UPDATED – WRAL and Other News Agencies Effectively Building a “How To” List for Utility Terrorism

It’s not news that two Duke Energy power substations were attacked in Moore county last week.  There is a ton of speculation about why the attacks were carried out and by whom, but the thing we aren’t short of information about is what they did and what law enforcement is doing about it.Photo Credit to News9, Oklahoma City, OK.

Various articles over the last week have been published by local news stations and other news media regarding the attacks, pointing out exactly HOW the attacks were performed, what damage was caused, and the impact upon the power grid by doing so.  All of this information is published under the First Amendment, presumably for the public good.   We think it’s more likely for clicks and advertising viewership, but mmmkay.   One thing is for certain, copy cats and wannabe terrorists are absolutely paying attention, and the media is essentially building for them a “how to” list for carrying out attacks on utility substations and the power grid.   We predict there will be more of this type of activity, with few options for the utilities to actually mitigate this without significant capital expenditures.

The latest “how to” entry is that the FBI is using cell phone data to try to correlate cell phone account holders in the vicinity prior to and during the time of the attacks (we know exactly WHEN the attacks happened because the power went out).  The reality is that there are probably more than a few people that are going to be on that last and will be interviewed by law enforcement about their whereabouts and activities.  Maybe the culprits forgot to turn their phones off or leave them at home will be interviewed and caught.  But rest assured about one thing, the NEXT attack done won’t have anybody carrying an active cell phone…

(Note, we don’t represent Duke Energy in this matter and are not involved in this event in a consulting or investigative capacity) 

We wrote a letter to WRAL requesting the redact portions of their news report (https://www.wral.com/gunfire-caused-damage-that-led-to-moore-county-blackout-schools-closed-monday/20612201/) which provides detailed information about the attack and even quotes former FERC head John Wellinghoff on the effective damage that was caused:

The former head of the Federal Energy Regulatory Commission Jon Wellinghoff explained the severity of the damage to WRAL News.

“Somebody with a high-powered rifle puts a bullet through the case of a transformer and once it goes into the case of the transformer it hits the coils of the transformer, shorts it out, and it’s gone; That that device is no longer operable,” said Wellinghoff. “It can’t be fixed, it needs to be replaced. It cannot be repaired.”

Wellinghoff also shared insight into the repair process.

“A lot of these transformers also are sort of one-offs. It’s not like you can cookie-cutter replace them with another one from some other utility in the next county or the next state,” said Wellinghoff. “They have to be made sort of custom for the particular substation that they’re in. So if they don’t have spares for that particular substation, it could take a considerable amount of time.”

In effect, reading the totality of information presented by WRAL alone helps copy cat criminals build a “how to” list for carrying out similar types of attacks with little risk of getting caught.  This is irresponsible journalism, and they should know better.  For that matter, Wellinghoff should ABSOLUTELY know better.  It’s unfortunately not just WRAL acting alone, but apparently standard journalist practices today to divulge information that could lead to a rash of domestic terrorism that could impact significant portions of the country, and have long lasting effects.

We support and recognize the need for the First Amendment, it’s a critical component that makes America the best country in the world to live and thrive in.  However, the press should honor and respect the need for operational security and the risk for “copy cat” crimes, or even escalation of crimes by their irresponsible reporting.  We’ve seen this effect in school shootings, serial killings, etc, where individuals see news reports and articles and are incepted and maybe even encouraged to perform similar crimes under the guise that such crime will bring them notoriety and fame (or at least infamy).     Yet the media is never held responsible; maybe they should be.   This is the reason you no longer see nude runners streaking on the field during NFL game broadcasts, the cameras are told not to video the streakers so they won’t get their “15 minutes of fame”, just jail time.   That’s called being responsible for what you broadcast.

As a security professional, if you see articles or news broadcasts that represent a danger to society, call or write to that news agency and give them your feedback about irresponsible journalism.  We don’t want censorship, we just want responsible reporting.

UPDATE 12/27/22 – Almost like clockwork, the prediction has come true, with several new attacks on substations in Tacoma, WA.  https://www.nytimes.com/2022/12/27/us/power-substation-attack-washington-state.html

 

Posted in: CPTED, Security Consulting

Leave a Comment (0) →

NEC and Conduit Fills for Communications and Security Cabling

A question that comes up frequently for us when working on security projects with high density device counts is conduit fill.   That National Electrical Code typically wants to limit conduit fill to less than 40% of the capacity for cables in the raceway.  This is based upon the dimensions of the conductors and the potential for “jamming” or stressing the cable and potential thermal issues that could lead to electrical fires.  This is referenced to apply to power cabling for AC power conductors.

We all know (or should know) that metallic low voltage communications cabling (e.g. CAT6 network, dry contact devices, card readers, etc) can’t be run in the same conduit as AC power cabling, so what is the limitation for conduit fill for low voltage security cabling?

