Are nuclear facilities secure?

After 9-11 there was some discussion about safety at nuclear power plants; would a plane crashing into a cooling tower cause a meltdown or not. Opinion was mixed. Some expert evident says, "The risk that planes will crash into nuclear plants and release potentially lethal clouds of radioactivity is significantly higher than official estimates" while the Nuclear Energy Institute (the nuclear energy industry’s policy organization) disagrees, "Structures that house reactor fuel at U.S. nuclear power plants would protect against a release of radiation even if struck by a large commercial jetliner".

Whoever is correct, I suspect this statement from SecurityManagement.com hits the nail on the head, "The United States is woefully unprepared to protect its nuclear power plants from a terrorist attack, a former CIA officer divulged on CNN.com"

Consider this recent story,

Tennessee's Y-12 National Security Complex houses 300 to 400 metric tons of bomb-grade uranium. The Oak Ridge plant, enriched the uranium for the atomic bomb dropped on Hiroshima, Japan, during World War II and continues to be a mainstay of the U.S. nuclear defense program. The Department of Energy has repeatedly claimed that security at the site is robust enough to defend against more than a dozen heavily-armed terrorists with inside knowledge of security procedures.

And yet, last month,

Three peace activists — including an 82-year-old nun — infiltrated the highest-security area of the Y-12 nuclear weapons plant in a predawn protest Saturday, reportedly evading guards and cutting through three or four fences in order to spray-paint messages, hang banners and pour human blood at the site where warhead parts are manufactured and the nation’s stockpile of bomb-grade uranium is stored.

I have to agree with this conclusion from the HuffingtonPost,

When a nuclear weapons facility can't stop infiltration by an octogenarian nun, it's time to reassess its security standards.

The Top 25 Worst Passwords

"To err is human, to really foul things up requires a computer."
~Bill Vaughan, 1969

Web site Internet Crime Complaint Center's (IC3) and other sites have published a list of the worst passwords. A study was done on a list of millions of stolen passwords posted on-line by hackers and here are the top 25 passwords found in the list.

1. password
2. 123456
3. 12345678
4. qwerty
5. abc123
6. monkey
7. 1234567
8. letmein
9. trustno1
10. dragon
11. baseball
12. 111111
13. iloveyou
14. master
15. sunshine
16. ashley
17. bailey
18. passw0rd
19. shadow
20. 123123
21. 654321
22. superman
23. qazwsx
24. michael
25. football
Bottom Line

If you use any of these passwords, change it now. Here's some advice on creating a good password:
http://perpetualpreparedness.blogspot.com/2011/05/passwords.html

(Lack of) Computer Security

Treat your password like your toothbrush. Don't let anybody else use it, and get a new one every six months.
~Clifford Stoll

If you use Google news you can customize it to include specialized topics of interest. One of my news "extras" is Computer Security and recently it was full of depressing news about serious security violations

Medical Record Theft At Sutter Health
Information stolen on more than 4 million patients of a major Northern California health care provider. What's unusual about this incident is not some clever hacker but a thief who broke a window with a rock and stole a PC containing patient records.

"Over the last two years, health care organizations have reported 364 incidents involving the loss or theft of information ranging from names and addresses to Social Security numbers and medical diagnoses on nearly 18 million patients – equivalent to the population of Florida."

Water utility hackers destroy pump, expert says
Hackers may have destroyed a pump used by a US water utility after gaining unauthorized access to the industrial control system. Many industrial control systems rely on passwords that are hard-coded and it looks like Russian hackers stole the password from the company that made the equipment. The hackers (after much experimenting) managed to burn out a water pump by rapidly turning it on and off. One expert noted, “These things are connected to the Internet in ways they shouldn't be.”

This is "a really big deal".

Hackers attack Norway's oil, gas and defence businessesIndustrial secrets and information about contract negotiations had been stolen from at least 10 firms according to Norway's National Security Agency (NSM). Normally attacks like this would be kept secret but the NSM wants to world to know about these very skillful hackers.

"The attackers won access to corporate networks using customised emails with viruses attached which did not trigger anti-malware detection systems. ...  the email messages had been sent to specific named individuals in the target firms and had been carefully crafted to look like they had come from legitimate sources."

Facebook admitted that hackers are breaking into hundreds of thousands of Facebook accounts every day.
"Don’t use the same password and username combination for multiple websites. Use an online password manager to keep track of your different accounts."

Bottom Line

Hacking is not just nerdy teens having fun at your expense. There is money to be made selling identity information and there are government sponsored hackers (Russia, China) seeking weakness for cyber-warfare or corporate espionage.

