Report: Hackers Breached More US Water Treatment Plants (nbcnews.com) 66
"On January 15, a hacker tried to poison a water treatment plant that served parts of the San Francisco Bay Area," reports NBC News:
It didn't seem hard. The hacker had the username and password for a former employee's TeamViewer account, a popular program that lets users remotely control their computers, according to a private report compiled by the Northern California Regional Intelligence Center in February and seen by NBC News. After logging in, the hacker, whose name and motive are unknown and who hasn't been identified by law enforcement, deleted programs that the water plant used to treat drinking water.
The hack wasn't discovered until the following day, and the facility changed its passwords and reinstalled the programs. "No failures were reported as a result of this incident, and no individuals in the city reported illness from water-related failures," the report, which did not specify which water treatment plant had been breached, noted.
The incident, which has not been previously reported, is one of a growing number of cyberattacks on U.S. water infrastructure that have recently come to light. The Bay Area attack was followed by a similar one in Oldsmar, Florida, a few weeks later. In that one, which made headlines around the world, a hacker also gained access to a TeamViewer account and raised the levels of lye in the drinking water to poisonous levels. An employee quickly caught the computer's mouse moving on its own, and undid the hacker's changes... The usernames and passwords for at least 11 Oldsmar employees have been traded on the dark web, said Kent Backman, a researcher at the cybersecurity company Dragos...
[A] number of facilities have been hacked in the past year, though most draw little attention. In Pennsylvania, a state water warning system has reportedly alerted its members to two recent hacks at water plants in the state. In another previously unreported hack, the Camrosa Water District in Southern California was infected with ransomware last summer. Whether hacks on water plants have recently become more common or just more visible is impossible to tell, because there is no comprehensive federal or industry accounting of water treatment plants' security... Unlike the electric grid, which is largely run by a smaller number of for-profit corporations, most of the more than 50,000 drinking water facilities in the U.S. are nonprofit entities.
Some that serve large populations are larger operations with dedicated cybersecurity staff. But rural areas in particular often get their water from small plants, often run by only a handful of employees who aren't dedicated cybersecurity experts, said Bryson Bort, a consultant on industrial cybersecurity systems. "They're even more fragmented at lower levels than anything we're used to talking about, like the electric grid," he said. "If you could imagine a community center run by two old guys who are plumbers, that's your average water plant."
NBC News also a spokesperson for America's Cybersecurity and Infrastructure Security Agency, who shared an internal survey conducted earlier this year. As many as 1 in 10 water and wastewater plants reported they'd recently found a critical cybersecurity vulnerability — and more than 80% of their major vulnerabilities were software flaws discovered before 2017.
The hack wasn't discovered until the following day, and the facility changed its passwords and reinstalled the programs. "No failures were reported as a result of this incident, and no individuals in the city reported illness from water-related failures," the report, which did not specify which water treatment plant had been breached, noted.
The incident, which has not been previously reported, is one of a growing number of cyberattacks on U.S. water infrastructure that have recently come to light. The Bay Area attack was followed by a similar one in Oldsmar, Florida, a few weeks later. In that one, which made headlines around the world, a hacker also gained access to a TeamViewer account and raised the levels of lye in the drinking water to poisonous levels. An employee quickly caught the computer's mouse moving on its own, and undid the hacker's changes... The usernames and passwords for at least 11 Oldsmar employees have been traded on the dark web, said Kent Backman, a researcher at the cybersecurity company Dragos...
[A] number of facilities have been hacked in the past year, though most draw little attention. In Pennsylvania, a state water warning system has reportedly alerted its members to two recent hacks at water plants in the state. In another previously unreported hack, the Camrosa Water District in Southern California was infected with ransomware last summer. Whether hacks on water plants have recently become more common or just more visible is impossible to tell, because there is no comprehensive federal or industry accounting of water treatment plants' security... Unlike the electric grid, which is largely run by a smaller number of for-profit corporations, most of the more than 50,000 drinking water facilities in the U.S. are nonprofit entities.
Some that serve large populations are larger operations with dedicated cybersecurity staff. But rural areas in particular often get their water from small plants, often run by only a handful of employees who aren't dedicated cybersecurity experts, said Bryson Bort, a consultant on industrial cybersecurity systems. "They're even more fragmented at lower levels than anything we're used to talking about, like the electric grid," he said. "If you could imagine a community center run by two old guys who are plumbers, that's your average water plant."
NBC News also a spokesperson for America's Cybersecurity and Infrastructure Security Agency, who shared an internal survey conducted earlier this year. As many as 1 in 10 water and wastewater plants reported they'd recently found a critical cybersecurity vulnerability — and more than 80% of their major vulnerabilities were software flaws discovered before 2017.
Change password (Score:2)
Re: (Score:2)
Even if we think someone will be back the next day, every account at my work gets its permissions stripped and the password scrambled into a mess nobody will remember if they leave for whatever reason. I work in car repair.
