{"id":1780,"date":"2011-01-03T09:31:31","date_gmt":"2011-01-03T16:31:31","guid":{"rendered":"https:\/\/emrabc.ca\/?page_id=1780"},"modified":"2016-05-27T11:22:27","modified_gmt":"2016-05-27T18:22:27","slug":"experts-fear-hacking-smart-meters","status":"publish","type":"page","link":"https:\/\/emrabc.ca\/?page_id=1780","title":{"rendered":"ISSUE – Security"},"content":{"rendered":"

<\/object><\/h3>\n

See Full Interview<\/strong><\/em><\/a> with former CIA Director<\/span><\/p>\n

\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026<\/h3>\n

Intel boss’ warning on cyber attacks no joke, say experts<\/b><\/h2>\n

By Malia ZimmermanPublished November 23, 2014 \u00a0FoxNews.com<\/a><\/p>\n

Top cybersecurity experts echoed a dire warning from a top intelligence chief on the vulnerability of the U.S. power grid, with one telling FoxNews.com that state-sponsored hackers could send America\u2019s nerve centers on an \u201cuncontrollable, downward spiral.\u201d<\/p>\n

Admiral Michael Rogers, director of the National Security Agency and commander of the U.S. Cyber Command, told lawmakers Thursday that adversaries of the U.S. conduct regular electronic reconnaissance to reveal weaknesses in America\u2019s industrial control systems, ranging from power plants to sewage facilities. The nation’s entire power infrastructure could prove vulnerable to a crippling assault, should China or any of the other nations who sponsor such efforts find an Achilles’ heel and move to exploit it, he said.<\/p>\n

Rogers was not exaggerating, according to experts.<\/p>\n

\u201cUnlike the recent headline attacks, which result in significant loss of data, attacking a nation state\u2019s critical infrastructure requires persistence and long term discipline of not being detected. The scale and techniques required to do this exist in the military and intelligence functions of various world governments,\u201d said Ron Gula, CEO of Columbia, Md.,-based Tenable Network Security.<\/p>\n

Rogers told members of the House Intelligence Committee China along with \u201cone or two\u201d other countries have the capability to mount devastating cyber-attacks, and merely remaining on the defensive is a \u201closing strategy.\u201d The possibility of such cyberattacks by U.S. adversaries has been widely known, but never confirmed publicly by the nation’s top cyber official.<\/p>\n

Admiral Michael Rogers, who heads the NSA, warned lawmakers that the U.S. must go on the offensive to avoid a crippling cyber-attack.<\/p>\n

Brian Ingram, cyber security investigator and owner of Consulting Investigation Services, headquartered in Dallas, called the assessment \u201cdead on accurate.\u201d<\/p>\n

\u201cChina has, for years, participated in massive electronic probing of networks in the U.S.,\u201d Ingram said. \u201cThe ability to conduct these network scans is not new, the sophistication of the newer methodologies is growing exponentially and our defenses, from the little made public or known to those in the industry, has not kept pace.\u201d<\/p>\n

There is a “huge risk” that America’s own power utilities could be turned into a weapon used against U.S. citizens and controlled from another land, said Larry Ponemon, chairman and founder of the Ponemon Institute.<\/p>\n

\u201cWhile security has improved substantially, there is no way, none at all, to prevent an attack.\u201d<\/p>\n

– Paul Rosenzweig, Heritage Foundation<\/p>\n

\u201cWe could lose the ability to control our power systems,” said Ponemon, whose organization is based in Traverse City, Mich. “If this happens with a nuclear power facility, the attack could cause a melt down or explosions, cause considerable damage for people at or near the plant, and put it out of commission for many, many months.\u201d<\/p>\n

The U.S. and Israel are believed to have mounted just such an attack on Iran’s nuclear weapons program, Ponemon noted, referring to the engineered computer virus known as Stuxnet that was discovered in 2010. The attack, delivered by an infected thumb drive, targeted Iran’s Natanz nuclear facility, and is believed to have shut down some one-fifth of Iran\u2019s nuclear centrifuges. The virus was used to obtain information on the nuclear facility and put pressure on centrifuges, causing them to spin out of control.<\/p>\n

Paul Rosenzweig, visiting fellow at the Heritage Foundation, said experts have known for a long time that an even more devastating and costly attack could be mounted on the U.S., where the power grid is a vast complex of public and private infrastructure.<\/p>\n

