# FBI announces ongoing Russian attacks against American electric grid, water processing, air

**URL:** <https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635>\
**Category:** Great Debates\
**Created:** [March 16, 2018, 2:01am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635 "2018-03-16T02:01:37Z")\
**Posts on this page:** 20\
**Page:** 2

<div class="post-metadata">

**Author:** ![Aspenglow](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/aspenglow/32/76_2.png) [@Aspenglow](https://boards.straightdope.com/u/Aspenglow)\
**Post date:** [March 16, 2018, 4:34am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/21 "2018-03-16T04:34:21Z")

</div>

From the same report:

> [@](#):
>
> Overview
> 
> This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). _This alert provides information on Russian government actions targeting U.S. Government entities as well as organizations in the energy, **nuclear** , commercial facilities, water, aviation, and critical manufacturing sectors._ It also contains indicators of compromise (IOCs) and technical details on the tactics, techniques, and procedures (TTPs) used by Russian government cyber actors on compromised victim networks. DHS and FBI produced this alert to educate network defenders to enhance their ability to identify and reduce exposure to malicious activity.
> 
> DHS and FBI characterize this activity as a multi-stage intrusion campaign by Russian government cyber actors who targeted small commercial facilities’ networks where they staged malware, conducted spear phishing, _and **gained remote access** into energy sector networks_. After obtaining access, the Russian government cyber actors conducted network reconnaissance, moved laterally, and collected information pertaining to Industrial Control Systems (ICS).

(Emphasis mine.)

What do you think “gained remote access into energy sector networks” means?

Remember, the accusation came from the Trump administration. Not exactly an eager participant in accusing Russia of anything. Do you think they’re wrong about this?

---

<div class="post-metadata">

**Author:** ![HurricaneDitka](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@HurricaneDitka](https://boards.straightdope.com/u/HurricaneDitka)\
**Post date:** [March 16, 2018, 4:36am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/22 "2018-03-16T04:36:24Z")

</div>

Here’s a paragraph from [CNN](https://www.cnn.com/2018/03/15/politics/dhs-fbi-russia-power-grid/index.html):

> [@](#):
>
> Although Russia is “on the right path” they “still have awhile to go,” said Robert Lee, the CEO of Dragos, a cybersecurity firm that specializes in protecting the nation’s power grid and critical infrastructure. “They are absolutely going after the systems they would need to for causing disruption, but it doesn’t put them close to that object.”

That sounds like about the right characterization to me, given what was released in the alert.

---

<div class="post-metadata">

**Author:** ![HurricaneDitka](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@HurricaneDitka](https://boards.straightdope.com/u/HurricaneDitka)\
**Post date:** [March 16, 2018, 4:41am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/23 "2018-03-16T04:41:24Z")

</div>

> [@Aspenglow](#):
>
> … What do you think “gained remote access into energy sector networks” means? …

I think it means they hacked some power company’s email, and stole some PDFs and Excel spreadsheets. Not good, but a long ways short of being able to “shut power plants off at will”.

> [@Aspenglow](#):
>
> … Do you think they’re wrong about this?

I think _the media_ is wrong about their characterizations of what happened. I think they (the media) are exaggerating the severity of it to a significant degree. “scare-mongering” is the word I’d use, but I recognize that many of you are going to resist the idea that you got duped and that your favorite news source might be pedaling fear.

---

<div class="post-metadata">

**Author:** ![Aspenglow](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/aspenglow/32/76_2.png) [@Aspenglow](https://boards.straightdope.com/u/Aspenglow)\
**Post date:** [March 16, 2018, 4:55am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/24 "2018-03-16T04:55:59Z")

</div>

> [@HurricaneDitka](#):
>
> I think it means they hacked some power company’s email, and stole some PDFs and Excel spreadsheets. Not good, but a long ways short of being able to “shut power plants off at will”.
> 
> I think _the media_ is wrong about their characterizations of what happened. I think they (the media) are exaggerating the severity of it to a significant degree. “scare-mongering” is the word I’d use, but I recognize that many of you are going to resist the idea that you got duped and that your favorite news source might be pedaling fear.

Well, Homeland Security and the FBI took the trouble to issue a public statement this time rather than a private one as they have in the past, so I suppose we’ve all been duped by them and they are “scare-mongering,” too. Rick Perry is so “scare-mongered” that he’s formed a new Office of Cyber Security and Emergency Response, according to the CNN article you cited. And since numerous news organizations have reported on this and indicated an elevated basis for concern that plants can now potentially be shut down, I thought maybe MSNBC had got it right just this once. But evidently one guy on CNN that “sounds like about the right characterization” knows better. Thanks for setting us all straight.

