Hamas and Hezbollah. In the years before the deal was signed, the crippling sanctions limited this support, which had significantly diminished along with Iran’s economy. But Tehran’s belief that tens, or hundreds, of billions of dollars will flow into the country in the coming years as a result of sanctions relief has led to a decision to boost the cash flow to these terror organizations.

At around the same time, Major General Ataollah Salehi, the commander-in-chief of Iran’s armed forces, boasted of the support Iran was giving to terror groups such as Hamas and Hezbollah to help them fight terror wars against Israel.

The Ynet article, coming a week after the leader of ISIS’s Sinai branch was reported in Gaza, highlighted the operational cooperation between Hamas and ISIS. Hamas has been giving funds, received from Iran, to ISIS to finance its operations. Hamas has also provided training to ISIS and treated ISIS terrorists in Gaza hospitals. In return, ISIS has helped Hamas smuggle weapons into Gaza.

Because Hamas has a clear hierarchy and command structure, it is highly unlikely that funds would go to ISIS without approval from both the highest echelons of Hamas and their funders in Iran.

  • Hamas’ military wing in the Gaza Strip has been transferring tens of thousands of dollars a month to the Islamic State group’s Sinai branch over the past year, via one of its emissaries.
  • The transfer of cash is just one part of the military and strategic cooperation between the two groups. The finances of Hamas’ military arm, the Izz ad-Din al-Qassam Brigades, are independent of those of the organization’s political bureau. Hamas is paying the Islamic State militants in Egypt to secure weapons shipments being smuggled through the Sinai to Gaza. More details here.

Saudi Led Coalition vs. Islamic States, Big Questions

Audio interviews of attitudes of the newly announced Saudi coalition against Islamic State and terrorism in the region.

BBC: Saudi Arabia is part of the US-led coalition against IS and is also leading a military intervention in Yemen against Shia Houthi rebels.
The list of 34 members: Saudi Arabia, Bahrain, Bangladesh, Benin, Chad, Comoros, Djibouti, Egypt, Gabon, Guinea, Ivory Coast, Jordan, Kuwait, Lebanon, Libya, Malaysia, Maldives, Mali, Morocco, Mauritania, Niger, Nigeria, Pakistan, the Palestinians, Qatar, Senegal, Sierra Leone, Somalia, Sudan, Togo, Tunisia, Turkey, United Arab Emirates and Yemen.
A joint operations centre is to be established in the Saudi capital, Riyadh, state media reported.
Countries from Asia, Africa and the Arab world are involved in the alliance but Saudi Arabia’s main regional rival Iran is not.
It comes amid international pressure for Gulf Arab states to do more in the fight against so-called Islamic State.
Saudi Defence Minister Mohammed bin Salman said the new alliance would co-ordinate efforts against extremists in Iraq, Syria, Libya, Egypt and Afghanistan.
Neither Iraq nor Syria, whose governments are close to Shia-ruled Iran, are in the coalition, nor is Afghanistan.


Two things stand out immediately about this new Saudi-based Islamic Coalition.
The Shia-majority nations of Iran and Iraq are noticeably absent, as is their ally Syria.
It is far from clear how, in practice, the coalition would conduct counter-terrorism operations in IS-plagued Iraq and Syria without the agreement of those governments.
Secondly, there is the question of the exact definition of terrorism. The Saudi authorities’ interpretation of it extends far beyond the violent actions of armed insurgents.
Recent legislation has branded peaceful opposition activists and reformers, whether online or in the street, as suspected “terrorists” and a security risk to the state.

***

CBC: Saudi Arabia’s defence minister gave a rare press conference on Tuesday to announce a new military coalition of 34 Muslim countries, led by Saudi Arabia, to fight terrorism in the region. The coalition includes a broad range of countries including the United Arab Emirates, Turkey, Egypt and Sudan.

The announcement was welcomed by some, and met with skepticism by others, given that Saudi Arabia has long been accused of turning a blind eye to support for terrorism coming from inside its own borders.

By Wednesday, several of the countries involved, including Pakistan and Malaysia, expressed confusion at having been named as members of a military coalition, and began distancing themselves from the commitment.