\u201cWhile security has improved substantially, there is no way, none at all, to prevent an attack,\u201d Rosenzweig said.<\/p>\n

The private sector has cooperated with the U.S. government for years to share information and increase the ability to defend itself from cyber attacks, Gula said. However, this is a growing challenge.<\/p>\n

\u201cThe problem is the attack surface is so large that we are constantly reacting to moves made by our potential adversaries,\u201d Gula says.<\/p>\n

Network security is much like airline or automobile safety, Gula explained. Government regulations, technology breakthroughs from industry and development of best practices will minimize the threat to the energy infrastructure, but there is no one entity responsible for this, he said.<\/p>\n

\u201cPrivate industries should be expected to defend themselves from less skilled hackers, corporate espionage and maintain a network compliant with their industry\u2019s regulations. They should also expect to work with the various U.S. government groups to share information and respond to nation-state attacks,\u201d Gula said.<\/p>\n

For now, the best protection the U.S. has is its economic ties to China – and the fact that America could answer an attack with one of its own – the strategy known in the Cold War as “mutually assured destruction.”<\/p>\n

\u201cWhat would China gain from turning off Los Angeles and why would China do that in light of its investment in the U.S. and the possibility that the U.S. could reciprocally turning off Beijing?\u201d Rosenzweig asked, before cautioning that America\u2019s vulnerability would become relevant if there was a major conflict with China.<\/p>\n

There is a general sense the U.S. faces more of a threat from irrational actors, such as smaller nations and independent terrorist groups, who probably don\u2019t have capabilities now, but could at some point in the future, Rosenzweig said.<\/p>\n

If and when committed enemies of the U.S. gain the ability to strike, America’s dependence on its power grid could prove to be a fatal weakness..<\/p>\n

\u201cCan you plan anything in the electronic age if you can\u2019t rely on the power grid?” Ingram asked. “Financial exchanges, eCommerce, banking, medical records, postal\/mail delivery, trucking, railways\u2026all of them are interconnected in our society and the ability to protect that, to ensure that our way of life is not dependent on a foreign power\u2019s benevolence is vital to have a thriving and prosperous U.S.\u201d<\/p>\n

http:\/\/www.foxnews.com\/world\/2014\/11\/23\/intel-boss-warning-on-cyber-attacks-no-joke-say-experts\/<\/span><\/a><\/span><\/p>\n

\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026<\/h3>\n

 <\/p>\n

Experts fear hacking of new smart meters<\/h2>\n

As California’s utilities roll out millions of “smart meters” in the coming years, they’re creating, for the first time, the possibility that the electricity infrastructure could be hacked through a home, security consultants say.<\/p>\n

With San Diego Gas & Electric Co. and Southern California Edison installing 7.3 million smart meters \u2014 upgrading their entire customer base \u2014 they’re essentially attaching small computers to each house, each equipped with wireless communications back to the utilities.<\/p>\n

Utilities say they have been hardening the smart meters since they began development, but security consultants say they are worried: If criminals cracked the system, they could remotely install a virus that could shut down power for millions of customers.<\/p>\n

The new smart meters will have a host of capabilities: They will credit homeowners who produce their own electricity via solar cells or wind turbines, be able to wirelessly communicate data to the utility and let utilities turn off the power remotely, among other functions that could be added.<\/p>\n

“Were it telemetry only, then the only compromise is privacy,” said Mike Davis, senior security consultant for the security service IOActive. “When you add remote disconnect, then you increase the attractiveness of the meter as a target.”<\/p>\n

Davis and his team hacked into smart meters last spring as part of a proof-of-concept they showed off at a Las Vegas security conference last summer.<\/p>\n

They reverse engineered meters they bought on eBay and found in trash bins near installation sites. Then they installed a computer virus that would replicate itself across the wireless network and block the utility from each meter as it went.<\/p>\n

Representatives from Edison and SDG&E said that the demonstration didn’t change their work at all; that they’ve been working on security since they started development three years ago.<\/p>\n

But Davis noted that utilities now require secure recycling of old meters, and eBay won’t allow that sort of gear to be sold on the site any longer. Davis said they have done such a good job keeping the meters out of his hands that he hasn’t hacked the most recent meters because he can’t find one through legal means.<\/p>\n

The demonstration may have also driven the federal government to create standards for smart meters in the previously unregulated smart meter arena. The National Institute of Standards and Technology, a branch of the Department of Commerce, released a draft of standards in September.<\/p>\n

