Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
Government Security Your Rights Online

Feds Investigating Water Utility Pump Failure As Possible Cyberattack 136

Posted by Soulskill
from the water-the-chances dept.
SpuriousLogic writes with this quote from CNN: "Federal officials confirmed they are investigating whether a cyber attack may have been responsible for the failure of a water pump at a public water district in Illinois last week. But they cautioned that no conclusions had been reached, and they disputed one cyber security expert's statements that other utilities are vulnerable to a similar attack. Joe Weiss, a noted cyber security expert, disclosed the possible cyber attack on his blog Thursday. Weiss said he had obtained a state government report, dated Nov. 10 and titled 'Public Water District Cyber Intrusion,' which gave details of the alleged cyber attack culminating in the 'burn out of a water pump.' According to Weiss, the report says water district workers noted 'glitches' in the systems for about two months. On Nov. 8, a water district employee noticed problems with the industrial control systems, and a computer repair company checked logs and determined that the computer had been hacked. Weiss said the report says the cyber attacker hacked into the water utility using passwords stolen from a control system vendor and that he had stolen other user names and passwords."
This discussion has been archived. No new comments can be posted.

Feds Investigating Water Utility Pump Failure As Possible Cyberattack

Comments Filter:
  • by Anonymous Coward on Friday November 18, 2011 @02:29PM (#38101898)

    Tryin to interfere with America's precious bodily fluids

    • No Reason (Score:5, Insightful)

      by sycodon (149926) on Friday November 18, 2011 @03:14PM (#38102454)

      I can think of no reason facilities such as this should be accessible via a public network. You should have to be physically present to access these control systems.

      • Re:No Reason (Score:4, Informative)

        by Sarten-X (1102295) on Friday November 18, 2011 @03:27PM (#38102604) Homepage

        Unless something goes catastrophically wrong, such as a fire in the control building, in which case the pumps (which must still operate) will need to be controlled remotely. Even during routine operation, the control system is likely connected to a monitoring network of some kind, to make sure things run smoothly.

        That means either wiring up a physically-isolated network (and constantly checking it for unauthorized alterations), which is ridiculously expensive, or connecting to the public network physically, and relying on software to keep it secure. Given that this system is probably a few decades old, and probably installed by the lowest bidder, you can make some reasonably-depressing assumptions about how secure that software is.

      • by kackle (910159) on Friday November 18, 2011 @04:42PM (#38103522)
        I've been in the water SCADA industry for 10 years. What I'm seeing lately are water operators, IT people, and system integrators who are overzealous when it comes to connectivity and all the "neat" things that can be done remotely via technology. It's the standard human foible when it comes to technology, writ dangerous: they consider what can be done versus whether it should be. The water industry isn't that exciting, so when flashy tech. comes along, and the taxpayer is footing the bill, I can see where they say "Yes!" And who is the salesperson to refuse this order?

        I'm all for automation, and crying out when a system is in trouble. But I haven't yet seen where humanized remote control is critical. Hackers aside, it's probably better if it's not.
        • by Animats (122034) on Saturday November 19, 2011 @12:00AM (#38106412) Homepage

          What I'm seeing lately are water operators, IT people, and system integrators who are overzealous when it comes to connectivity and all the "neat" things that can be done remotely via technology.

          Yes. Read "Access Your Embedded Controller with Ease through a Web Server" [ti.com], from Texas Instruments, which ought to know better. "The designer should also make it as easy as possible to change the settings on a piece of equipment, reconfigure its operation, or fine-tune the system. The more intuitive and explicit that activity is, the more likely the result will be what the operator desires. Losing the instruction manual can seriously impair the user's operation of many systems."

          What that paper describes is a family of embedded controllers with a web server in each controller and no security. What's wrong with this picture?

          • by plover (150551) *

            Wow. Not a relevant word in that document about security, isolation, or protection. And it was written in March of 2010! It's not like it's from 1998 when malware meant the GOOD TIMES virus in your inbox.

            That would really disturb me if I thought it would impact me in any meaningful way. Now if you'll excuse me, I have to go figure out why the water isn't working.

