Comment Articles

Did Blaster bring down the US grid?

Bruce Schneier CNET News

Published: 10 Dec 2003 15:40 GMT

This massive computer failure was critical to the cascading power failure. The report continues: "Power system operators rely heavily on audible and on-screen alarms, plus alarm logs, to reveal any significant changes in their system's conditions. After 2:14 p.m. (EDT) on 14 August, FE's operators were working under a significant handicap without these tools. However, they were in further jeopardy because they did not know that they were operating without alarms, so that they did not realise that system conditions were changing."

Other computer glitches are mentioned in the report. At the Midwest Independent Transmission System Operator, a regional agency that oversees power distribution, there's something called a "state estimator." It's a computer used to determine whether the power grid is in trouble. This computer also failed, at 12:15 p.m. According to the report, a technician tried to repair it and forgot to turn it back on when he went to lunch.

The Blaster worm first appeared on 11 August, and infected more than a million computers in the days following. It targeted a vulnerability in the Microsoft operating system, infected computers and in turn, tried to infect other computers. And in this way the worm automatically spread from computer to computer and network to network.

Although the worm didn't have to perform any malicious actions on the computers it infected, its mere existence drained resources and often caused the host computer to crash. To remove the worm, a system administrator had to run a program that erased the malicious code; then the administrator had to patch the vulnerability so that the computer would not get reinfected.

The coincidence is too obvious to ignore. At 2:14 p.m. EDT, the Blaster Worm was dropping systems all across North America. The report doesn't explain why so many computers -- both primary and backup systems -- at FirstEnergy were failing at around the same time. But Blaster is certainly a reasonable suspect.