“Our security complies with the emerging smart grid standards in NIST,” said Paula Campbell, director of the Edison Smart Connect Program.<\/p>\n

“There’s unique encryption, all designed with the goal in mind of minimizing the vulnerabilities.”<\/p>\n

The encryption would apply primarily to over-the-air communications from the devices. In theory, a criminal could sit in a car up to a mile away from a site and attempt to hack the WiFi signal of the devices.<\/p>\n

Baker said that would be pretty hard.<\/p>\n

“It’s called security in depth,” Baker said. “The old technology is there’s one key that could open every door in the neighborhood. In the systems employed today, you need a different key for every room in your house.”<\/p>\n

Alternatively, a hacker could just try to wire directly into a meter.<\/p>\n

All the devices will include a detector that sends an alert to the utility if the meter is shaken, removed or even if the front cover is taken off.<\/p>\n

“How you respond to that, isolate that, control that in an organized fashion, it’s part of our overall security program,” said Chris Baker, chief information officer for SDG&E.<\/p>\n

Davis, though, said he thinks the utilities are just buying a product, and it’s the manufacturers who are rushing to market.<\/p>\n

Itron Inc., the Washington-based supplier of smart meters to both Edison and SDG&E, pooh-poohed Davis’ demonstration this summer.<\/p>\n

“We believe our implementation is very secure and cannot be subjected to the kind of attacks shown by IOActive in their demonstration of unsecured equipment,” company spokeswoman Kim Papich said in an e-mailed statement.<\/p>\n

In a separate statement, Itron said it hired outside companies to test their systems. Both SDG&E and Edison said they also had contracted with third parties to conduct “penetration tests,” in which security professionals search for holes in the security.<\/p>\n

Davis said he is pleased that there is third-party testing, but he is still worried about creating a monoculture of devices. Because all the smart meters installed by SDG&E and Edison will be made by the same company and use the same software, they’re only as strong or as weak as any one unit.<\/p>\n

“If the attacker finds the vulnerability in one, the entire network is vulnerable,” he said. “That’s a catastrophic failure.”<\/p>\n

http:\/\/www.electricityforum.com\/news\/jan10\/Expertsfearhackingofnewsmartmeters.html<\/a><\/p>\n

\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026<\/h3>\n

440 million new hackable smart grid points<\/h2>\n

By the end of 2015, the potential security risks to the\u00a0smart grid<\/a> will reach 440 million new hackable points. Billions are being spent on smart grid cybersecurity, but it seems like every time you turn around, there is yet another vulnerability exposing how to manipulate smart meters or power-grid data. At the\u00a0IEEE SmartGridComm2010<\/a> conference, Le Xie, Texas A&M University\u2019s assistant professor of electrical and computer engineering, gave examples of how attackers could\u00a0hack the power grid for fun and profit<\/a>.<\/p>\n

http:\/\/blogs.computerworld.com\/17120\/400_million_new_hackable_smart_grid_points<\/a><\/p>\n

\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026<\/h3>\n

Hacking water meters is easier than it should\u00a0be<\/h2>\n

August 6, 2011 |\u00a0Dean Takahashi<\/a><\/p>\n

The smarter water meters become, the easier they\u2019re getting to hack. Like many things in electronics, water meters become easier for hackers to break into and misuse when they are upgraded to include wireless and computer technology.<\/p>\n

John McNabb, a security expert who has focused on protecting drinking water, told the audience at the Defcon hacker conference in Las Vegas today that, despite a $40 billion-dollar water economy, it\u2019s still far too easy to hack into water meters used by utilities around the country. He concluded that nation\u2019s 150,000 water utilities have a number of well-known vulnerabilities to cyber attacks and they should fix them on behalf of the 250 million consumers they serve.<\/p>\n

\u201cThe energy theft when it comes to water theft is billions of dollars a year,\u201d McNabb (pictured) said. \u201cElectric utilites assume they use about 10 percent losses to theft each year. Water could be similar, and it winds up increasing the rates for others.\u201d<\/p>\n

Lots of water meters are still mechanical devices. Water companies lose revenue when those meters get old and sediment builds up in them so that they measure lower water usage. Utilities have started to put in wireless water meters that are easier to read and less costly. For instance, some meters broadcast a wireless signal so that a meter reader can simply drive by, detect the signal, and record it electronically. That reduces the cost of reading meters. Here\u2019s McNabb\u2019s white paper<\/a> on the topic.<\/p>\n