Aya Batrawy reports on the Arabian Peninsula for the Associated Press. She was in Riyadh, Saudi Arabia.

David A. Weinberg is skeptical of Saudi Arabia’s new military coalition. He is a senior fellow at the Foundation for Defence of Democracies in Washington.

For a sense of how the American government might be thinking, we were joined by James B. Smith. He was the U.S. ambassador to Saudi Arabia from 2009 to 2013. He’s now the president of the policy consulting firm C and M International in Washington.

We did make multiple requests for comment from the Saudi Arabian embassy in Canada, but we did not receive a response. The Saudi embassy to the United States declined our request for an interview.

Hagel: WH Worked to Destroy Me

Hagel: The White House Tried to ‘Destroy’ Me

21st Century Genocide, Syria

On regime change in Syria, the White House capitulates to Russia

WashingtonPost Editorial Board: RUSSIAN PLANES are still bombing Western-backed forces in Syria every day and targeting hospitals, bakeries and humanitarian corridors. Moscow is still insisting that blood-drenched dictator Bashar al-Assad remain in power indefinitely while trying to exclude opposition groups from proposed peace negotiations by claiming they are terrorists.

Nevertheless, Secretary of State John F. Kerry insisted Tuesday after meeting with Vladi­mir Putin that the Russian ruler and the Obama administration see Syria “in fundamentally the same way.” Unfortunately, that increasingly appears to be the case — and not because Mr. Putin has altered his position.

For four years, President Obama demanded the departure of Mr. Assad, who has killed hundreds of thousands of his own people with chemical weapons, “barrel bombs,” torture and other hideous acts. Yet in its zeal to come to terms with Mr. Putin, the Obama administration has been slowly retreating from that position. On Tuesday in Moscow, Mr. Kerry took another big step backward: “The United States and our partners are not seeking so-called regime change,” he said. He added that a demand by a broad opposition front that Mr. Assad step down immediately was a “non-starting position” — because the United States already agreed that Mr. Assad could stay at least for the first few months of a “transition process.”

Mr. Kerry’s rhetorical capitulation was coupled with the observation that the administration doesn’t “believe that Assad himself has the ability to be able to lead the future Syria.” But he now agrees with Mr. Putin that the country’s future leadership must be left to Syrians to work out. That’s a likely recipe for an impasse — especially as Mr. Assad is still saying he won’t even negotiate with any opponents who are armed or backed by foreign governments. At the same time, the administration’s forswearing of “regime change” sends a message to Mr. Putin and his Iranian allies: The power structure in Damascus that has granted Russia a naval base and served as a conduit for Iranian weapons to the Hezbollah militia in Lebanon can remain. (complete editorial here)

“If the Dead Could Speak” reveals some of the human stories behind the more than 28,000 photos of deaths in government custody that were smuggled out of Syria and first came to public attention in January 2014.

The report lays out new evidence regarding the authenticity of what are known as the Caesar photographs, identifies a number of the victims, and highlights some of the key causes of death. Human Rights Watch located and interviewed 33 relatives and friends of 27 victims whose cases researchers verified; 37 former detainees who saw people die in detention; and four defectors who worked in Syrian government detention centers or the military hospitals where most of the photographs were taken. Using satellite imagery and geolocation techniques, Human Rights Watch confirmed that some of the photographs of the dead were taken in the courtyard of the 601 Military Hospital in Mezze.

If you can stomach more truth, torture and genocide click here.

Why is this an important story? It is a holocaust at the hands of the Syrian leader, Bashir al Assad, a deadly tyrannical leader who is fully supported by Vladimir Putin of Russia and the rogue regime of Iran. Further questions are required, where is the United Nations? Where is the International Criminal Court, why no modern day Nuremberg trial? Why have Western leaders including John Kerry, Barack Obama, David Cameron even the Middle East Gulf States come to accept this?

Many across America say that Syria is not our problem. While there is some truth to that, when the United States is taking in hundreds of thousands refugees without vetting and Europe is being crushed by migrants, it does become a problem for at least America.

The full Human Rights Watch report is here. In full disclosure, multi-billionaire George Soros gave $100 million to HRW in 2010, but it seems there is selective attention, attitudes and investigations by Human Rights Watch as noted with regard to Iran.