RE: [Full-Disclosure] The Grid, Blaster v. Poor Security Engineering

["Richard M. Smith" <rms@computerbytesman.com>]

Hi,

Given that the power companies are still looking into the chain of
events that caused the 2003 Blackout, I think it is premature to count
in or out any cause.  We might be looking at an equipment failure, human
error, an insider attack, weather problems, cyberattack, sabotage, etc.
Speculation is a lot of fun many times, but it should be based on the
facts.  

Here are few articles that covered a news conference held today on the
investigation so far on the causes behind the blackout:

http://www.msnbc.com/news/297115.asp?0si=-&cp1=1

http://www.internetnews.com/infra/article.php/3064401

http://www.cnn.com/2003/US/08/15/power.outage/index.html

Richard M. Smith
http://www.ComputerBytesMan.com

-----Original Message-----
From: full-disclosure-admin@lists.netsys.com
[mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Bernie, CTA
Sent: Friday, August 15, 2003 12:21 PM
To: full-disclosure@lists.netsys.com
Subject: [Full-Disclosure] The Grid, Blaster v. Poor Security
Engineering

It is ridiculous to accept that a lightning strike could knock 
out the grid. There are many redundant fault, limit and Voltage-
Surge Protection safeguards and related instrumentation and 
switchgear installed at the distribution centers and along the 
Power Grid that would have tripped to prevent or otherwise 
divert such a major outage. 

I believe that the outage was caused by the blaster, or its 
mutation, besieged upon the respective vulnerability in the 
systems (SCADA and otherwise) running MS 2000 or XP, located 
different points along the Grid. Some of these systems are 
accessible via the Internet, while others are accessible by POTS 
dialup, or private Frame relay and dedicated connectivity.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html