Adding computer technology throughout the infrastructure helps bring down costs. It\u2019s easier for utilities to monitor usage on any given day and send bills more frequently. They can also detect water leaks more precisely, based on water usage patterns throughout the population. Water meters with wireless attachements can become sensors for the utility and two-way communications systems. Utilities can also resolve billing disputes better, provide more customer service, enforce water conservation, and identify illegal water connections.<\/p>\n

Smart water meters are the new thing. The smart water meter market is expected to total $4.2 billion between 2010 and 2016, according to market researcher Pike Research. And Pike predicts that the worldwide installed base of smart water meters will increase from 5.2 million in 2009 to 31.8 million by 2016. The market researcher defines a smart meter as a component of a smart grid, with two-way communications between the meter and the water utility that allows the utility to get readings on an hourly (or more frequently) basis and issue commands to the meter. California in particular is racing ahead in deployment, and 25 manufacturers are making the smart meters now.<\/p>\n

\u201cIt\u2019s like an electronic cash register for the utility,\u201d McNabb said. \u201cBut it could also be a tool for Big Brother,\u201d a reference to the totalitarian figurehead of George Orwell\u2019s novel, 1984.<\/p>\n

The problem with the wireless water meters is that they are vulnerable because of the wireless medium they use. Communications are not encrypted (largely due to higher costs) and so they are easily intercepted, faked or even jammed. The sensors are unattended and hang on the meter, outside the house, and so they are easily tampered with. The cyber attacks against them can be active, where commands are issued to them, or passive, where the data is taken.<\/p>\n

If people want to reduce their water bills, they could hack the sensors. They could also increase the bill paid by a neighbor they don\u2019t like, or evade restrictions on the amount of water used. And since the usage of water indicates the presence or absence of the homeowner, the hacked water meters can be used for surveillance purposes.<\/p>\n

Last year, Greek hacker Thanassis Giannetsos demonstrated how it was possible to introduce a worm to the smart electrical grid (similar to water grids) on a simulated network. Ioactive, a security penetration testing firm, also did something similar. But McNabb said that the concern about Big Brother is also a big one. He said that the water department\u2019s staff could learn what time of day you take a shower, when you are at home, and when you\u2019re on vacation.<\/p>\n

\u201cAre we being paranoid?\u201d McNabb asked. \u201cIt\u2019s already established that law enforcement is using electricity use and thermal imaging,\u201d where the heat generated by indoor marijuana-growing farms has been measured.<\/p>\n

McNabb also noted that the Hydrosense device created by researchers at the University of Washington in Seattle can be attached to water faucets to determine the usage coming out of a particular fixture in the home.<\/p>\n

McNabb said his research showed that vendors don\u2019t use frequency hopping spread spectrum (FHSS), which could stop eavesdropping on wireless signals, or encryption with their smart meters. One utility used a default password system which used a generic password on its web site (where users would log in and view their water usage) that was easily hacked. Transceivers for sending commands to the water meters can be purchased on eBay.<\/p>\n

But some manufacturers are starting to build 128-bit encryption and spread spectrum security into their meters. McNabb, who was an elected water commission and managed a small water system for 13 years, described the vulnerabilities in some detail, including how to inexpensively \u201csniff\u201d the wireless water meter readings, and has described them in a white paper. He said he will put it online in the near future.<\/p>\n

Sniffing wireless water meters should\u2019t be too difficult, he said, but there are some technical hurdles. Most U.S. meters broadcast in the 900 megahertz band of the wireless spectrum. That is the same frequency as cell phones, and there aren\u2019t any off-the-shelf devices to sniff packets from them. Also, most of them scramble the signal by using spread spectrum, which sends out part of the message on one frequency, the next part on another, and so forth. However, other researchers have shown how to unscramble the spread spectrum code, so McNabb plans to build a device to sniff the 900 megahertz spread spectrum signals to show how it can be done and why it needs to be more secure.<\/p>\n

http:\/\/venturebeat.com\/2011\/08\/06\/hacking-water-meters-is-easier-than-it-should-be\/<\/a><\/p>\n

\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026<\/span><\/h3>\n

Four Ways to Hack the Smart Grid<\/span><\/h2>\n

by Preston Gralla\u00a0\u00a0\u00a0 September 01, 2009 – Full Article<\/a><\/span><\/em><\/strong><\/span><\/span><\/p>\n