      • by AHuxley (892839)
        The days of paying 2-3 smart people and their helpers to sit around waiting for a problem or looking over a plant daily are over.
        You can connect any large scale plant with networked sensors and have one very expensive person sitting at home over looking a wide area of a state.
        If a code flashes, expert contractors are sent in to help the small group of very cheap staff on site.
        No more teams doing maintenance unless a VIP tour enters or cable tv science show offers free PR.
        Count the system down to just be
      • by mcgrew (92797) *

        An update: I just discovered that it's my own city, Illinois' capital, Cartoon City. From the State Journal-Register:

        CWLP denies reports it was victim of cyber attack

        By DEANA STROISCH (deana.stroisch@sj-r.com)
        The State Journal-Register
        Posted Nov 18, 2011 @ 11:05 AM
        Last update Nov 18, 2011 @ 11:31 AM

        City Water, Light and Power officials are denying reports that the utility was a victim of a cyber attack that may have been responsible for the failure of a water pump.

        âoeCWLP has not had any breach of its

        • New information (Score:4, Informative)

          by mcgrew (92797) * on Friday November 18, 2011 @06:13PM (#38104426) Homepage Journal

          The local TV news is on, and they just said that it was Curran, a tiny town five or ten miles from Springfield. They're concerned that the system might have been hacked because the company that designed the system discovered evidence of a breach of sensitive data... passwords, maybe? They did say it was gigabytes of data.

          • by RockDoctor (15477)
            Gigabytes of PASSWORDS ?

            More likely 9 characters of password giving access to a bare-bones install of WinXP that occupies a gig or so (it's been a while since I looked at an XP system).

      • by BanjoBob (686644)

        This is the way it used to be. The only true security is to be isolated. When I worked on secret stuff, anything that went into the facility stayed in the facility and, there was absolutely no connection to the outside world -- None.

        Also, these wireless network electric/water/gas meters are easily hackable. Why not just but a big wide open door into their data center?

        It's hard to take these utility companies seriously when they talk up security. If they want it secure -- secure it.

    • That's why I only drink distilled water and pure grain alcohol!
  • by Anonymous Coward

    ...thinks innocuous event is a cyber security attack. News at 11.

  • SCADA vulns (Score:5, Interesting)

    by sl4shd0rk (755837) on Friday November 18, 2011 @02:41PM (#38102036)

    SCADA systems were sold en masse under the presumption that they were "secure" because they were not connected to public networks. It will be interesting to see which entities did, or did not, follow their policies. Stuxnet was a USB infection but it was still able to route over the internet to phone home. I'm going to bet that a lot of SCADA networks are implemented to allow egress packets. It will be interesting to see how many SCADA systems are actually "isolated".

    • Re: (Score:3, Interesting)

      by Anonymous Coward

      I worked for a Utility in the early 2000's..I was on the post-9/11 security team that had to investigate and close loopholes for that utility. Many sites had interconnected the SCADA systems with the corporate network for GIS information. We were hard pressed to find adequate solutions that would meet the requirements that the federal government set at that time; as the engineering staff didn't want to give up the real-time GIS information they got from the SCADA systems.

  • AWESOME (Score:5, Interesting)

    by WindBourne (631190) on Friday November 18, 2011 @02:41PM (#38102038) Journal
    That is possibly just a kid playing, however, it could be somebody learning. The nice thing is that it has now been detected. Perhaps it is time to push not just security, but to insist that the parts be western or better yet, American made. Seriously, this is infrastructure that should be local to friendly nations. China is hard at work to make sure that they have the ability to import zero food as well as all of their equipment is from local sources. In doing that, they claim national security. Makes sense. But we should be doing the same.
    • Kids playing around on the internet tend to pick more interesting targets. Large multinational corporations, government organizations, that kind of thing. Try to imagine a kid saying, "Woo! I stuck it to the man! I struck a blow for freedom! I'm living dangerously! I'm such a badass because I just shut down a WATER PUMP IN ILLINOIS! FUCK YOU, ILLINOIS!"

      What I can imagine is a military official talking to the commander of a cyberwarfare unit in China, and saying, "So you say you could in theory launch cybe

      • by epic93 (1863952)

        Or... perhaps it's a cautious kid who knows that such high profile targets would be stupid to attack and wants to learn on something the mass population isn't as concerned about.

