ArchivedArticles: Blackout 2003

From An Interview With Richard Clarke The Former White House Cyber Security Advisor from 2001 to March 2003. (3-18-03) Clarke was White House cyber security adviser from October 2001 to March 2003, heading up the President's Critical Infrastructure Advisory Board. In this interview, he discusses the many vulnerabilities of cyberspace, the evidence that points to Al Qaeda's cyber capabilities, his views on liability laws and federal regulation for cyber security, and why he believes the new U.S. National Strategy to Secure Cyberspace is "a great success story." This interview was conducted on March 18, 2003. Joe Weiss, an expert in control systems and SCADA systems, said that most of the system's electrical power world industry work off of Windows 2000. The security scenario on how one fixes it is now about 50 pages long. His statement to me was, "Nobody does it. Everybody uses it out of the box." What's the problem, as defined by that?

http://www.pbs.org/wgbh/pages/frontline/shows/cyberwar/interviews/clarke.html

August 12, 2003
Worm Blasts Windows Users Worldwide
By Mark Berniker Internetnews.com

The 'Blaster' worm, also referred to as the 'Lovesan' or 'MSBlaster' worm, takes advantage of a vulnerability in Microsoft's Windows Distributed Component Object Model (DCOM) Remote Procedure Call (RPC) interface, widely publicized in July as the first 'critical' vulnerability in Microsoft's new Windows Server 2003 operating system, though it also affects Windows NT 4.0, Windows NT 4.0 Terminal Services Edition, Windows 2000, and Windows XP.

http://www.internetnews.com/dev-news/article.php/2247801

From An Interview With Richard Clarke The Former White House Cyber Security Advisor from 2001 to March 2003. (3-18-03)

So a lot of system administrators, rather than go through all of that, not knowing what's going on in their own system, just don't apply the patches, or they take months to apply the patches. What we saw with the Sapphire worm, or we saw with Nimda, or we saw with Code Red, was that the vulnerability had been identified, the patch had been issued. But people hadn't bothered to put it on, because it's just too cumbersome, too hard to do, and you don't know what effect it's going to have on other pieces of software.

Right now, our electric power companies, both the generating companies and the distribution companies, have paid very little attention to security in cyberspace

In this one case, I think federal regulation makes sense, because without it, these electric power companies are not going to pay attention to security.

http://www.pbs.org/wgbh/pages/frontline/shows/cyberwar/interviews/clarke.html

Computer worm wreaks havoc By DAVID AKIN
>From Thursday's Globe and Mail

Aug 14, 2003

A worm, though, crawls across the Internet automatically, search