CERT warns of critical industrial control bug

A group collaborating with the U.S. Computer Emergency Readiness Team is warning oil refineries, power plants, and other industrial facilities of a bug in a popular piece of software that could allow attackers to take control of their computer systems. The vulnerability in the Genesis32 and BizViz products made by Massachusetts-based Iconics could allow attackers to remotely execute malicious code on machines that run these supervisory control and data acquisition programs (SCADA), the Industrial Control Systems CERT warned May 11. The programs are used to control equipment used in factories, water, wastewater and electric utilities, and oil and gas refineries. The vulnerability stems from a stack-overflow bug found in an ActiveX control used by the SCADA programs and can be exploited to gain command-execution capability, researchers from Australasia-based Security-Assessment.com warned. “By passing a specially crafted string to the ‘SetActiveXGUID’ method, it is possible to overflow a static buffer and execute arbitrary code on the user’s machine with the privileges of the logged on user,” the researchers warned. They included a proof-of-concept exploit written in JavaScript. Iconics has updated the vulnerable component to plug the security hole. According to the advisory, version 9.22 of Genesis32 and BizViz is not susceptible to the attack.

Details Here

first published week of:   05/16/2011

China taking solar power lead?

Beijing announced it was guaranteeing solar developers certain payments for every kilowatt-hour of clean energy they feed into the nation’s grid.

As an economic powerhouse, Beijing is moving to include more renewable energy on the national grid. The country set a goal of increasing its solar power capacity significantly during the next five years.

A feed-in tariff guaranteeing about 15 U.S. cents per kilowatt hour of electricity could put the country in a leadership position, the Financial Times reports.

“We strongly believe that China will quickly evolve into one of the largest and most important solar markets in the world,” Miao Liansheng chief executive of solar power company Yingli, told the newspaper.

Beijing’s European rivals have started cutting back on solar power subsidies, meaning China is set to become a world leader in solar panel purchases.

Details Here

first published week of:   08/08/2011

Cleaning up the Cleantech Economy
Does Solyndra's bankruptcy belie the clean technology sector? Green energy has gotten a black eye but as pioneering tools exit the queue, it will rebound

Before the era of ‘win–at–all–cost,’ public policy largely endorsed loans and other incentives targeted to all kinds of energy projects. The simple goal has been the creation of far–reaching technologies that will add value and boost economic growth while mitigating risks to the federal treasury.

“The reality is the Department of Energy’s loan guarantee program will likely result in minimal costs and large gains for taxpayers&mndash;just like many other federal lending efforts,” write Mark Muro and Jon Rothwell, both with the Brookings Institute, in the New Republic.

The two go on to say that the loan guarantee program has generated billions in loans that has trickled throughout the broader economy, creating jobs in factories and in electric utilities. They point to Xyratex, which built advanced machines for collapsed Solyndra: The firm is hiring people nationally.

Altogether, they say that the during the most recent recession, the loan program has generated $4 to $8 of private lending for every $1 of public investment. The U.S. government runs at least 70 loan guarantee programs, they add, which along with other lending plans, will put $3 billion in taxpayer money at risk. But those policies will return $46 billion to taxpayers in 2011.

Details Here

first published week of:   10/17/2011

Cloud Computing and Clean Energy
Could networks be powered by wind?

Could wind and solar power be used to power a distributed network of data centers connected by fiber–optic cable that would bypass the transmission grid?

Researchers in New York are trying to find out, with a public–private partnership of business and academia that wants to power the “cloud computing” networks with servers that rely on wind or solar–generated electricity.

The New York State Energy Research and Development Authority (NYSERDA), along with Clarkson University, Advanced Micro Devices Inc. (AMD), HP and other private businesses, hope to demonstrate how a network of wind– and solar–powered data centers could create a new model for data center and renewable energy operations.

Google has made the electricity demand of its data centers an overriding reason for its entry into clean energy investments in wind and solar.

The new program in New York uses a distributed network of data centers to make this high–energy–demand technology more energy–efficient and cost–effective than current methods. If successful and deployed on a larger scale, this project could bring significant energy savings to an industry that can consume one megawatt of electricity at times of peak operation, project proponents say.

Details Here

first published week of:   08/22/2011

Company declined safety plan in California pipeline explosion

The California utility whose gas pipeline exploded last September had rejected federal recommendations to install more automatic shut-off valves to help reduce the risks from a rupture and fire, an investigative panel was told March 1. U.S. Department of Transportation recommendations call for the installation of automatic or remote shut-off valves to reduce the risks of a conflagration, according to documents released at a National Transportation Safety Board (NTSB) hearing into the accident. Pacific Gas&Electric had rejected the guidance, finding in a 2006 memo that most damage from a pipeline rupture occurs during the first 30 seconds. The memo concluded that automatic valves “will not provide additional safety to people or prevent property damage. ”The National Transportation Safety Board has not concluded what caused the explosion. The agency is holding the hearing to discuss broader safety issues raised by the accident. During sometimes tense questioning by NTSB investigators, a panel of PG&E officials said it was impossible to say whether the impact of the fire could have been lessened by better preparation.

Details Here

first published week of:   03/07/2011

Concrete deterioration at Seabrook Station prompts national warning

A problem with degradation of concrete in the control building at the Seabrook Station nuclear power plant in Seabrook, New Hampshire, prompted the Nuclear Regulatory Commission (NRC) to issue a warning to operators of nuclear power plants across the country. “The NRC has issued an information notice to all U.S. nuclear power plant operators regarding the issue of alkali-silica reaction-induced (ASR) concrete degradation,” an NRC Region 1 spokesman said. “This notice was prompted by the identification of ASR at the Seabrook nuclear power plant. NRC information notices are generic communications designed to make all plants aware of issues, with the expectation they will review the information for applicability to their facility and consider actions, if necessary to avoid similar problems.” The report noted specific areas of concrete degradation and metal corrosion found at the plant including concrete cracking and corroded steel supports.

Details Here

first published week of:   12/05/2011

Volume 31

-->