\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026<\/span><\/h3>\n

Hacking the Smart Grid<\/span><\/h2>\n

One researcher shows how your house’s power could be shut down remotely, but the threat is only theoretical–for now.<\/span> www.technologyreview.com\/energy\/24977\/?mod=related<\/a><\/p>\n

\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026<\/h3>\n

How to Hack the Power Grid for Fun and Profit<\/span><\/h2>\n

by Kevin Bullis – Technology Review – October 07, 2010: –<\/span> http:\/\/www.technologyreview.com\/energy\/26472\/?mod=related<\/a><\/p>\n

\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026<\/h3>\n

Meters for the Smart Grid<\/span><\/h2>\n

Researchers say new energy infrastructure isn’t nearly secure enough.<\/span><\/p>\n

by Erica Naone\u00a0\u00a0\u00a0 September\/October 2009<\/span><\/p>\n

http:\/\/www.technologyreview.com\/computing\/23179\/?a=f<\/a><\/p>\n

\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026<\/h3>\n

Smart cities the world over ripe for hacking, expert\u00a0says<\/h2>\n
Posted on\u00a0April 22, 2015<\/a>\u00a0by \u00a0smartmeterharm.org<\/div>\n
\n

\u201cThe current attack surface for cities is huge and wide open to attack\u201d<\/strong><\/span><\/p>\n

\u201cThis is a real and immediate danger.\u201d
\n<\/strong><\/span><\/p>\n

\u201cIt\u2019s a matter of time until someone launches an attack over some city infrastructure or system.\u201d<\/strong><\/span><\/p>\n<\/div>\n

http:\/\/smartmeterharm.org\/2015\/04\/22\/smart-cities-the-world-over-ripe-for-hacking-expert-says\/<\/span><\/a><\/span><\/p>\n

 <\/p>\n

This isn\u2019t just about turning off electricity, etc. as catastrophic as that could be. Powerful wireless transmitters (Smart Meters)\u00a0are on every house and can be wirelessly reprogrammed. Wireless antennas and cell towers are throughout most towns and cities, with emission capabilities above what\u2019s normally used.<\/p>\n

If this type of system is hacked and the radiation level\u00a0turned up, the effects could be\u00a0lethal.\u00a0Smart city becomes dead city. How long before that happens? Do you live near a cell tower?<\/p>\n

From Canberra Times<\/b>, April 23, 2015<\/p>\n

So-called smart cities, with wireless sensors controlling everything from traffic lights to water management, may be vulnerable to cyberattacks, according to a computer security expert.<\/p>\n

Last year, Cesar Cerrudo, an Argentine security researcher and chief
\ntechnology officer at IOActive Labs, demonstrated how 200,000 traffic
\ncontrol sensors installed in major hubs like Washington, New York, Melbourne and Lyon were vulnerable to attack.
\n<http:\/\/blog.ioactive.com\/2014\/04\/hacking-us-and-uk-australia-france-etc.htm<\/a>
\nl> Mr. Cerrudo showed how information coming from these sensors could be intercepted from 1500 feet away \u2014 or even by drone \u2014 because one company had failed to encrypt its traffic.<\/p>\n

Just last Saturday, Mr. Cerrudo tested the same traffic sensors in San
\nFrancisco and found that, one year later, they were still not encrypted.<\/p>\n

Mr. Cerrudo\u00a0said he was increasingly uncovering similar problems in other products and systems incorporated into smart cities. He has discovered simple software bugs, poorly installed encryption or even no encryption at all in these systems. And he has found that many are wide open to a fairly common attack, known as a distributed denial of service, or DDoS, in which hackers overwhelm a network with requests until it collapses under the load.<\/p>\n

Mr. Cerrudo has found ways to make red or green traffic lights stay red or green, tweak electronic speed limit signs, or mess with ramp meters to send cars onto the freeway all at once.<\/p>\n

Security researchers say that the opportunities for a maliciously minded hacker or government abound. Last year, security researchers at the Black Hat Europe conference in Amsterdam demonstrated how to black out parts of cites simply by manipulating smart meters and exploiting encryption problems in power line communication technology.<\/p>\n

