hacker of unknown origin, using masking software called Tor, took over the controls of a large utility's wind farm, according to a former industry compliance official who reviewed a report that was scrubbed of the utility's name. The hacker then changed an important setting, called the automatic voltage regulator, from "automatic" to "manual," he said.

That seemingly simple change to any power plant can damage the generator and destabilize parts of the nearby grid if the plant's output is high enough.

Last year, Homeland Security released several maps that showed a virtual hit list of critical infrastructure, including two substations in the San Francisco Bay area, water and gas pipelines and a refinery. And according to a previously reported study by the Federal Energy Regulatory Commission, a coordinated attack onFORTRAN, a programming language developed in the 1950s.

At the Tennessee Valley Authority, a corporation owned by the federal government that powers 9 million households in the southeastern U.S., a former operations security expert said in recent years he saw passwords for some key operating systems stored on sticky notes.

"Some of the control systems boot off of floppy disks," said Patrick Miller, who has evaluated hydroelectric dam cybersecurity for the U.S. Bureau of Reclamation and Army Corps of Engineers. "Some dams have modeling systems that run on something that looks like a washing machine hooked up to tape spools. It looks like the early NASA stuff that went to the moon."

The rush to tie smart meters, home programmable thermostats and other smart appliances to the grid also is causing