IDG News Service - An anonymous hacker who claimed to have broken into monitoring systems at a New Mexico wind turbine facility made the whole thing up, security experts said Monday.
The hacker, who called himself Bigr R, said he broke into NextEra Energy Resources' Fort Sumner wind facility in revenge for an "illegitimate firing." He posted what he said was proof of his exploits to several places Saturday, including the Full Disclosure mailing list.
In fact, the "proof" he provided had been gathered from public websites and contained contradictory information.
Ruben Santamarta, head of security assessment at the security consultancy Wintercore, was the first to uncover the hoax. He found that the screenshots allegedly proving Bigr R had access to the Fort Sumner management console were lifted from a file on a publicly available FTP server.
After pointing out a number of technical errors in the alleged proof, Santamarta concluded that Bigr R was a fake.
NextEra, owned by Florida Power & Light (FPL), had already said on Sunday that the material offered as proof was largely publicly available and that there was no evidence that its facility had been hacked.
Some Cisco routers cited by Bigr R were reported to have been accessible, but the proof he offered that he had hacked into industrial systems was all faked, Santamarta said via instant message.
Others agreed: "We now believe most, if not all, of this is a hoax and an attempt to embarrass [Florida Power & Light]," wrote Eric Byres, CTO with Byres Security, in a blog post Monday.
One expert, Wesley McGrew of security consultancy McGrew Security, had thought on Sunday that Big R's claims were probably legitimate. By Monday he had changed his mind and agreed that "it looks like a lot of it has been faked."
Bigr R insisted Sunday that he was not a hoaxer. Late Sunday and Monday, however, he did not respond to e-mails seeking comment.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast Best Practices: How to Improve Business Continuity with Virtualization VMware solutions include a range of business continuity capabilities to help ensure availability for applications across your virtualized environment. Learn More>>
- Live Webcast
Transforming Finance, Procurement and Supply Chain Effectiveness with Cross-Functional Analytics
Date: May 6th, 2014
Time: 1 PM EDT
Attend this Webcast to find out how Oracle's packaged analytic applications enable line-of-business managers to examine all...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts