Experts agree: Wind turbine ‘hacker’ is a fake

An anonymous hacker who claimed to have broken into monitoring systems at a New Mexico wind turbine facility made the whole thing up, security experts said Monday.

The hacker, who called himself Bigr R, said he broke into NextEra Energy Resources’ Fort Sumner wind facility in revenge for an “illegitimate firing.” He posted what he said was proof of his exploits to several places Saturday, including the Full Disclosure mailing list.

In fact, the “proof” he provided had been gathered from public websites and contained contradictory information.

Ruben Santamarta, head of security assessment at the security consultancy Wintercore, was the first to uncover the hoax. He found that the screenshots allegedly proving Bigr R had access to the Fort Sumner management console were lifted from a file on a publicly available FTP server.

After pointing out a number of technical errors in the alleged proof, Santamarta concluded that Bigr R was a fake.

NextEra, owned by Florida Power & Light (FPL), had already said on Sunday that the material offered as proof was largely publicly available and that there was no evidence that its facility had been hacked.

Some Cisco routers cited by Bigr R were reported to have been accessible, but the proof he offered that he had hacked into industrial systems was all faked, Santamarta said via instant message.

Others agreed: “We now believe most, if not all, of this is a hoax and an attempt to embarrass [Florida Power & Light],” wrote Eric Byres, CTO with Byres Security, in a blog post Monday.

One expert, Wesley McGrew of security consultancy McGrew Security, had thought on Sunday that Big R’s claims were probably legitimate. By Monday he had changed his mind and agreed that “it looks like a lot of it has been faked.”

Bigr R insisted Sunday that he was not a hoaxer. Late Sunday and Monday, however, he did not respond to e-mails seeking comment.

Robert McMillan covers computer security and general technology breaking news for The IDG News Service. Follow Robert on Twitter at @bobmcmillan. Robert’s e-mail address is robert_mcmillan@idg.com