      • That is pretty much what I was thinking. In fact, another play on that, is by burning out the equipment early, then they get more sales. However, I suspect that it was what you were saying. That is why I think that finding this is actually an opportunity to fix things.
    • by Grelfod (1222108)

      We should have done that long long ago. Now we are behind the curve and have been infiltrated at every level with outsourced goods and services - that just screams screwed royal... meanwhile dumbass government will spent 10 more years debating it :/

  • by nimbius (983462) on Friday November 18, 2011 @02:42PM (#38102054) Homepage
    major federal crimes such as the collapse of the united states economy at the hands of wall-street, human trafficking between south america and north america, net neutrality compliance that is largely being ignored by major carriers, civil rights abuses in united states prisons, and protestor police brutality in major metropolitan cities, federal officials target their laser-like scrutiny upon the teeming cesspool of violent crime and evildoings that is Springfield Illinois. their objective? prove a small and unsubstantial water pump in a city of 116,000 people has been nefariously compromised and destroyed by cyber (attackers/hackers/criminals) from (china/iran/north korea/syria) in order to deprive american citizens of their shitty and unaccountably safe drinking water for an evening while the district manager oversees a few dozen pipefitters and welders as they replace a pump on a blustery november weekend.
    • Re: (Score:2, Offtopic)

      by couchslug (175151)

      They are ignored because the folks who post regarding them have inoperable or intermittent Caps Lock keys.

      This particular keyboard malfunction mimics the way the way paranoid nutjobs once typed when conspiracy theorists only had mimeographed newsletters with which to practice "samizdat".

      e.e. cummings was cool,

      http://en.wikipedia.org/wiki/E._E._Cummings [wikipedia.org]

      but he's fucking DEAD and anyone imitating that stylistic affectation (especially at length) needs to be.

      The only cure for "crazy" is to do a Hemingway (Ernes

    • by Sarten-X (1102295)

      The FBI (or rather, a group of people from it) is investigating a small problem, because it looks like the kind of small problem that can become a big problem later. Perhaps it's now a local water pump in Illinois, but next time it will be a coolant pump at a power plant. Logs from this incident may provide more information about an attack that the "real deal", if this is a practice intrusion.

      Given that the investigators knowledgeable about water control systems aren't likely to be the investigators knowled

      • by Kagura (843695)

        The FBI (or rather, a group of people from it) is investigating a small problem, because it looks like the kind of small problem that can become a big problem later. Perhaps it's now a local water pump in Illinois, but next time it will be a coolant pump at a power plant. Logs from this incident may provide more information about an attack that the "real deal", if this is a practice intrusion.

        Given that the investigators knowledgeable about water control systems aren't likely to be the investigators knowledgeable about risk-management accounting, human trafficking, civil rights politics, or the latest tactics for successfully negotiating with irrational group-thinking mobs, I think it's perfectly reasonable that they spend their time doing what they know. The federal officials aren't universally-adaptable masters of all things investigative. Each person has a particular set of skills, so it makes sense that they be split up doing many different things.

        No. I want these FBI agents working on a cure for cancer, and I want them on it yesterday!

        • by Sarten-X (1102295)
          Okay. We'll assign the cryptography and data recovery backgrounds to making a time machine, and when they're done we'll send back the water control agents to yesterday to work on curing cancer. The biologists will be sent to look for kidnapped kids.
  • Maybe one of the local citizens was just upset about low water pressure and decided to take matters into their own cyber-hands?

    It would be interesting if the system hacked was similar to the ones used for the hacked Iranian centerfuges, as both attacks involve spinning a motor too fast.

  • Live Free or Die Hard Reference. I'm the good guy here. I told them this could happen if they didn't prepare. Did I get a "Thank you"? They have been warned now we are all going to pay for their ignorance!
  • by stating_the_obvious (1340413) on Friday November 18, 2011 @02:48PM (#38102122)
    Perhaps it's time to start we stop believing that everything in the world needs to be connected to external networks.

    In the battle of the sword and the shield, the sword eventually wins, but it takes a hell of a lot longer when the sword and shield are separated by the moat and a thick stone wall...
    • Perhaps it's time to start we stop believing that everything in the world needs to be connected to external networks.

      Perhaps it's time to stop believing that everything in the world that goes wrong is due to a 'cyberattack'.

      • by idontgno (624372)

        Perhaps it's time to realize both statements are true and completely orthogonal to each other.

        Leaping to the conclusion that pump failure in a SCADA-controlled utility is cyberwar is foolish.

        Believing that anything remotely important should be connected to a publicly-accessible network is also foolish.

        Both skepticism, and air-gapped networks, are very good ideas.

    • by Pope (17780)

      I for one welcome our new stone wall making overlords!

    • by Mr. Freeman (933986) on Friday November 18, 2011 @03:15PM (#38102458)
      Perhaps it's time that people realize that a lot of things do need to be connected to external networks and that "air gap them" is simply a cop out response equivalent to saying "use a typewriter".