Whenever you are in doubt, you should always consult with the AHJ, but in reality the NEC basically doesn’t care and it will likely never be inspected.  The manufacturers of these cables may have some recommendations on maximum fill ratings to reduce the pulling tension to minimize stretching or damaging the cable, however.  There are other factors in play of course: cable type, conduit type, distance, number of bends, and pulling lubricant used.

In short, be conservative with conduit fill for long runs of delicate small gauge multi-conductor cables like 22AWG TSP or CAT6A that could be damaged.   But for vertical cores between floors that are typically very short runs, you can probably fill to 80% without any significant risk, as long as the cable is properly supported and there is sufficient room remaining to properly apply intumescent firestop sealant.

Posted in: Access Control, Security Consulting

Leave a Comment (0) →

Playing Around with the PinPoint Survey Application using Amazon Data

We put together a quick demo of the PinPoint Survey Application using some public data scraped from the web for all the US Amazon sites.  The equipment names and photos are all generated, so don’t get too excited about thinking there are real Amazon security equipment details being posted on the web.

Some of the reporting features are turned off, but the overall objective was to show off the speed and utility of the site data and geospatial mapping capabilities for relating sites and equipment within those sites.

Using the application from a tablet, you can use the built-in GPS to map the device lat/lon data to the database, along with any photos, notes, and punch list information that might be relevant.  This is particularly useful for large external sites like ports, refineries, mines/quarries, or power generation/transmission facilities.

GIF Movie of PinPoint Survey Application using demonstration data for Amazon sites

PinPoint Survey Application Short Demo

Posted in: Access Control, Application Development, CPTED, Premises Liability, PSIM, Security Consulting, Security Technology, Vulnerability Analysis

Leave a Comment (0) →

NSA Releases Guidance on How to Protect Against Software Memory Safety Issues

C++ Code example of memory overrun.

When the NSA makes a post about software best practices to reduce hacking attempts, you know there’s a problem.  For the non-programmers, a memory safe programming language is one that has built-in features to reduce or eliminate the possibility of a poorly crafted program to be exploited (usually by malicious input) by causing a memory buffer overrun or similar failure that can corrupt data, run a malicious payload, or escalate privileges.  These problems have been around for years, and there are several programming languages that are common offenders (C and C++), but are ubiquitous and have long codebase history that makes it unattractive to rewrite.

Fortunately there are quite a few memory safe programming languages to choose from, such as C#, Go, Java, Ruby, Rust, and Swift.  Of course it’s not enough to just change programming languages, good security coding practices, hardening tools, safe compiler options, and thorough testing should also be used as well.

For the NSA full article, click here:  https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3215760/nsa-releases-guidance-on-how-to-protect-against-software-memory-safety-issues/

Posted in: Company News

Leave a Comment (0) →

HID Signo Reader Shortage

As most people in the security industry know by now, Motorola HID has been having supply chain issues for months now for readers.  As a temporary solution, they are offering a new product line, “Signo Priority” readers, which lack the 125Khz Proximity function.

Signo Priority Features
 
– Same lifetime warranty as the traditional Signo readers
– Current lead time is 7 days (Sept 2022)
– Configured by profiles: Standard, Smart, Seos and Custom
– IP65 certified
– Automatic self-calibration when nearby metal surfaces are detected
– Factory equipped with Bluetooth (BLE Smarts) and NFC
 
Differences from traditional Signo Readers
 
– Lead time > 180 days (Sept 2022)
– Signo Priority will not read 125 Khz Proximity
 
If 125Khz reading is not needed, only 13.56 Mhz,  please consider the Signo Priority Reader X0NKS-T0-000000 as a substitute for the Signo Traditional X0NKS-00-000000 readers.

 

 

Posted in: Company News

Leave a Comment (0) →

Leaked Database of over 1 billion Chinese Civilians for Sale

The Shanghai National Police (SHGA) database of over 1 billion Chinese citizens is apparently up for sale for 10 Bitcoin (~USD $200,000 ).   This represents terabytes of personal data including full name, address, birthplace, age, birth year, nationality, photo information, national ID number, mobile number, and any committed crimes and case details for the individuals.   (Source link has been obscured, sorry.)

Included in the for sale ad were samples of the data to verify authenticity.  The alleged leak was apparently from a contract software developer that had errantly posted the database login credentials to a project blog some months earlier. 

The leak has been verified by several people and posted online, but Western media has not really picked up on the impact of such an event.  If legitimate, it represents the largest data leak ever reported.


