McAfee report exposes cyber extortion of U.S. power grid

By Chuck Frank / chuck@theklaxon.com / 01.29.2010

Updated on: 01.29.10 at 12:18 am

Manny Francisco, Manila, The Phillippines/caglecartoons.com

Operation Aurora in December 2009 silently was launched by Chinese hackers. Their goal: Retrieve the source codes from Google, Adobe, Juniper and 34 other high-profile companies.

The opportunity they exploited was a little-known programming hole called “zero-day” in the Internet Explorer software. To date, this has been the most sophisticated and wide-spread cyber attack on American business interests.

In the Cyber Wars, this was the parking garage bombing of the World Trade Center in 1993. We had better make this priority one, or the next time it may be “lights out” for the U.S. at an inopportune moment.

McAfee made public Thursday “In The Crossfire: Critical Infrastructure in the Age of Cyber War,” a report commissioned by the company to detect cyber threats. It discloses that foreign national states, especially China, are sponsoring cyber attacks that are focusing on the companies that make up the electric grid, oil and gas producers, telecom and transport networks, as well as water and sewage filtration plants.

The most victimized sector is oil and gas with power following in second position.  More than 54 percent of large-scale cyber attacks in the past year have targeted Critical Infrastructure Enterprises. The attacks focus on Computerized Operational Control Systems, which—once they have been compromised—allow hackers direct control of all operational systems.

Imagine how annoying it will be to find oneself in the middle of a coordinated missile defense scenario due to an attack by China and have the power go out. What is Plan B in that event? Run down to the silo and light a match to the fuse?

Here’s even better news: Due to the global recession, most information technology departments of Critical Infrastructure Enterprises are experiencing budget cuts. Due to the overall costs, executives don’t want to pay for additional cyber security.

The real culprit, though, is lack of awareness of the risk.

“Cyber is a three-legged stool,” said retired Gen. Michael Hayden, adding the three legs were “ease-of-use, security and privacy … To date, almost all of our creative energies have been put into ease-of-use and like any three-legged stool, if you don’t have all three legs, what you have is firewood.”

The McAfee report estimates the average cost of downtime for a 24-hour period due to a major cyber offensive against a Critical Infrastructure Enterprises to be approximately $6,300,000.

What Americans don’t know, however, is that many of these enterprises are paying extortion fees to hackers who compromise their systems, threaten operational shutdowns, and demand payment to desist.

Who says you have to come to the U.S. to live the American dream? Currently, India, Saudi Arabia/Middle East, China and France are the nations that are experiencing the most negative affect from Cyber Warfare. The U.K. and the U.S. are the two countries where attacks are most rare, even though the U.S. is a primary target.

The U.S. government needs to move this issue to the front burner and heed the warning of Operation Aurora. A major attack on our power grid alone will cause wide spread economic disruptions and loss of life, not to mention gigantic holes in national security.