      Yes, some things should be air-gaped, nuclear gas centrifuges come to mind. However, many industrial control systems need to report information over the internet. Remote pumping stations, unmanned power distribution centers, etc. Having a lot of data is not simply a convenience. This data allows engineers to troubleshoot failures, predict future failures, and adjust systems for optimum efficiency.

      What's really necessary is for some kind of device that will communicate the data to remote places, but refuse to pass any messages from the outside onto the control system. I don't know how difficult this is, but it's certainly harder than "air gap it". On the other hand, this solution actually addresses the problem.
      • by idontgno (624372) on Friday November 18, 2011 @03:25PM (#38102590) Journal

        What's really necessary is for some kind of device that will communicate the data to remote places, but refuse to pass any messages from the outside onto the control system. I don't know how difficult this is, but it's certainly harder than "air gap it". On the other hand, this solution actually addresses the problem.

        So, what you're saying is, if a utility is too cheap to lay in dedicated network assets and buy their own blacknet (which is not hard to do if you want to), it's ok to just connect the the Internet?

        That said, the thing you're looking for is called a unidirectional network [wikipedia.org]. Back in my military network operations days, the colloquial name was "data diode". Data goes one way but nothing (no data, no handshakes, no signaling at all) goes the other way. In that environment, they were used to promote data from a lower-level security environment (say, Secret-only) to a higher-level one with no risk of leak-back.

        Yeah. They exist. They're considerably lower-bandwidth than your average gigabit Ethernet switch, but if you're just talking SCADA telemetry, they should suffice.

        • So, what you're saying is, if a utility is too cheap to lay in dedicated network assets and buy their own blacknet (which is not hard to do if you want to), it's ok to just connect the the Internet?

          Because all utilities are in developed areas and have tons of cash to burn, right? Natural gas utilities have equipment that must be monitored and/or controlled remotely that may not even have electric service in the vicinity, much less telephone or fiber optic cable, leaving satellite and cellular modems as their only options. Do you really think building a private WIMAX network or launching a satellite is within the budget of a local utility serving 25,000 customers? There is no doubt that many utiliti

          • by idontgno (624372)

            I know that it's not often acknowledged, but in the long run there's one ironclad rule, enforced with all the ruthlessness of natural selection: If you can't afford to do it right, you can't afford to do it at all.

            You don't tackle vast projects with half-vast security. You're just spending lots of money to embarrass yourself and let down people who depend on you, if you try.

            Security is not optional. All the impediments you described are merely challenges to engineer around. The only real insurmountable obst

            • Spoken like someone who has never worked in the real world. Life isn't black and white - real life decisions are made on a relative basis. Few organizations have the luxury of a DOD budget yet they still have to continue operating. You seem to equate "right" with "expensive". Whether a small co-op, statewide regulated utility, or publicly-traded mammoth, cost always has to figure into the equation. Business is about risk management, not spending unlimited dollars in search of the "perfect" solution.

              Security is not optional. All the impediments you described are merely challenges to engineer around. The only real insurmountable obstacle is not giving sufficient damn to actually try to overcome the other issues rather than handwaving them away as "too hard" or "too expensive."

              And

        • The other, much cheaper solution to this is to place a router that has ACL's allowing unidirectional udp traffic...
      • by Obfuscant (592200)

        However, many industrial control systems need to report information over the internet.

        Maybe over AN internet, but not over THE Internet. "Report information" is not the same as "allow incoming control or information."

        This can be as simple as a Lantronix XPort (or equivalent) tied to a serial port TX line on a secure machine, allowing telnet connections to read the serial data coming out but not send anything back. Or any terminal server with the RX lines cut.

        What you need to be careful of in the planning of this system is that the information coming out of the secure system isn't being f

  • gallons, towing it to China in huge bladders and hacking our cities' pumps?

  • by TheCarp (96830) <sjc AT carpanet DOT net> on Friday November 18, 2011 @02:51PM (#38102188) Homepage

    Lets face it, when they are putting out advisories actually advertising that one of the FBI's "Most Wanted" is some dude who blew up a package at a building, in the middle of the night, injuring noone, just so he could make some statement about "Animal Liberation".... you really have to wonder what the hell these people actually do for a living anyway.

    I mean.... if that dude is one of the top 10 threats out there.... then I think we can all relax.

    Quick, somebody find a tenuous link to terrorism so we can look relevant!

    • by Obfuscant (592200)

      Lets face it, when they are putting out advisories actually advertising that one of the FBI's "Most Wanted" is some dude who blew up a package at a building, in the middle of the night, injuring noone, just so he could make some statement about "Animal Liberation".... you really have to wonder what the hell these people actually do for a living anyway.