Oddly enough, there doesn’t seem to be anything called the “Shanghai National Police”, only the “Shanghai Municipal Police” returns any search results as a legitimate entity in major search engines.  Still, regardless if this is a translation error or some other mis-identification, the validity of the data appears to be proven.  We attempted to connect to the sample link provided through a VM and VPN and were able to download the 110mb compressed gzip sample file and view the sample files.  When uncompressed, the files were several hundred megabytes each in JSON format in English language and Chinese characters (multi-byte format), consisting of personal information, police record case data files, and an address merge with cell phone data.   Here’s an example of the personal detail record file:

 

The police case record data appears to be of the most concern,  with the actual data content consisting of detailed police reports of the charged offense, including the date/time and specific location of the criminal events.  Deciphering the information is difficult for most westerners since most of the text is in traditional Chinese, but it would be trivial to use automated translating to get the gist of the content when inserting into a database.

With the horse already having left the barn, there doesn’t appear much that the Chinese government can do to mitigate this leak.  Addresses and phone numbers can of course be changed by the individuals, but having these records open to the public (particularly the police reports) is a massive blow to individual privacy (such that it is in PRC), and will likely cause problems for millions of people for years.

 

 

 

 

Posted in: Company News

Leave a Comment (0) →

SP-FA/LV Exam Prep Class (Zoom) on May 11, 2022, 8:00 AM – 5:00 PM

“Preparing for the North Carolina SP-FA/LV Electrical Examination”

NCBEEC Approved CE Course #CEC.03912
Course Instructor: Kile Unterzuber
NC License #10173-SP-FA/LV

Don’t miss this opportunity to prepare yourself for this critical exam!  The virtual class format save you time and money.  Register now at https://nationaltrainingcenter.com/event/nc-sp-fa-lv/.  For more information download our SP-FA/LV Exam class description and FAQ PDF files!

Course Description: This course reviews subject areas of the National Electrical Code (NFPA 70-2020) applicable to the North Carolina SP-FA/LV (Special Fire Alarm/Low-Voltage) license classification examination, as well as the administrative requirements of the NCBEEC and the use of the National Fire Alarm and Signaling Code (NFPA 72-2013). The course emphasizes Code requirements that may not be familiar to the typical installer of low-voltage and power-limited circuits for security and fire alarm systems, but that are important for successfully taking the qualifying examination. These topic areas include:
• Review of basic requirements of Title 21 NCAC 18B;
• General requirements for all electrical work;
• Grounding and bonding for power-limited and associated branch circuits;
• Calculating conductor ampacity;
• Calculating box fill;
• Identifying conductors for specific applications;
• Identifying and providing overcurrent protection for power-limited circuits; and
• Calculating resistance in simple circuits; and
• Requirements of National Fire Alarm and Signaling Code (NFPA 72-2013)

 

Posted in: Company News

Leave a Comment (0) →

Another installment of (in)secure Cloud storage

Chinchero Airport, Peru | EJAtlas

We know we sound like a broken record when we tell our clients “If you don’t own your server, you don’t own your data. Don’t put anything in the cloud you don’t want potentially exposed to the public.”, but time after time we show examples of why we keep repeating this mantra.

What Happened:

A major data leak by Securitas that affected several Latin American airports and other related companies was discovered by a cybersecurity firm called SafetyDetectives. In late January a team discovered that an Amazon S3 bucket had been left unsecured and exposed to public access, and contained over 1 million files relating to airport and security personnel.

Securitas, a large, well known multinational security company that has been in business for almost a century, has not made any public statements around the incident as of this posting. This isn’t the first time Securitas has had cybersecurity issues. In 2017 the Securitas CEO Alf Göransson had his personal identification stolen at the end of March, when someone applied for a loan in his name. The Stockholm District Court then declared Göransson bankrupt without informing the CEO prior to its decision.

The Breach (From SafetyDetectives briefing):

Securitas left its Amazon S3 bucket open and accessible, without any authentication procedures in place. The misconfigured bucket has therefore exposed almost 1.5 million files, equating to about 3TB of data.

The bucket’s exposed information included employee Personally Identifying Information and sensitive company data of at least four airports in Colombia and Peru: El Dorado International Airport (Bogota D.C, COL), Alfonso Bonilla Aragón International Airport (Valle del Cauca, COL), José María Córdova International Airport (Antioquia, COL), and Aeropuerto Internacional Jorge Chávez (Lima, PE). As mentioned, unobserved files may have exposed other airports and places throughout Colombia, the rest of Latin America, or even the rest of the world.

They observed two main datasets containing the information of Securitas employees and airport employees: photos of ID cards and other unmarked photos.

Photos of ID cards featured on the bucket. There were an estimated 1 million files of this type on the Securitas misconfigured bucket. These files revealed the personal information of employees at the four aforementioned airports that are using Securitas’ services.

Photos of ID cards reveal several forms of employee Personally Identifying Information, including:

  • Full names, incl. first names and surnames
  • Photos of employees
  • Occupations
  • National ID Number

What Was Leaked?

Other unmarked photos featured among the bucket’s content too. There were about 300,000 files of this type. These photos leaked the data of airports, airport employees, and associated companies.

Specifically, these files exposed employees’ personal data, sensitive client data (airports), and the sensitive data of associated companies, such as airlines. Exposed data includes:

  • Photos of employees
  • Photos of planes
  • Photos of fueling lines
  • Photos of luggage being loaded/unloaded

What Was Leaked?

 In addition to the information mentioned above, the two primary datasets analyzed on the bucket (photos of ID cards and other unmarked photos) contained Exchangeable Image File Format (EXIF) data that exposed specific information related to each photo.   Exposed EXIF data includes:

  • Device models (of the cameras used)
  • GPS locations of photos, incl. coordinates and GPS maps
  • Time & date of photos

What Was Leaked?

What it Means to Us

It may be some time before there is any assessment of the extent of damage the data breach, but this obviously serves as an example of how careless data management can cause serious security implications for your firm or those of your clients.   In evaluating software application strategies for our clients, we always ask these simple questions:

  1. What is the criticality if this information if it is leaked to the public?
  2. Can the solution be self-hosted on the Client’s own private network?
  3. Does it really NEED to be a cloud application?
  4. If so, how can we mitigate the potential damage if there is a breach?

Additional measures like a Type I or Type II SOC report are helpful, but likely wouldn’t have prevented the Securitas data breach discussed above.  Regular and ongoing security audits, along with well defined and enforced data management and security policies and procedures are the only real defense against these kinds of mishaps.

This won’t be the last time we see this either, as the Cloud becomes more and more integrated into corporate IT strategies, it will happen again, and again, and again.

 

 

 

Posted in: Security Consulting, Security Technology

Leave a Comment (0) →

More Cloud Woes for Security

Once again a cloud solution has been hacked, this time Verkada, a fairly new entry into the security arena.  Verkada offers a turnkey solution using proprietary hardware and hosted video management solutions for a monthly fee.  They aren’t unique to the industry, but they are the most recent to be hacked and be spotlighted in the news.

The key takeaway from the Bloomberg article is something we’ve been telling our clients for a while:  Cloud and SaaS solutions typically have a “super-admin” or overall management account access that lets the provider “see” all of their customer’s account and account information.  This varies of course depending upon the service provider and the service type, but in general if you don’t own the server, someone else does and has to manage and support the data coming into it and on it.

Madison County Jail seen through a Verkada camera.

“A group of hackers say they breached a massive trove of security-camera data collected by Silicon Valley startup Verkada Inc., gaining access to live feeds of 150,000 surveillance cameras inside hospitals, companies, police departments, prisons and schools.”

We strongly urge to our clients that sensitive data and physical controls should be hosted on premise, and don’t belong in the cloud.   This could be devastating for Verkada and other cloud based solutions that are dedicated 100% to SAAS (software as a service) solutions.   You can read the full article from Bloomberg here:

https://www.bloomberg.com/news/articles/2021-03-09/hackers-expose-tesla-jails-in-breach-of-150-000-security-cams?srnd=premium

 

Posted in: Company News

Leave a Comment (0) →

SolarWinds Hacked – Or “Another Example of Why Putting Security in the Cloud Might Not Be Safe”

The supply chain giant SolarWinds, used by every major branch of the government, all military branches, and almost all of the Fortune 500 companies, has been hacked by a Russian hacking group that gained access to sensitive emails, APIs, and SSO tokens and user accounts since as far back as March of 2020.   See a summary from Krebs here: https://krebsonsecurity.com/2020/12/u-s-treasury-commerce-depts-hacked-through-solarwinds-compromise/

This is a classic example of why outsourcing  your security and sensitive operations isn’t always a good idea. 

One of the most frequent discussions we have with our clients is why we are generally opposed to putting security operations “in the cloud”.  After all, it’s offered by just about every IT supplier, and the security software vendors are all jumping on board as well.  Sure they are, because it’s a great recurring revenue source for them, as opposed to buying a traditional perpetual software license that you install on your premises computer(s).

To be sure, there are obviously Cloud deployments that can be done safely and securely; then again, that’s probably what SolarWinds thought too.  Security, and especially Cyber Security, is a never ending game of cat-and-mouse, with the mousetrap always getting better and the mouse always getting smarter.  

We will see this again, whether it’s another twitter hack where celebrities posting for bitcoin submissions (https://www.pandasecurity.com/en/mediacenter/mobile-news/twitter-celebrities-hacked) or maybe a service provider like Workday or Okta getting hacked and exposing sensitive client data to be sold on the darkweb or nation states for further exploitation. 

For certain clients or situations, using cloud based security application makes sense, but in general we advise against using the cloud for access control and video surveillance for sensitive locations or enterprise applications.

Caveat Emptor.

Posted in: Company News

Leave a Comment (0) →
Page 1 of 5 12345