Re: (Score:2)
One guy worked here for nearly 20 years and was quite upset when I gave him the bad news. Apparently it was "his" email address.
Re: (Score:1)
Re:Change password; email the KGB (Score:1)
Re: Change password (Score:2)
Re: (Score:2)
This is SF where we are told the elites live.
Hicks with money.
Re: (Score:2)
Re: (Score:2)
If you're an IT guy at a water treatment plant, you're likely not an elite IT guy.
Re: (Score:2)
Diabolical KRC, diabolical...
Re: (Score:2)
This is SF where we are told the elites live.
Elite system admins are not running the water company computers.
They are also not running the Bay Area consumer internet services, but that's a different story. Utah has better internet than we do.
Re: (Score:2)
Re: (Score:1)
TeamViewer account (Score:2)
Re: (Score:2)
How does this work? (Score:2)
Connecting to 10.22.35.112...
Connection established.
>User: Moron
>Pass: youllneverguessthislol
Welcome, Moron.
>Set fluoride concentration to 2000%.
OK.
>Open sewage bypass valve.
OK.
>Start sewage pump.
OK.
>Increase output pressure by 1000%.
OK.
>quit
Connection lost.
Re:How does this work? (Score:5, Interesting)
As a board member on one of those small rural water systems, that won't work. We have no fluoride injection, no chlorination, and no sewage cross connect. (Everyone is on septic tanks.)
If you hack into the PLC all you can do is turn off the pumps, or turn on the pumps, or send us spurious alarms.
And the pumps have off-hand-auto switches so if the PLC screws up, I can flip the switches as needed. This has been known to happen, so we know Hand works.
The middle level systems are more likely targets. They might actually have the systems you describe and not have the computer skills to secure them.
verification OOB ? (Score:2)
I understand your view I just wish they would build a verification system i.e. check's that are on a separate network the issue is often they build out this SCADA system and have no cheap one way independent system to verify the settings are applied.
Re: (Score:2)
Is nothing used to disinfect the water or is it done on the customer's side?
Re:How does this work? (Score:4, Informative)
It's from a deep well. There is nothing to disinfect.
And we do the coliform test monthly, and the other tests as required. Nitrates are a bit high due to this being an agricultural area, but not high enough to do anything about. And we keep an eye on pesticides and herbicides. But it's good water.
Re: (Score:2)
Thanks. In a former life I was a plant operator.
Re:How does this work? (Score:4, Informative)
Re: (Score:2)
Can you recommend a good softener? The only things I see for domestic use are magnets (which don't work) and salt-based filters (which do work but add salt to the water and need a lot of it).
I'm wondering what an industrial scale filter looks like.
Re: (Score:2)
Re: (Score:2)
Thanks. My understanding was that you needed a separate water softener with your RO system but I will investigate further.
Re: How does this work? (Score:2)
My city uses hydrofluorcilic acid in our water. Why can't someone hack in to save us from these idiots? If you want a corrosive neurotoxin it should be by your own consent and choice.
Re: (Score:3)
The boss says hey I want access from home so I don’t have to come in. Oh and make the password something easy.
Re: (Score:2)
Re: (Score:3)
Connecting to 10.22.35.112...
Connection established.
>User: Moron
>Pass: youllneverguessthislol
Welcome to ed, Moron.
Set fluoride concentration to 2000%.
?
Open sewage bypass valve.
?
Start sewage pump.
?
Increase output pressure by 1000%.
?
quit
?
wtf
?
help
?
logout
?
?
Re: (Score:3)
Connecting to 10.22.35.112...
Connection established...
But when they find your body, it will have really strong teeth.
Re: (Score:1)
Re: How does this work? (Score:1)
Terrible, Awful System Design (Score:4, Insightful)
"gained access to a TeamViewer account and raised the levels of lye in the drinking water to poisonous levels. An employee quickly caught the computer's mouse moving on its own"
This is simply terrible systems design. A functioning system should never just let any of the controls be movable to the "poison" setting. Any dangerous settings must be physically blocked by the machinery, which should be adjustable only by an actual mechanic on site behind a locked gate.
Re: (Score:1)
We used to have a security policy that you could not change any process setting unless you were at the time of the change located within the blast area of the equipment setpoint you were changing. That plus 3G security (Gates, Guards, Guns) is extremely effective.
imagine a community center run by two old guys... (Score:1)
Re: (Score:3, Insightful)
I've done a lot of work for organisations responsible for plant infrastructure and that freakishly accurately describes the staff.
IT capable employees outside of the IT industry are rare. Hell - IT capable employees in the IT industry aren't exactly the rule either.
You give most people the choice between secure and convenient they will take convenient until they get a shock.
Asymmetry (Score:3)
And that is why we can't beat Russia in this game. They barely have any water treatment plants, and those that exist are most certainly not connected to the global network (and, often, not even computerized). Low tech is best defense.