      You don't think that someone who would go to that extent to make that kind of statement is dangerous to the rest of us?

      People who plant bombs and blow things up are dangerous. Period. The fact that he managed not to kill anyone the first time he tried doesn't mean he won't the next. Even if he's not trying to blow people up, it happens. He can't know that an anaimal caretaker isn't visiting a sick animal that night, or doing some late night cleanup, for example. Maybe he screws up the timer and it goes of

      • by TheCarp (96830)

        I didn't say they weren't dangerous.

        See, I accept that there will always be some amount of danger. The question is not, are there dangerous people? Of course there are. Duh!

        The question is, are there so many, who are so dangerous, that we need to fund the FBI?

        I actually don't think so....case in point. When you add that their major achievements lately have been finding unstable people to radicalize, turn into terrorists, and arrest.... I think we have a whole pattern of "trying to look relevant", that seems

  • by slewfo0t (679988) on Friday November 18, 2011 @02:52PM (#38102206) Homepage
    As a controls engineer, I program these type of systems all the time. A simple incorrect setting for when the pumps turn on and off (Lead,Lag) could cause this type of problem. It could literally be a new operator that fat fingered a parameter in the SCADA system. To hack these systems requires specific knowledge of exactly what kind of control architecture is in place at the facility and then having the appropriate software to gain access to the control system. Not that this type of hack cannot be done, but it does require specific knowledge. This really sounds like operator error to me.
    • by ColdWetDog (752185) on Friday November 18, 2011 @03:04PM (#38102350) Homepage

      This really sounds like operator error to me.

      From TFA:

      But in its statement, the DHS said the water system was located in Springfield, Illinois.

      Springfield....

      Operator error....

      Something in the back [wikipedia.org] of my mind....

    • by Anonymous Coward on Friday November 18, 2011 @03:17PM (#38102480)

      Sort of. To program or configure the specific SCADA system requires specific knowledge of the device, installation architecture, firmware, and version supplied by the system operating manual. Until you get to the S part of SCADA and it all goes into some sort of aggregation platform with a big old GUI on a windows 2000 or windows XP box hooked into a cable modem.

      Well, to program them correctly requires that knowledge.

      These manuals are often trade secrets for the manufacturer, but are 'openly' passed around by maintenance technicians and field installers, and probably controls engineers such as yourself--although I never had the pleasure to work with one.

      Depending upon the organization, such manuals are often shipped to other third party contractors with a "legitimate need" as determined by an engineer or manager.

      When you tell them you have a corporate filter on PDFs, they will send to a personal email address if they would send it to start with. If they won't send it directly to you, their client will find a way to get their hands on it and forward it to you.

      These manuals contain relatively complex documentation--including ports, encoding types, bit masks, register sizes and addresses that may be remotely configured by a couple of pretty common protocols which tend to be "extended" by the vendor in odd ways.

      Sure, every bigwig in the industry has their own special program for everything that talks some proprietary clusterfuck. But mostly, they all have legacy support and some sort of shitty standard that will do basics.

      Admittedly, any piece of hardware may implement complicated control processes specific to the device at hand, but all of which (that I've seen) generally fall into about three different "protocol families" for control purposes once you're down to a sensor or switch. Maybe you can't calibrate the device over your basic serial port, but you can throw a relay with it.

      All of which I once wrote software for to control via plaintext text message at the demands of a former employer. Who insisted on static vendor passwords, and no encryption or even authorized whitelists to make our controllers easier and faster to install for subcontractors. Plug and Play. Or Pray. Or Plug and hacker prey. Whatever.

      Now, you can say it's operator error to use that device. But the bottom line is even in your wealthy industries that do readonly monitoring over encrypted VPN--sooner or later somebody insists on remote control in order to cut maintenance costs. The moment that happens, they're hooked up to hardware that might be 25 years old. And then they're gonna hire somebody with a cheap solution to plug into it.

    • by onepoint (301486)

      that's the same shit they said back in 1985ish when those hackers were moving satellites around. nothing is unhackable, sometimes it just takes more time to figure out.

  • by rudy_wayne (414635) on Friday November 18, 2011 @02:58PM (#38102268)

    the cyber attacker hacked into the water utility using passwords stolen from a control system vendor

    WTF?

    It's not hacking if you know the password.

