After the terrorist attacks on 9/11, there were many concerns about new ways that the terrorists could strike again. One area of concern was the electrical grid, a target that could knock out crucial infrastructure in the U.S.
While there have not yet been any major attacks on the electrical grid, from terrorists or others, industrial consultants working for Automatak have discovered several software vulnerabilities in the electrical grid that could have devastating consequences if exploited.
Automatak consultants Adam Crain, Chris Sistrunk and Adam Todorski have found 25 zero-day vulnerabilities in the protocol that power plants and other parts of the U.S. and Canadian electrical grid use internally, according to the UK Guardian.
Most of the vulnerabilities center around attacks on controlling servers that send them into infinite loops, rendering the servers unable to respond to commands from controllers. This could make sections of the power grid opaque and unable to report what is actually happening.
Image via Shutterstock
The worst vulnerabilities that the consultants found were potential buffer-overflow attacks that overflow code stored for one purpose into the container of another. This, if injected into servers, could enable attackers to potentially control the whole system.
The systems used by the electrical grid go without much scrutiny because they are isolated from the Internet and thereby less accessible to hackers.
Also, few know the SCADA protocols that are used, so it is believed that their obscurity helps them avoid being exploited.
This is the theory, at least.
“If someone tries to breach the control center through the internet, they have to bypass layers of firewalls,” Adam Crane told Wired. “But someone could go out to a remote substation that has very little physical security and get on the network and take out hundreds of substations potentially. And they don’t necessarily have to get into the substation either.”
The investigation into potential holes is part of Project Robus, the team’s ongoing search for vulnerabilities. It reports exploits it finds both to the vendor and to the Department of Homeland Security.
So while there have not yet been any major electrical grid shutdowns, that record might not last.
Edited by Alisen Downey