---

<div class="post-metadata">

**Author:** ![HurricaneDitka](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@HurricaneDitka](https://boards.straightdope.com/u/HurricaneDitka)\
**Post date:** [March 16, 2018, 4:57am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/25 "2018-03-16T04:57:49Z")

</div>

> [@Aspenglow](#):
>
> Well, Homeland Security and the FBI took the trouble to issue a public statement this time rather than a private one as they have in the past, so I suppose we’ve all been duped by them and they are “scare-mongering,” too.

No, no they are not. THEY didn’t say that the Russians could “shut power plants off at will”. That was a fiction invented by Rachel Maddow and the NYT, AFAICT.

---

<div class="post-metadata">

**Author:** ![BeenJammin](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beenjammin/32/448_2.png) [@BeenJammin](https://boards.straightdope.com/u/BeenJammin)\
**Post date:** [March 16, 2018, 4:58am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/26 "2018-03-16T04:58:54Z")

</div>

Sorry, I did not even read the thread. Just need to confirm context before I either move on or start trolling…

---

<div class="post-metadata">

**Author:** ![HurricaneDitka](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@HurricaneDitka](https://boards.straightdope.com/u/HurricaneDitka)\
**Post date:** [March 16, 2018, 5:03am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/27 "2018-03-16T05:03:21Z")

</div>

> [@BeenJammin](#):
>
> So We’re Debating FBI Announcements Now?..

No, we’re not “debating FBI announcements now”, we’re debating the media’s gross mischaracterization of FBI announcements. Here, we’ll make this _REALLY_ simple:

This is a link to the actual announcement: [Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors | CISA](https://www.us-cert.gov/ncas/alerts/TA18-074A)

Please quote the portion in there that says the Russians can now “shut power plants off at will” (which was how the NYT characterized it).

---

<div class="post-metadata">

**Author:** ![Aspenglow](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/aspenglow/32/76_2.png) [@Aspenglow](https://boards.straightdope.com/u/Aspenglow)\
**Post date:** [March 16, 2018, 5:04am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/28 "2018-03-16T05:04:01Z")

</div>

> [@HurricaneDitka](#):
>
> No, no they are not. THEY didn’t say that the Russians could “shut power plants off at will”. That was a fiction invented by Rachel Maddow and the NYT, AFAICT.

I disagree. I think the language in the report, “gained remote access into energy sector networks” is very clear. It ain’t email.

---

<div class="post-metadata">

**Author:** ![Sunny\_Daze](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sunny_daze/32/438_2.png) [@Sunny\_Daze](https://boards.straightdope.com/u/Sunny_Daze)\
**Post date:** [March 16, 2018, 5:04am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/29 "2018-03-16T05:04:28Z")

</div>

[Here is a link to the alert](https://www.us-cert.gov/ncas/alerts/TA18-074A), for those who want to follow along.

Here is full quote from your section above:

> [@](#):
>
> Targeting of ICS and SCADA Infrastructure  
> In multiple instances, the threat actors accessed workstations and servers on a corporate network that contained data output from control systems within energy generation facilities. The threat actors accessed files pertaining to ICS or supervisory control and data acquisition (SCADA) systems. Based on DHS analysis of existing compromises, these files were named containing ICS vendor names and ICS reference documents pertaining to the organization (e.g., “SCADA WIRING DIAGRAM.pdf” or “SCADA PANEL LAYOUTS.xlsx”).  
> \*\*  
> The threat actors targeted and copied profile and configuration information for accessing ICS systems on the network. DHS observed the threat actors copying Virtual Network Connection (VNC) profiles that contained configuration information on accessing ICS systems. DHS was able to reconstruct screenshot fragments of a Human Machine Interface (HMI) that the threat actors accessed.\*\*

I’ve bolded the second paragraph that you omitted. You’ll note that they reference the HMI. [The screenshot is a GUI](https://www.flickr.com/photos/133093217@N04/40835206861/in/dateposted-public/), and very clearly NOT an excel spreadsheet. (Interested readers should look at the alert for a more complete understanding. Redacted areas appear to include accounts, spoofed data, and so on.)

The New York Times article also mentions specific detection work done by Symantec and Cloudstrike. These companies have unravelled state-actor level cyber-activity before. I take their conclusions seriously.

Where do we go from here? Whether Russia can shut down our power grid today or in 6 months, Russia is ramping up hostilities and we are nattering on about Trump Jr’s divorce, and porn stars.

---

<div class="post-metadata">

**Author:** ![HurricaneDitka](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@HurricaneDitka](https://boards.straightdope.com/u/HurricaneDitka)\
**Post date:** [March 16, 2018, 5:13am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/30 "2018-03-16T05:13:33Z")

</div>

> [@Aspenglow](#):
>
> I disagree. I think the language in the report, “gained remote access into energy sector networks” is very clear. It ain’t email.

No, it’s not clear. It’s terribly vague. “networks” could mean almost anything. I personally have “remote access into energy sector networks” (but was nowhere near able to shut down a power plant).

The headliner is this:

> [@](#):
>
> **Systems Affected**
> 
> - Domain Controllers
> - File Servers
> - Email Servers

You think they conveniently left “SCADA systems” off this list?

---

<div class="post-metadata">

**Author:** ![Sunny\_Daze](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sunny_daze/32/438_2.png) [@Sunny\_Daze](https://boards.straightdope.com/u/Sunny_Daze)\
**Post date:** [March 16, 2018, 5:17am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/31 "2018-03-16T05:17:42Z")

</div>

I forgot to include the conclusion from Symantec that also supports the control of systems:

> [@](#):
>
> “We now have evidence they’re sitting on the machines, connected to industrial control infrastructure, that allow them to effectively turn the power off or effect sabotage,” said Eric Chien, a security technology director at Symantec, a digital security firm.

from the New York Times article

It goes back to October 2017, however, in this [Wired](https://www.wired.com/story/hackers-gain-switch-flipping-access-to-us-power-systems/)article

> [@](#):
>
> “There’s a difference between being a step away from conducting sabotage and actually being in a position to conduct sabotage … being able to flip the switch on power generation,” says Eric Chien, a Symantec security analyst. “We’re now talking about on-the-ground technical evidence this could happen in the US, and there’s nothing left standing in the way except the motivation of some actor out in the world.”

At that time, Symantec declined to publicly state which actor was responsible for the attacks, but was working with NERC and the DHS. Russia was rumored to be behind them. Today the kimono appears to have opened.

---

<div class="post-metadata">

**Author:** ![HurricaneDitka](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@HurricaneDitka](https://boards.straightdope.com/u/HurricaneDitka)\
**Post date:** [March 16, 2018, 5:29am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/32 "2018-03-16T05:29:30Z")

</div>

So Eric Chien has been pushing the same story line for at least 6 months now. Great. :rolleyes:

---

<div class="post-metadata">

**Author:** ![Sunny\_Daze](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sunny_daze/32/438_2.png) [@Sunny\_Daze](https://boards.straightdope.com/u/Sunny_Daze)\
**Post date:** [March 16, 2018, 5:33am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/33 "2018-03-16T05:33:49Z")

</div>

I’ve read the entire report, including skimming the code, and I’ll summarize for you. Using a wide variety of techniques from social engineering to far more sophisticated, hackers attempted to gain access to targeted (as opposed to random) agencies/utilities/etc. Their ultimate goal was always to gain access inside the network, either by gaining credentials (legitimate ones that are then used illegitimately), or creating illegitimate ones once they are able to get into the right layers of the network through another means (several are listed). Credentialed users can do all kinds of fun things with a network, from telling a network to do things, to learning more about how a system works, to copying all kinds of data and sending it out of the network to other people who want it. From that starting point, or parallel with it, you can insert other pieces of code into the network, for example to over-heat a reactor, or shut down a grid. If you can get into a network at that level, you can run it.

No the report will not say “shut plants off at will” because the writers of the report think that is obvious. I cannot see where you read that report and believe that they only thing at risk is some Excel files.

The base case is that we should not let anyone rummage around our core systems.

---

<div class="post-metadata">

**Author:** ![Sunny\_Daze](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sunny_daze/32/438_2.png) [@Sunny\_Daze](https://boards.straightdope.com/u/Sunny_Daze)\
**Post date:** [March 16, 2018, 5:34am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/34 "2018-03-16T05:34:52Z")

</div>

> [@HurricaneDitka](#):
>
> So Eric Chien has been pushing the same story line for at least 6 months now. Great. :rolleyes:

I am slain by your rebuttal. I’ll retire to lick my wounds. :dubious:

---

<div class="post-metadata">

**Author:** ![Aspenglow](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/aspenglow/32/76_2.png) [@Aspenglow](https://boards.straightdope.com/u/Aspenglow)\
**Post date:** [March 16, 2018, 5:53am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/35 "2018-03-16T05:53:00Z")

</div>

**Ditka** , let it go. You’ve shared your interpretation of the alert, and I’ve shared mine. We disagree, and you’ve presented nothing to change my mind. You need to substantively address the points **Sunny Daze** raised in Posts #29 and 31. She is showing you exactly where the conclusions about having control to turn off/sabotage the power plants are coming from, and you seem to be simply trying to indulge a strong confirmation bias. I think you saw my user name coupled with the words, “Maddow” and “MSNBC” and drew an instant and erroneous conclusion. I hope you can stop doing this as it adds nothing to the debate. (The mansplaining was funny, though, so thanks for that.)

**Sunny Daze** , I think your statement about our being in dismaying disarray is spot on and so important. A path forward does seem to be coming into focus, and as much as I hate to invoke politics into your thread, we must regain control over our government as soon as possible in order to mount any meaningful, cohesive and coherent response to what Russia is doing. They know it, too – which is why the disruption is going to be horrendous ahead of the mid-term elections. I liken it to landing a plane through a hurricane. I do think the majority of citizens recognize this. It’s just a long damn time till November. Porn stars and Trump Jr.'s divorce are perhaps just ways to pass the time until more impactful things can be accomplished.

We need to mend fences with our allies as soon as possible. We need to somehow reestablish trust between their intelligence services and our own, so that information can again be freely shared. It is going to be a massive challenge.

We need to be critical of and wide-ranging in our news sources and never, ever take news from social media. **Ditka** obviously hates MSNBC and Maddow, but my own experience is that they are doing a great job and are often ahead of the curve for what is shown to be true as other agencies catch up. Moreover, I confirmed the story I heard on Maddow with Bloomberg, New York Times, BBC and others before saying anything on the board, as you also did. I don’t care where the news comes from. I only care that it’s factually true. This is one of the biggest problems we face: Being able to discern actual information from false information – and be willing to be wrong.

Like you, I feel gloomy and sad about our present circumstances. Until we find a way to have discussions without imposing preconceived notions about the motivations of our partners in conversation, it will be extremely difficult. With a president who not only thrives on chaos and confict but encourages it as a means of obfuscating his own transgressions, it is going to take an Herculean effort to see our way through to the other side.

**Bayard** made good points without snark and I hope s/he will return to the thread and give us an interpretation of the additional information you have provided here. S/he may have some additional ideas about what more we might do in the face of this challenge.

I personally think the best thing we can do right now is to be aware of the concerns, share the information with those who are receptive to hearing it and make sure the information informs their votes going foward. We need people in government who are able to recognize and respond to these threats seriously. I am no fan of Rick Perry, but I give him credit for at least trying.

Beyond that, I’m at a loss.

---

<div class="post-metadata">

**Author:** ![HurricaneDitka](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@HurricaneDitka](https://boards.straightdope.com/u/HurricaneDitka)\
**Post date:** [March 16, 2018, 6:01am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/36 "2018-03-16T06:01:20Z")

</div>

> [@Aspenglow](#):
>
> … I think you saw my user name coupled with the words, “Maddow” and “MSNBC” and drew an instant and erroneous conclusion. I hope you can stop doing this as it adds nothing to the debate. (The mansplaining was funny, though, so thanks for that.) …

> [@Aspenglow](#):
>
> … **Ditka** obviously hates MSNBC and Maddow…

> [@Aspenglow](#):
>
> … Until we find a way to have discussions without imposing preconceived notions about the motivations of our partners in conversation, it will be extremely difficult. …

Oh the irony.

---

<div class="post-metadata">

**Author:** ![Sunny\_Daze](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sunny_daze/32/438_2.png) [@Sunny\_Daze](https://boards.straightdope.com/u/Sunny_Daze)\
**Post date:** [March 16, 2018, 6:08am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/37 "2018-03-16T06:08:20Z")

</div>

**Hurricane Ditka** was there more?

---

<div class="post-metadata">

**Author:** ![Aspenglow](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/aspenglow/32/76_2.png) [@Aspenglow](https://boards.straightdope.com/u/Aspenglow)\
**Post date:** [March 16, 2018, 6:17am UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/38 "2018-03-16T06:17:38Z")

</div>

> [@HurricaneDitka](#):
>
> Is there **a more credible source** confirming this?