Re:Asymmetry (Score:5, Interesting)
I don't know if you were being sarcastic, but you're obviously correct. If you go to Shodan, you can find gas stations all over the United States with poorly configured level monitoring systems. Basically, some joker sold a monitoring system that gas stations put onto their networks that, without any authentication whatsoever, responds to an incoming telnet with things like the amount of gas remaining in the tank, what kind it is, how much water contamination has been detected, and so on. This came in handy when Hurricane Harvey hit Texas and a bunch of psychos started a gas rush. I was able to sit in a hotel room and tell family members on the phone what out of the way gas stations still had gas in their areas. I forget the exact details of how to do the scan on Shodan, but you can probably find it easily enough.
One interesting thing I found was a major medical center that had something insane like 10,000 gallons of jet fuel in an underground tank. (This is a place that's a major part of the National Disaster Medical System for Texas.) You have to figure that if all these places are leaking information like that, there's probably some idiotic design flaw to change the price of gas to $0.01/gal, or cripple the entire system by telling it that it's out of gas, or something else nefarious like just turning all the pumps off.
Re: (Score:2)
Was not being sarcastic at all.
Hacked again... (Score:2)
The hacker had the username and password
In other news: I just hacked into my bank account using the username and password I had provided earlier.
This has been a long time coming (Score:1)
This has been a potential issue for at least 16+ years ( longer really ). A few of us have been sounding the alarm at how exposed our SCADA systems are, and no one seemed to care.
Now we have significant infrastructure out there with it's ass in the wind, and I doubt anyone fully appreciates the scope of the problem. Well, that's not true; I'm sure foreign actors know just how exposed we are, but none of the "good guys" do.
Re: (Score:2)
Re: (Score:2)
Basic security is beyond the ability of most corps (Score:2)
Use a firewall to:
Block everything.
Permit only the network traffic which is required.
Sanity check what you allow.
Use SSO via a remote user directory where you can disable everything for an employee with one action.
Did I mention -- use a directory. LDAP, AD, Etc. Pick one, there are many.
*Never* trust passwords alone.
At minimum, two factor authentication is a must to access *any* critical system.
There are three categories that can be used in 2fa.
Re: (Score:2)
Why in the hell is this on the Internet (Score:3)
Re: (Score:2)
Because it's convenient and saves money. I say this based on a conversation I had with a person who has power to make these decisions.
It's also moronic, but that's my opinion.
Re:Why in the hell is this on the Internet (Score:4, Insightful)
Because driving all over the city to take measurements by hand is a bitch.
It's the very real reality of modern infrastructure that it gets controlled in realtime over a large area. Somehow you have to pay for that network. Do you use an existing network, or do you build yourself your own network with blackjack and hookers, and get the public to pay for it?
Re: (Score:2)
This. When the water company puts out a contract to build a new system, they specify remote control and data collection. They write "secure" on the spec and call it a day.
The companies bidding to build these systems aren't going to suggest installing a dedicated network at great cost. They will leverage existing synergies by setting up RDP with a password. Maybe via VPN, it is 2021 after all.
If it gets p0wned they will put out a press release about how "sophisticated state-level hackers" accessed their syst
UNPLUG IT FFS. (Score:2)
Why is this stuff plugged into the internet?
All this stupid narrative can be resolved - UNPLUG from the internet.
If you REALLY need remote access, use leased lines - not the internet.
Let's piss off with all this 'surveillance to make us safe' because it doesn't - and legislate that critical infrastructure cannot be connected to the internet in any way.
Re: UNPLUG IT FFS. (Score:3)
In the 90s you would laugh at the hacker movies because no one would ever connect stuff like this to the net.
Sometime between now and then, everything ended up hooked to the netâ¦.
Re: (Score:2)
Back in 1999 I was on dial-up. I noticed the LEDs on the modem flashing even though I was not sending any traffic. Looked at the packet dump and saw someone was pinging me.
I tried opening up telnet to their address, and got a login prompt. Tried "admin" for user and password and get straight in. Poked around a bit, couldn't see anything interesting. It wasn't Unix, didn't seem to have any kind of help system or list of commands. Managed to display a list of what looked like relays.
Anyway, got bored and trie
Re: (Score:2)
If you REALLY need remote access, use leased lines - not the internet.
In other words, a VPN / Router you don't control.
Leased lines are no longer as special as you think they are. These day's you're likely far better off with a standard internet connection but with carefully configured hardware firewall / routers on both ends.
Re: (Score:2)
Re: (Score:2)
At least with the leased line, you get competent level of support.
Speaking of things which don't happen...
You put a bit too much faith in others.
How many are? The current top story on /. is how NK needled their way into Bangladesh National bank and almost stole a billion dollars.
Indeed. But if you want to talk about access to a leased line you don't need to look at something so sophisticated. You simply look to the countless stories of incredibly frigging basic social engineering attacks on network providers all to happy to change you account details on a whim.
I think the amount of faith you place in a leased line is potentially quite dangerous. Kind of like airgapping. It is my experience that companies
Re: (Score:2)
Why not cut the middle hacker out (Score:1)