Increasingly, cities are automating systems and services. Saudi Arabia, for example, is investing $90 million to build four new smart cities. In South Africa, a $12.3 billion smart city project is already underway. By 2020, the market for smart cities is predicted to reach $US1 trillion, according to Frost & Sullivan, a consulting firm.<\/p>\n

\u201cThe current attack surface for cities is huge and wide open to attack,\u201d Mr. Cerrudo writes in a report he plans to present this week in San Francisco at the annual RSA Conference on security. \u201cThis is a real and immediate danger.\u201d<\/b><\/p>\n

The threat is not just hypothetical. Last year, security companies
\ndiscovered a hacking group, known both as Dragonfly and Energetic Bear, that was actively targeting power networks across the United States and Europe.<\/p>\n

Last year, the US Department of Homeland Security acknowledged in a report that \u201ca sophisticated threat actor\u201d had broken into the control system network at a public utility, simply by guessing a password on an internet-connected system.<\/p>\n

And in 2012, Chinese military hackers successfully breached the Canadian arm of Telvent. The company, now owned by Schneider Electric, produces software that allows oil and gas pipeline companies and power grid operators to gain access to valves, switches and security systems remotely. It also keeps detailed blueprints on more than half the oil and gas pipelines in North America.<\/p>\n

In 2013, the energy industry became the most-targeted sector for hackers in the United States, accounting for 56 per cent of the 257 attacks reported to the Department of Homeland Security that year.<\/b><\/p>\n

Some scientists are trying to redesign the smart grid to make it less
\nvulnerable. Currently, the smart grid is centralised, controlled by the energy suppliers, which makes utility companies a juicy target for hackers.<\/b><\/p>\n

But this year, Science Daily reported that Benjamin Sch\u00e4fer, a physicist from the Max Planck Institute for Dynamics and Self-Organization; his colleagues Marc Timme\u00a0and Dirk Witthaut; and a master\u2019s student, Moritz Matthiae, developed a model that showed, in theory, that smart meters could be monitored directly at customer sites, and decentralised in such a way that would make them much less vulnerable to attack.<\/p>\n

For now, their research only works in principle. So Mr. Cerrudo said
\nmunicipal leaders had to start thinking of their cities as vast attack
\nsurfaces that require security protection just as a corporate network might.<\/p>\n

He encourages municipalities to adopt basic security measures like
\nencryption, passwords and other authentication schemes and an easy mechanism for patching security holes.<\/p>\n

He suggests that cities create their own computer emergency response teams, or CERTs, to address security incidents, coordinate responses and share threat information with other cities.<\/p>\n

He also suggests that cities restrict access to their data; track and
\nmonitor those who do have access; and run so-called penetration tests, in which hackers try to break into cities so that municipalities can learn where they are most exposed.<\/p>\n

Finally, he suggests that cities prepare for the worst, as they would for a natural disaster.<\/b><\/p>\n

\u201cWhen we see that the data that feeds smart city systems is <\/b>blindly trusted<\/b> and can be <\/b>easily manipulated<\/b> \u2014 that the systems can be <\/b>easily hacked<\/b> and there are <\/b>security problems everywhere<\/b> \u2014 that is when smart cities become dumb cities<\/b>,\u201d Mr. Cerrudo said.<\/p>\n

Also, see:
\nhttp:\/\/motherboard.vice.com\/read\/all-the-ways-to-hack-a-smart-city<\/a>
\nThe New York Times
\nhttp:\/\/www.canberratimes.com.au\/it-pro\/security-it\/smart-cities-the-world-over-ripe-for-hacking-expert-says-20150422-1mr8m1.html<\/a><\/p>\n

\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026<\/h3>\n

Smart Meters – A 21st Century Technology, a 21st Century Threat:<\/strong><\/span><\/p>\n

\n

Invasion of the Privacy and Security Snatchers\u00a0<\/span><\/h2>\n

http:\/\/www.friendswoodrw.org\/documents\/SmartMetersReport.pdf<\/a><\/p>\n

\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026<\/h3>\n

 <\/p>\n

The U.S. government thinks China could take down the power grid<\/span><\/h2>\n

By Jamie Crawford, National Security Producer<\/b><\/p>\n

Updated 6:19 PM ET, Fri November 21, 2014<\/p>\n

China and “probably one or two other” countries have the capacity to shut down the nation’s power grid and other critical infrastructure through a cyber attack, the head of the National Security Agency told a Congressional panel Thursday.<\/p>\n

