'American Blackout': TV Movie, or a Real-World Threat?

---

Researched by Industrial Info Resources (Sugar Land, Texas)--On October 27, the National Geographic Channel aired a movie called "American Blackout." The basic premise of the movie was to follow various characters through a 10-day power outage caused by a cyber attack. The message of the movie was quite clear: people are not prepared for such an event, and the chaos that could potentially ensue is a threat to social order and national security.

After the movie was screened, a panel of various experts discussed, among other things, the potential reality such a cyber-attack. Former Deputy of Homeland Security Jane Holl Lute echoed a common sentiment on the panel: the movie was extreme, but as a country "we're not nearly as prepared as we need to be." Aside from the fear such a movie will cause among many viewers, what are the vulnerabilities of the grid that delivers power to homes, hospitals, factories and businesses around the country? Is the movie's plot far-fetched?

In the spring of this year, researchers Adam Crain and Chris Sistrunk began to look for vulnerabilities in some open-source software called Distributed Network Protocol 3.0 (DNP3). DNP3 is an open and public protocol that was developed to implement interoperability between substation computers, RTUs (Remote Terminal Units), IEDs (Intelligent Electronic Devices) and master stations for the power generation and transmission industries. The protocol is now widely used by other industries, like the water, wastewater, transportation, and oil and gas industries. What Crain and Sistrunk found is disturbing: The threat of a blackout is quite real.

A single attacker at one unmanned substation could start a series of events that would lead to a widespread power outage. This is because the communications backbone that utility companies use, called S.C.A.D.A. (supervisory control and data acquisition) systems, are vulnerable to attack using DNP3 communications protocols, which are not filtered by network firewalls. Utilities use S.C.A.D.A. to remotely monitor substation operations to allow them to diagnose issues without necessarily having to send an engineer to the substation. Since there are many remote substations with low levels of security, a motivated attacker could gain access to the communications systems at a single substation and use DNP3 protocols to shut off power at multiple locations.

Sistrunk told Wired, which first covered the story, "If you have control of the master, you have control of the whole system, and you can turn on and off power at will."

The official response to this issue has been slow. The Department of Homeland Security's Industrial Control Systems - Cyber Emergency Response Team (ICS-CERT) is in the process of posting more than two dozen advisories about DNP3 vulnerabilities, resulting from the testing that Adam Crain and Chris Sistrunk have completed to date.

Industrial Info Resources (IIR), with global headquarters in Sugar Land, Texas, three offices in North America and nine international offices, is the leading provider of global market intelligence specializing in the industrial process, heavy manufacturing and energy markets. Industrial Info's quality-assurance philosophy, the Living Forward Reporting Principle™, provides up-to-the-minute intelligence on what's happening now, while constantly keeping track of future opportunities.