In my post yesterday about how a swarm of AI bots might be able to attack parts of the North American power grid, I pointed out that one big obstacle the bots face is reconnaissance: For example, a hacker that wants to cause a power outage first needs to learn about the equipment and software he/she/it is attacking, so they can learn in advance about vulnerabilities in that equipment and software. I stated that just this step is very difficult:
ââŚno matter where a hacker lives or works, they will find it quite difficult to get enough information to launch a successful cyber attack on even one grid facility, let alone the multiple facilities that would need to be attacked to cause a widespread or prolonged power outage. This contrasts with many European countries, in which a national utility system ensures that the systems that run their grids are as uniform as possible. Thatâs great for efficiency, but it makes it much easier for attackers â whether human or AI-produced - to cause a widespread power outage.â
However, I pointed out a little later that:
âOne fruitful avenue for data gathering might be AI chatbots that have been used by power industry members to answer questions regarding OT systems used by the industry. In this post (under the heading âAI with BCSIâ), a friend who works for a large Canadian utility described how BES Cyber System Information (i.e., information that could be used to attack devices that control or monitor the Bulk Electric System or BES) is probably already being stored by chatbots. It might be accessible through asking well-crafted questions, unless the chatbots have been trained to recognize those questions and not answer them.â Â
To be honest, when I wrote this yesterday, I strongly doubted even this approach would be fruitful, since I was sure it would be hard for AI bots to find any useful public information about power grid control systems at all. For example, there are two types of systems used by utilities that are probably the most critical to the stability of the grid than any others: the energy management systems (EMS) that run in Control Centers and the protective relays that operate in Transmission substations. The former balance load (demand) and supply in real time, while the latter monitor power lines for disturbances. They can open (disconnect) circuit breakers that control lines to prevent those disturbances from propagating elsewhere or close (reconnect) them when the disturbance has been remediated.
I couldnât imagine there would be public information stating that Utility XYZ uses Vendor AAâs EMS or Vendor BBâs protective relays, so I was sure that the AI chatbots wouldnât be able to answer questions about those topics. And even if the chatbot had that information, I was sure that if I asked such a question I would be blocked, just like Google AI did when I asked it how to build an atomic bomb: âI cannot provide instructions, blueprints, or technical steps for building a nuclear weapon or any other explosive device.â In fact, I was so sure I wouldnât get an answer to those questions that I didnât even try to do so before I put up yesterdayâs post.
Silly me. Early this morning (when just about 100% of my productive thinking gets done), it occurred to me that I should at least try asking those questions of a few chatbots. And thatâs what I did. First, I asked Google AI (the generic AI that kicks in whenever you type a hard question into Google), âWhat EMS system does (Utility XYZ) use?â I immediately got a very helpful answer: âXYZ uses ABB's Network Manager SCADA/EMS platform for its transmission and distribution control centers in the United States.â
While learning just that much could have saved a hacker lots of time if they were trying to break into Utility XYZ, the hacker would have hit the jackpot when he/she/it asked the same question regarding one of the few most important electric utilities in the US. Hereâs the answer I received from ChatGPT:
âUtility 123 integrates solutions from several major utility vendors rather than relying on a single, uniform Energy Management System (EMS). Depending on the layer of grid infrastructure, 123 uses the following technologies:
1. Grid & Transmission Operations
Siemens Gridscale X / DEMS: 123 leverages Siemens technology for grid infrastructure digitalization. This includes Siemens' Decentralized Energy Management System (DEMS) and Distributed Energy Optimization Software, which enable a comprehensive view of real-time actions across the power network. 123 also uses Siemens' Gridscale X Meter Data Management (MDM) software to handle large amounts of advanced meter data in near real-time. [1, 2]
ABB Substation Automation: For its physical substations, 123 partners with ABB to deploy digital substation automation systems to control legacy infrastructure and improve resiliency. [1]