> [@HurricaneDitka](#):
>
> [Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors | CISA](https://www.us-cert.gov/ncas/alerts/TA18-074A) appears to be the actual report. **I’d politely submit to you that Rachel Maddow and the NYT are full of shit** (at least on this point). They don’t appear to have “penetrated actual control of facilities – including nuclear facilities.”
> 
> ETA: **but I get it, what’s a bit of scare-mongering between friends to sell some advertising, right?**

> [@HurricaneDitka](#):
>
> I know this wasn’t addressed to me, but I’m saying it hasn’t actually gotten that far. As for why the media is making a story out of it, I can only speculate, but I speculate that e **ither they believe exaggerating this threat serves their purpose of undermining President Trump, or they’re playing for ratings.**

> [@HurricaneDitka](#):
>
> **There’s a portion of the story here that I believe to be exaggerated / false.** It’s this:
> 
> I don’t think the Russians have the ability to shut down any of our power plants at will. The actual alert doesn’t seem to indicate they do. **Some shoddy “journalism” seems to have taken some wild-eyed sky-is-falling interpretation of that report and exaggerated it into “Russians can shut down our power plants at will”.**

> [@HurricaneDitka](#):
>
> I think it means they hacked some power company’s email, and stole some PDFs and Excel spreadsheets. Not good, but a long ways short of being able to “shut power plants off at will”.
> 
> I think _the media_ is wrong about their characterizations of what happened. I think they (the media) are exaggerating the severity of it to a significant degree. **“scare-mongering” is the word I’d use, but I recognize that many of you are going to resist the idea that you got duped and that your favorite news source might be pedaling fear.**

> [@HurricaneDitka](#):
>
> No, no they are not. THEY didn’t say that the Russians could “shut power plants off at will”. **That was a fiction invented by Rachel Maddow and the NYT, AFAICT.**

I’m sorry. Did I misunderstand your meaning? Were you actually expressing admiration for MSNBC and Maddow? 'Coz it just seemed like in virtually every post you made, you were denigrating these news sources and the people who consider them to be credible.

---

<div class="post-metadata">

**Author:** ![Defensive\_Indifference](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/defensive_indifference/32/6502_2.png) [@Defensive\_Indifference](https://boards.straightdope.com/u/Defensive_Indifference)\
**Post date:** [March 16, 2018, 1:54pm UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/39 "2018-03-16T13:54:29Z")

</div>

Geez, a guy goes to bed, and people go right on having an engaging conversation without him! The nerve!

So, I have to eat some crow, which I prefer medium well with mustard. I did not read the CERT alert very closely last night. I read the first bit of it, assumed it was like the other 100s of them I’ve seen, and went back to drinking my beer. I should have read it to othe end. It got good.

> [@Sunny\_Daze](#):
>
> **Bayard** I agree with **Aspenglow**. This sounded more like stuxnet-level shenanigans (not necessarily stuxnet-type, if you follow me). That said, I’ve only seen a few press pieces, and the Maddow interview to date.

I’m more inclined to agree with this now. Reading to the end of the CERT alert, I see (as you also quoted later in this thread) that the threat actors got into the intended targets’ networks and moved laterally to the point that they were able to gain control of a computer that apparently used VNC to manage a device involved in power generation. The screenshot is really concerning. It **does** look like the bad guys had control of a Programmable Logic Controller (PLC), and they quite possibly could have shut down some systems or caused a dangerous condition.

So, in the clear light of day and without beers to drink, this is starting to look like a brown trousers moment. This report has the attackers getting farther than I had assumed they did. Russia has used attacks like this on power grids, notably against Ukraine, so it’s not surprising that they’re targeting us. And I hope we’re doing the same to them. But the extent the which they succeeded here is pretty worrisome.

And stories like this are why I drink in the first place.

My apologies again for shooting from the hip before reading the whole alert.

ETA: And to the power plant people: airgap the nuke systems, guys.

---

<div class="post-metadata">

**Author:** ![crucible](https://avatars.discourse-cdn.com/v4/letter/c/5f8ce5/32.png) [@crucible](https://boards.straightdope.com/u/crucible)\
**Post date:** [March 16, 2018, 1:57pm UTC](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635/40 "2018-03-16T13:57:06Z")

</div>

> [@HurricaneDitka](#):
>
> Is there a more credible source confirming this?

More credible than Rachel? YGTBK

[Previous page](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635.md?page=1)

[Next page](https://boards.straightdope.com/t/fbi-announces-ongoing-russian-attacks-against-american-electric-grid-water-processing-air/810635.md?page=3)