Check out this article on the 25 worst passwords
http://www.telegraph.co.uk/technology/news/8898482/25-worst-web-passwords.html

Update
Recent news is claiming that the Utility pump was a false alarm. No proof that hackers destroyed it. Perhaps. But the risk is real and it is only a matter of time before real damage is done by hackers.

Passwords

"Some users will provide their password to a stranger who says he is from their company's IT department."
-Amir Lubashevsky

If you use computers than you'll be asked to supply a "secure" password. When I wrote about this two years ago, I recommended using the initial letters of a phrase like "tbontbtitq" for "To be or not to be, that is the question" as something not found in a dictionary yet easy to remember. Sometimes it is possible to be too clever. When physicist Richard Feynman worked on the Manhattan Project to create the first nuclear bomb, he found that many safes could be cracked at the super-secure site with combinations based upon PI = 3.14159 or e = 2.7182818.

This morning I read an article on baekdal.com that suggests we are looking at passwords the wrong way. Reliable security it argues, comes from password length, not password complexity. Yes complexity helps. A password like "jskerv" with only characters can be cracked in 1 month using brute force. But "J4fS<2" with mixed case, symbols and numbers would take 219 years to crack. The problem with complex passwords is remembering them. A password at the office is defeated if you post it on the wall of your cube.

Baekdal recommends a three word password like "this is fun". A pure brute-force attack for 11 characters would take over 1 million years. An attack combining common words would take over 2000 years, still very secure. If spaces are not allowed in your password, try "this-is-fun".

Since most password algorithms measure complexity, not length, you may find a password like this rated as "weak." And yes a single word from a dictionary with 11 characters would be weak. But not three words. Imagine how many three word sentences exist!

Some passwords require symbols, numbers, etc. I find this annoying and occasionally forget the new password for some bank that requires two numbers or some other pattern different from what I use. This results in keeping a list of passwords which in itself weakens security.

Bottom Line

Find a password that is easy to remember but long and either multi-words or letters taken from some phrase you remember. Can you guess this phrase?  "hb2yhb2y"

Stolen Checks

"I don't have a bank account, because I don't know my mother's maiden name". - Paula Poundstone 

My wife has discovered the joy of online payments and online banking but a story from the Consumerist make me nervous. Some banking sites scan your checks and allow you to view the images online. These images may be stored on a 3rd party server by an independent image storage company whose security rules are not quite as strict as your bank's.

Russian crooks have broken into three sites that store archival check images, stolen the account information, and written over $9 million in phony checks against over 1,200 accounts. The security company that discovered this attack has notified the affected sites but it is not making their names public.

To avoid getting caught, the Russian crooks used "money mules".  Here's the story of an unwitting money mule:

A man found her "work wanted" ad online and contracted her to become a virtual assistant. He said that he was associated with the reputable international fashion marketing firm Mandi Lennard. The jobs started simple: buy this exact kind of ink and paper and perform various tasks. Soon he had her sending money for him to help one of the "photographers" purchase some alcohol. When she asked why he needed her to send the funds, he said "because i am very busy and you are my assistant."

Then she was instructed to print out a check for $1,300, deposit it in her account, and write a check off her account and mail it to her handler.

But when she did, the bank said it would be held for seven days while they investigated it for fraud. She soon received a call from a woman in Atlanta. It was her account the $1,300 check was drawn from, and the caller she was pissed and ready to press felony charges against her!

Bottom Line

Never, never agree to cash a check to your account and then offer some or all of the funds from your account (by check, cash, or wire service) to the person supplying the check. This is a very common scan and you're the one breaking the law by cashing a check that will bounce or one that is using stolen account information.

Who's reading your email?

“Relying on the government to protect your privacy is like asking a peeping tom to install your window blinds.”
- John Perry Barlow

When you use the Internet, you can NEVER assume any privacy. Consider email for example. Your text is moving in the clear between many servers and can be easily intercepted. It is stored on a server at the email company where police and others can request to see it with a court warrant. Any employee at the email company with access to the server could read the email (though it may violate company/corporate privacy regulations.) Don't think this could happen? There are many examples of Civil employees caught reading the DMV records or tax records of celebrities, friends and enemies.

Another technology that puts privacy at risk is Chat. It's not uncommon for employees within a company to chat with other. But if the chat is run by an outside company, then confidential conversations can compromised. At my last job, the IT department came to fear this and required that everyone only use a new Chat service that was run within the company.

One problem today is that we have little clue who owns or operates services on the Internet. Your favorite site or service could be running in China with a history of disregard for privacy. Recently one of the pioneering chat companies, ICQ, was sold to a Russian company where the Russian "secret service" is entitled by law to any information it wants.

Bottom Line

Anything you put on the Internet may be leaked or become public. Don't assume privacy. I'm often annoyed by sites where I register and then they email back a welcome letter with my password printed out in clear text.

I read yesterday of a case in Europe where a brother privately boasted of a murder on Facebook to his sister. She turned the message over to the police.

Terror over Detroit

“No man dies for what he knows to be true. Men die for what they want to be true, for what some terror in their hearts tells them is not true.” - Oscar Wilde

On December 25, a terrorist tried to blow up an airplane as it was landing at Detroit, Michigan. I encourage you to read the first hand account, Over Detroit Skies, by passenger Roey Rosenblith. He's very honest about the experience and his reaction to what happened. For instance he talks about the urge to flee but having nowhere to go when aboard a plane.

Another important thing to learn from this story is that the "incident" is just the beginning of a long process of response and recovery. Passengers were not allowed to leave the plane or even to leave their seats after landing. When they finally deplaned, they were escorted to private briefings with 250 police/custom agents/security personnel. Cell phone calls were not allowed to waiting family members. The processing took hours and connecting flights were missed. At least they got vouchers for a meal and a hotel room.

Bottom Line

In any disaster, the hurricane, tornado, fire, etc is just the beginning. There are survival needs and emotional shock immediately afterwards. This is followed by a long and slow recovery with lots of paperwork, bureaucracy, and delays. It is frequently weeks or months for life to return to normal.

Espionage & Passwords

“Every one is a moon, and has a dark side which he never shows to anybody” - Mark Twain

Here is an unsettling story published in the Wall Street Journal, Electricity Grid in U.S. Penetrated By Spies.

Cyberspies have penetrated the U.S. electrical grid and left behind software programs that could be used to disrupt the system, according to current and
former national-security officials. The spies came from China, Russia and other countries, these officials said, and were believed to be on a mission to navigate the U.S. electrical system and its controls. The intruders haven't sought to damage the power grid or other key infrastructure, but officials warned they could try during a crisis or war.

As a computer programmer I understand that hackers would try to break into our infrastructure systems. But what concerns me is that they succeeded and could leave behind sleeping programs waiting for activation. “Many of the intrusions were detected not by the companies in charge of the infrastructure but by U.S. intelligence agencies, officials said.”

The WSJ reports, “Intelligence officials worry about cyber attackers taking control of electrical facilities, a nuclear power plant or financial networks via the Internet.” I cannot for the life of me understand why a nuclear power plant should be accessible via the Internet. Perhaps workers want to push buttons from far away in case the plant starts to meltdown? I’ve worked at several companies with restricted Internet access. At one, there was no access, period. At two others they used VPN (Virtual Private Networks) to restrict access. VPN uses a token that displays a new “random” number every minute. To login I need my password and the current number on the token registered to me.

Sadly in many secure systems the weakest link is the human element. At one of my internships, the top executives (with the most data access) hated to memorize long passwords and asked for an exception so they could use two letter passwords. One hacker trick I’ve read about includes getting inside a company and then sitting down at computers where workers have left for lunch but left the PC logged on and connected to the company network. (Screen savers with passwords help protect against this). Another clever hacker passed out a survey to workers asking for names of pets, children, spouse, etc. He then checked to see if any worker had used a family name as their password; very common unfortunately. (A solution to this is requiring numbers and or special symbols in the password.)

Now it would be nice to think espionage would never happened but the WSJ describes two recent cases outside the US:

• In 2000, a disgruntled employee rigged a computerized control system at a water-treatment plant in Australia, releasing more than 200,000 gallons of sewage into parks and rivers.
• Last year the CIA told utility company representatives that a cyberattack had taken out power equipment in multiple regions outside the U.S. The outage was followed with extortion demands.

Bottom LineTwo points I’d like to emphasize here.
1. Water or electricity could fail at a moments notice with a hostile attack. Do you have backup water and a power generator or means to cook/light without electricity? ABC News did a follow-up story called What if Russia or China Cut Off Your Electricity? It goes through a typical day showing how pervasive electricity is...

• Your alarm clock
• Your laptop (when the batter dies) & wireless router
• Your landline phone perhaps work but not VOIP
• Your hot water heater (if not gas)
• Your gas oven (most have an electric starter instead of a pilot light)
• Traffic lights
• Gas station pumps
• Frozen/refrigerated food at the grocery store
• Cash Registers, Credit Cards

2. Always use a strong password. Studies have shown that longer is better. Password hackers are well aware of L33T, the trick of substituting letters with symbols like 9ary or G@ry for Gary. So don’t think you are safe with a short but clever password. One easy password method is to use the letters from a favorite hymn, bible verse, poem, etc. For example “tbontbtitq” for “To be or not to be, that is the question” (but please choose something less obvious). You can strengthen this by creating a personal pattern where you always capitalize the same letters (say 2nd and 3rd) “tBOntbtitq”