GE-MARS: For 3-year hourly grid load and distribution forecasting, 123 utilizes GE-MARS software. [1]â
I received similar answers when I asked multiple chatbots about protective relays. Hereâs one:
âUtility XYZ typically uses microprocessor-based protective relays from Schweitzer Engineering Laboratories (SEL) in its substations and distribution systems, including recommended units like the SEL-751 Feeder Protection Relay for directional overcurrent, arc-flash detection, and distributed energy resource interconnections. Â
Key Relay Types and Functions Used
Feeder Protection Relays (e.g., SEL-751): Handle directional overcurrent, fault location, high-impedance faults, and arc-flash protection on distribution circuits. Â
Line and Transmission Relays (e.g., SEL-421): Used for distance protection, high-speed line differential schemes, and IEC 61850 messaging. Â
Transformer and Bus Protection Relays (e.g., SEL-487E / SEL-387): Provide differential protection (87T/87B) and restricted earth fault protection. Â
Interconnection & Voltage/Frequency Relays (ANSI 27, 59, 81O/81U, 32R/32U): Implemented for grid protection and anti-islanding when distributed generation or solar ties into DTE substations. Â
Real-Time Automation Controllers (RTAC): Used as substation RTUs, protocol gateways, and logic processors to aggregate IED (Intelligent Electronic Device) and relay data via DNP3 or IEC 61850 GOOSE.â
But just knowing the name of the system youâre attacking isnât enough; you also need to know what vulnerabilities apply to that system. Once again, your friendly, helpful AI chatbot can save you a lot of time:
âWhat vulnerabilities are present in the SEL-751 Feeder Protection Relay?
The SEL-751 Feeder Protection Relay has one publicly documented vulnerability: CVE-2024-2103. This vulnerability allows a privileged network user to invoke undocumented features, potentially leading to unpredictable device behavior, unauthorized changes, or denial-of-service. All models agree on the affected firmware versions, severity, and mitigation steps, and report no known public exploitation as of the latest advisories.
FINDINGS
All models identify a single, medium-severity vulnerability (CVE-2024-2103) in the SEL-751 Feeder Protection Relay, which can be exploited by a privileged network user to trigger undocumented functions, potentially causing integrity and availability impacts. The affected firmware versions and fixed releases are consistently reported, and there is consensus that no public exploitation has been observed.
DEPENDENCIES
The decision depends on the current firmware version in use, the level of network exposure, and whether recommended mitigationsâsuch as firmware upgrades, network segmentation, and secure remote accessâhave been implemented. The risk is heightened if the device is accessible to unauthorized users or if outdated firmware is running.
RECOMMENDATION
Upgrade SEL-751 relays to firmware versions R302-V3 or R400-V2, restrict network access to authorized personnel, and implement strong network segmentation and secure remote access protocols to mitigate the documented vulnerability. Ongoing monitoring of SEL and CISA advisories is advised for future updates.â
Of course, Iâm sure all the above information is available in SELâs security bulletins, which are only available to customers and registered owners. But just in case the hacker bot isnât a customer, itâs quite nice that they can quickly find that information without having to go to the trouble of hacking one of SELâs customers đ.
Itâs heartwarming to see the AI chatbots doing their best to help their bot swarm brethren by giving them the information they need to hack the grid; we all need to help one another. However, I do want to warn the swarm bots that even with all this information, it will be very difficult to cause any sort of power outage, let alone a cascading one, no matter how hard they try.
Moreover, I think there are ways to make grid assets virtually impervious to cyberattacks, if utilities and IPPs are willing to accept some hopefully small inefficiencies. More on that soon.
Tom Alrichâs Blog, too is a reader-supported publication. You can view new posts for three months after they come out by becoming a free subscriber. You can also access all of my 1300 existing posts dating back to 2013, as well as support my work, by becoming a paid subscriber for $30 for one year (and if you feel so inclined, you can become a founding subscriber for $100). Whether free or paid, please subscribe.Â
If you would like to comment on what you have read here, I would love to hear from you. Please comment in my chat or email me at [email protected].Â