DHS: No evidence hackers infected Vermont power grid

[oberliner]

Source: Politico

Federal authorities see no signs that hackers breached Vermont's electric grid using suspected Russian malware that infected a power company's laptop, the Department of Homeland Security said tonight.

"While our analysis continues, we currently have no information that indicates that the power grid was penetrated in this cyber incident,” J. Todd Breasseale, DHS's assistant secretary for public affairs, told POLITICO in a statement.

Read more: http://www.politico.com/story/2016/12/vermont-power-grid-hackers-233091

[guillaumeb]

1. Those who see the Russians as being behind everything

are ignoring the fact that the GOP is doing what it can to establish a one party country.

[jalan48]

2. We need to check our Russian hysteria and focus on what the Republican's are going to try and do.

While we are freaking out about Russia the Republican controlled Congress will try and pass their long sought wish list of massive cuts to social programs.

[DonnaRx7]

6. This is the latest canard

to distract people.

Just watch, it will be used for all kinds of new spending justifications.

[Crash2Parties]

23. Exactly. I'm a bit disappointed that Obama focused so tightly on Russia

It gave the signal that whatever the GOP did was water under the bridge. Maybe he had no way to at least start investigations(?), but for the entire DNC to pretty much ignore the enormous body of tactics used to steal the election is unconscionable.

At best all he did was ensure that a seed of doubt was left in the history book. Problem is, he forgot that lesson about said books and victors...

[BainsBane]

3. the article says it was hacked

and Malware planted. The point DHS is making is that it doesn't seem to have compomised the grid.

People are taking your OP to meant it wasn't hacked at all, probably because of the excerpt you chose.

[oberliner]

7. No, it doesn't

And the "excerpt I chose" is the first two paragraphs of the article.

[BainsBane]

9. How do you suppose the malware got on the laptop?

And it looks like the reason it wasn't connected to the grid was because the utility found the malware early and isolated the computer.

[oberliner]

11. The power grid wasn't hacked

Burlington Electric Department Statement: No Indication that Electric Grid or Customer Information Compromised
Saturday, December 31, 2016

Cybersecurity is an issue that the Burlington Electric Department and all U.S. utilities take very seriously and on which we focus every day to protect the integrity of the electric grid and the personal information of our valued customers.

Federal officials have indicated that the specific type of Internet traffic, related to recent malicious cyber activity that was reported by us yesterday, also has been observed elsewhere in the country and is not unique to Burlington Electric. It’s unfortunate that an official or officials improperly shared inaccurate information with one media outlet, leading to multiple inaccurate reports around the country.

At Burlington Electric, where we take great pride in conveying timely and accurate information, we want our community to know that there is no indication that either our electric grid or customer information has been compromised. Media reports stating that Burlington Electric was hacked or that the electric grid was breached are false.

https://www.burlingtonelectric.com/news/3910/Burlington-Electric-Department-Statement%3A-No-Indication-that-Electric-Grid-or-Customer-Information-Compromised

[BainsBane]

13. The relavent questions are

What was the type of Malware, where did it come from, and was it an effort to compromise the electric grid?

[oberliner]

15. Agreed

But there was a frustrating rush by the Washington Post to assert something that was not proven to be true. This speaks to a larger issue with reporting in general in the internet age.

[BainsBane]

16. Yes. I see your point. Nt

[BainsBane]

17. Another poster in this thread

Linked to an article showing it was the same malware as found on DNC computers. I believe that entered the DNC through email phishing. I know that was the case with Podesta.

[oberliner]

18. I would imagine that malware is all over the place

Here's the DHS page on the subject:

https://www.dhs.gov/news/2016/12/30/executive-summary-grizzly-steppe-findings-homeland-security-assistant-secretary

[Crash2Parties]

24. True. What if the purpose of the malware was not to compromise the grid?

What if it was to compromise say, election machines by getting past the internet facing firewalls at the state or local level?

What if the only purpose was to leave a trail so that if all other efforts failed, Trump could claim the election was invalid b/c machines had been hacked?

Stating that effectively "nothing happened" because the electrical grid itself was not compromised is such a bright, shiny, object offered by a press trying to con its readers.

[sarah FAILIN]

4. according to other sources, the Russians have been in our utilities up to 2 years.

But, this is just James Clapper, the Director of National Intelligence. Maybe he doesn't know what he's talking about.

http://www.glitch.news/2015-09-22-russian-hackers-have-burrowed-into-critical-u-s-infrastructure-like-the-electric-power-grid-says-intelligence-director.html

[Lithos]

5. Too early

They do not know what was released and what attacks might be possible in any near term. If this malware released information about the internal corporate network, then they are still vulnerable to attack.

The game about pen testing (penetration testing) is to first gain information, then choose your targets, then attack. I would bet you money the malware on this laptop was designed to gain information so other attacks could take place.

Last takeaway - attacks are typically done in hops.

The Target attack in 2014 which released the credit card information for millions started out as an email hack in a vendor. Their systems were slowly compromised which allowed the attackers to target the billing system inside of Target. From their they expanded to the developer network which allowed them access to the POS systems in the stores. What's not mentioned are the many iterations which occurred in between.

[Lithos]

14. More information

http://www.cnn.com/2016/12/30/us/grizzly-steppe-malware-burlington-electric/index.html

As much as I hate CNN - this is better than average for them..

L-

[shraby]

8. That's probably because no one happened to plug the laptop into the system. If they

had, the malware would have taken off cause that's what it's designed to do.

[BainsBane]

10. Exactly. Nt

[oberliner]

12. Utilities maintain a secure technological separation between public and proprietary systems

That gap is in place at Burlington's electric utility, Lunderville said.

http://www.usatoday.com/story/tech/nation-now/2016/12/31/russia-us-electric-grid/96045118/

[Crash2Parties]

25. All it takes is one USB thumbdrive, a la Stuxnet.

Gaps have their failures if the entire system of operation isn't secure as well. People tend to work around them by throwing needed files on thumbdrives & hopping the gap. It's exceedingly bad practice and one that is far to prevalent.

And that is just one workaround.

[truthisfreedom]

19. They might as well say "be very afraid." There's no reassurance in "no evidence."

It just means, quite directly, that they can't find the virus.

[oberliner]

20. They found the virus

Read the third paragraph.

[Crash2Parties]

26. They found *a* virus.

[Vinca]

21. The bottom line is that our electrical grid would be easy pickings for a serious hacker.

It will happen at some point. The only questions are when and where.

[think]

22. K&R

[pansypoo53219]

27. trying doesn't count?

[oberliner]

28. It counts

And it's bad. But it's not what was initially (incorrectly) reported.