Admiral Michael Rogers, who also serves the dual role as head of U.S. Cyber Command, said the United States has detected malware from China and elsewhere on U.S. computers systems that affect the daily lives of every American.<\/p>\n

“It enables you to shut down very segmented, very tailored parts of our infrastructure that forestall the ability to provide that service to us as citizens,” Rogers said in testimony before the House Intelligence Committee.<\/p>\n

Rogers said such attacks are part of the “coming trends” he sees based on “reconnaissance” currently taking place that nation-states, or other actors may use to exploit vulnerabilities in U.S. cyber systems.<\/p>\n

A recent report by Mandiant, a cyber-security firm, found that hackers working on behalf of the Chinese government were able to penetrate American public utility systems that service everything from power generation, to the movement of water and fuel across the country.<\/p>\n

“We see them attempting to steal information on how our systems are configured, the very schematics of most of our control systems, down to engineering level of detail so they can look at where are the vulnerabilities, how are they constructed, how could I get in and defeat them,” Rogers said. “We’re seeing multiple nation-states invest in those kinds of capabilities.”<\/p>\n

Admiral Rogers declined to identify who the other countries, beside China, because of the classified nature of their identities. Russia is generally regarded as also having an aggressive cyber program.<\/p>\n

In addition to nation-state actors, Admiral Rogers noted the increasing presence of “surrogate” criminal actors in cyberspace that serve to obscure the hidden hand of criminal activity done on behalf of formal nation-states.<\/p>\n

“That’s a troubling development for us,” Rogers said.<\/p>\n

Rep. Mike Rogers, R-Michigan, the retiring chairman of the committee, called the groups “cyber hit men for hire” for nation-state actors in cyberspace.<\/p>\n

The testimony also comes in the wake of a report from the Pew Internet and American Life Project that cited a prediction by technology experts that a catastrophic cyber-attack that causes significant losses in life and financial damage would occur by 2025.<\/p>\n

Related: Catastrophic cyber attack looms<\/a><\/p>\n

Admiral Rogers told the committee he did not disagree with the assessment.<\/p>\n

In addition to the threats from specific nation-states, Admiral Rogers said there are already groups within the U.S. cyber architecture who seek to cause major damage to corporate and other critical sectors of the American economy.<\/p>\n

“It is only a matter of the when, not the if, that we are going to see something traumatic.” he said.<\/p>\n

http:\/\/www.cnn.com\/2014\/11\/20\/politics\/nsa-china-power-grid\/index.html?hpt=hp_c2<\/a><\/p>\n

 <\/p>\n

\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026<\/h3>\n

 <\/p>\n

72% of U.S. Financial Services and Energy Firms Say They Expect a Cyber Attack in the Next 12 Months<\/h2>\n

ThreatTrack Security report addresses two industries on the cyber war frontlines<\/em><\/p>\n

Clearwater, Fla. \u2013 May 7, 2014\u00a0\u2013 ThreatTrack Security today published a study that looks at the security vulnerabilities of two industries most often targeted by cybercrime; energy and financial services. 72% of respondents from these industries are confident that their organization will be the target of an Advanced Persistent Threat (APT), targeted malware attack or other sophisticated cybercrime or cyber-espionage tactic in the next 12 months, with 38% saying an attack is either a “certainty” or “highly likely.”<\/p>\n

Read the executive summary report here:\u00a0http:\/\/www.threattracksecurity.com\/resources\/energy-companies-financial-services-survey-report.aspx<\/a><\/p>\n

Both the energy and financial services sectors are under constant pressure from attackers due to the high-value assets they hold, which represents a significant risk to the U.S. economy and critical physical infrastructure. According to the\u00a0U.S. Department of Homeland Security<\/a>, the highest percentage (more than half) of incidents reported to its Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) occurred in the energy industry. Similarly, in January of this year, the Financial Industry Regulatory Authority (FINRA) released a\u00a0letter<\/a>warning of increasing frequency and sophistication of attacks against financial services firms.<\/p>\n

An independent blind survey of 200 IT security managers or IT security administrators in energy and financial services organizations (100 in each) was conducted by Opinion Matters on behalf of ThreatTrack Security in April 2014. There are a wide range of threat actors and attack vectors targeting these two industries, and ThreatTrack Security\u2019s report investigates the challenges these organizations face in defending themselves, and what they plan to do to increase security.<\/p>\n

Among the key findings of the survey:<\/p>\n