By Ted Weaver

08/17/2003

While most of the media runs from news conference to news conference looking and sounding like keystone cops, and industry officials jumping from conclusion to conclusion, I have been looking elsewhere for answers and possibilities. Because I had good reason to.

After picking up on signals over the past 60 days, I was already nervous that something was about to happen. I started to become seriously concerned. To the point of calling up Verizon and make a complaint two weeks ago and warned them that something was up. I was concerned about being compromised. Obviously, to no avail. The telephone techie didn’t think it was important enough to forward to the Verizon Security center in Virginia. And I did mention the Chinese scans. I also contacted my firewall software company and sent them a partial log and explaining strange hacker activity has increased and being concerned about being compromised. I was told by tech who sends out emails there that because the software company had upgraded their software, I would see more types of scans - not that the scanning activity increased. That didn’t satisfy me whatsoever, because this was occurring before I upgraded.

After awhile, you just get this gut feeling that no one knows what the hell they are doing. Kind of makes one wonder if you are the only one watching for this sort of thing. I’m sure others have had similar occurrences showing up on their logs. Though, probably not many pay attention to the patterns and related activity or understand it.

Over the last two months, I have noticed irregular scanning patterns and activity coming from the Peoples Republic of China. 24/7. I watch my system like a hawk. I regularly update windows patches, security software upgrades or patches and don’t open up any email on my computer period (secret method:).

I know my computer system. I recognize the slightest change in its performance. Which includes the lack thereof. Even to the point that if I notice before a warning from my firewall software that I detect the slightest change working in the back round, off it goes when I’m online (experience).

The Chinese hackers have thrown the full range of hacker types of scans at me. Ranging from the UDP MSRPC Probes in which Someone is scanning your system for active MSRPC services. MSRPC is Microsoft's implementation of DCE/RPC (Distributed Computing Environment, Remote Procedure Calls. It allows remote attackers to make function calls as if they were operating locally on the computer. And these have been frequent. Another probe on a regular basis from China has been the UDP port probe in which Someone has tried to access your computer's UDP (User Datagram Protocol) ports and failed. A port is a point of entry into a system. Each Internet-enabled program running on a system is reached through its own ports. Attackers commonly perform widespread UDP scans searching for security weaknesses they can use to break into systems. These types of scans I’ve noticed have been plentiful over a period of two months. Quite frankly, I’ve lost count.

The most disturbing pattern emerged between the dates and times listed below. Keep in mind my computer is not online 24 hrs per day or for hours on end and many times I turn it off when I see numerous scans close together. Of course, the Chinese hacker scans have been ongoing up and until this present moment and before these key dates and times. But not as concentrated as depicted below. Now, I see an enormous number of infected computers showing up trying to make contact with mine - to infect me. But that didn't happen. It was shocking at its peak to see how many computers were infected. At times it seemed that there was another computer trying to contact mine every 10 seconds as the logs show beyond what is described below.. It got to the point I just turned off the computer. It was simply stunning.

Time,                 Event,                 Intruder     Count Origin

The code written into the worm causes the operating systems Windows XP, Windows 2000 systems and Windows NT 4.0 to shut down and reboot without a command from the operator then go hunting for other vulnerable computers to infect. . Also, the later variants installed a backdoor (way to get in) which could essentially take control of your computer to steal files, delete files and information so on and so forth. Depending on what your computer does, and who you are, an intrusion like this could cause a serious compromise of your system and the company you work for.

The Possibility

Now just supposing you are one of those who work in the upper management and control level for a utility company. Either at the main monitoring control or sub-station somewhere or possibly even operating wireless. But all tied into what is known as the SCADA system, which stands for “Supervisory Control And Data Acquisition” which sometimes utilizes the OS Windows XP ,NT 2000 systems and is connected to the internet. To pose this plausible scenario here lets start with this. The system administrator of a power plant monitoring facility hasn’t followed the rules in keeping up with the security patches. Could the system become infected with the Blaster worm or its variants? Yes. Could a hacker gain entry through this lapse in security? Yes since it is connected to the internet through Windows based servers. Could the worm infect the windows based servers connected to the SCADA system? Yes and it could spread throughout the rest of the Windows based system via other computers (controllers) within the same system since they are all interconnected and to the internet. This is a prime example of how a cyber attack and catastrophic interconnected rippling effect could occur . Of course there are other possible scenarios too. But to me, this one seems to make the most sense. There were just too many redundant safeguards in place that failed and over quite a distance.