Feds Question Ex-Worker about Power Plant Breach

VIP LOUNGE

CLOUD LOGIN

You are here: News > News > Feds Question Ex-Worker about Power Plant Breach

» IT Security NEWS

» 03 June 2009

Feds Question Ex-Worker about Power Plant Breach

The Federal Bureau of Investigation (FBI) is inspecting a large-scale hack attack at a Texas power corporation that froze the firm's energy forecast system for a whole 24 hours in March, which cost them over $26,000 worth of lost revenue.

On Thursday morning last week, the FBI stormed into the residence of an ex-employee of the Dallas-based Energy Future Holdings (the parent company of three enormous Texas electric companies that include Luminent, which is responsible for 16,300 megawatts of power generation in Texas and runs in Comanche Peak nuclear power plant).

Court records state that Dogul Chul Sin was fired from the organization on March 3 for performance reasons and was accompanied off of the premises. However, the company failed to shut of his VPN access immediately, which caused the aforementioned security breach in the first place.

According to a search warrant affidavit by Dallas FBI agent Robert Smith, Shin's VPN access was either used by Shin himself or somebody else to log onto the company network that very same afternoon, e-mailing out propriety information to a personal Yahoo account connected to Shin as well as modifying and deleting critical company files.

While logged into the VPN, the invader sent a message to an engineering group working the Comanche Peak nuclear reactor, with the e-mail stating questions about the safety of the reactor, specifically querying about what would occur if the load were to be amplified to 99.7% of capacity.

Smith noted that Shin was in charge of programming the models that managed the EFH power generation facilities, including those found in Comanche Peak. There have been no charges filed against Shin yet, but the FBI is dealing with the case as a suspected breaking of federal computer crime regulation, including the rarely used law forbidding breaking into a network and creating a hazard to public safety and health.

The affidavit notes that the damage done by the hack was mostly financial. Among the files that was tinkered with, " Hourly Capacity Supplied—2009 upload.xls" is documented as an input file that resolves the power generation needed by components of the RFH system.

The main digital harm caused by the tampering was mostly composed of a compromised EFH management system that was rendered incapable of precisely forecasting the parameters needed to work the business for exactly one day, on March 4, 2009.

Cyber security experts and related government agencies have cautioned time and again that hackers could breach and tamper into networked control systems that manage parts of the North American electric grid, although there have so far been no confirmed cases of sabotage of this particular nature.