  • by Gyorg_Lavode (520114) on Friday November 18, 2011 @03:03PM (#38102344)
    ...a hacked pump at a water station DOES NOT DESTROY THE COUNTRY.
    • by onepoint (301486)

      You are correct that a hacked pump does not destroy the country, but if it's a proof of concept, then 30000 hacked pumps around the country get ton's of people mad/upset/scared ...

      the best way to win a war is to starve the opponent into submission, getting rid of the water supply is a solid first step, getting rid of the food can turn it very violent quickly. For some reason people think lack of food = death quickly, which the real truth is lack of water = death quickly. so people will panic if there are fo

  • by fsckmnky (2505008) on Friday November 18, 2011 @03:15PM (#38102464)
    Connecting your water pumps to the public internet.

    Der der der.
  • I am soooo damn tired of word 'cyber' now. Used to be kind of a neat word, way back when it actually meant something.

  • Is all this crap attached to the intertubes?

    OK, now we don't even have to come into the office to change the position of the control rods and avert a meltdown, we can do it from home, or heck... Kazan, Russia if you really wanted to.

  • by Anonymous Coward

    Weiss said the report says the cyber attacker hacked into the water utility using passwords stolen from a control system vendor and that he had stolen other user names and passwords."

    In other words, people are not capable of understanding the situation they are in. Computers are mysterious, magical creatures, with pink tails and fluffy hair from which you can hold on when riding on the waves of the cyberspace holding a pink bunny, a packet of noodles and wearing the everlasting Viking helmet.

  • manuals for all this equipment on the the internets in conspicuous locations in the control network with special attention given to tolerances and acceptable operating parameters. So that hacker wont accidentally damage the critical infrastructure component they are the playing with.

    Heck, we may want to make more foolproof by publishing user dashboards, with very strict input checking, at playwithcriticalinfrastructure.com.

    It the responsible thing ...and knowing is half the battle.

  • This what out souring and useing vender systems get's you people who are not there and or see you as just a other client you want use to come out a look at a system out of it's window that's a added change.

  • Why such systems are online and accessible via the Internet? Is this a cost cutting measure? Why aren't critical passwords changed every week? Why isn't database information stored in encrypted containers or hard drives? Why does this happen again and again and again?

    Several stories online of laptops containing massive DB's get stolen, in fact a previous employed of mine (major chip manufacture) got one of their HR laptops stolen out of a car at Starbucks, I was sent a letter by said company giving the excu

  • I call bullshit. (Score:5, Informative)

    by Lumpy (12016) on Friday November 18, 2011 @04:32PM (#38103436) Homepage

    I have worked with SCADA and water filtration plant pumps, big ass pumps, like 650hp pumps that run on 7200volts.

    You cant set it to "burn out". you can adjust the speed of the pump from 10% to 100% the only way to kill a pump is to drop power to it without dropping power to it's valve so it will not close. wait for the pump to start spinning backwards from the water running back downhill through the pump and then slamming the power back on at 100% after the pump was free wheeling in reverse at full speed.

    Then they don't burn out, they freaking explode.

    This happened when we lost power plant wide and a hydraulic failure kept the valve from auto closing. (not electronic, it's a mechanical/hydraulic thing, a blockage in the pressure line)

    Unless the plant was designed by a utter moron and made it so a programming error could blow up parts of the plant.

  • From TFA (and the summary):

    "Weiss said the report says the cyber attacker hacked into the water utility using passwords stolen from a control system vendor and that he had stolen other user names and passwords."

    How likely is it that a control system vendor would have the usernames and passwords of their client, used in the actual production system? Maybe they actually do, as part of some sort of remote support agreement, but if this is the case, that's already a bad security practice.

    It seems more likely to me that the vendor has a list of default usernames and passwords, and THIS is what was obtained. Perhaps what Weiss *really* meant to say would be be something like: "Someone got

  • Joe Weiss is fairly notorious in the control system security world as the first to say, "Hey! That was a cyber incident!" For example, he said this about the BP spill, when they were still investigating it...and while it turned out to be true that some alarms were turned off because of computer issues, the real root causes had to do with faulty mechanical equipment and bad concrete, and that the cyber aspect was pretty much entirely irrelevant. Hear him speak, and it's a safe bet that you'll hear about h

  • by Anonymous Coward

    Most industrial control systems I've worked with (typically power plants) have their root passwords set to the same one from the OEM. They are rarely changed. Many of these HMIs are now networked on the company LANs to data historian servers. Sometimes there's a firewall, sometimes not. Most HMIs and historians are running a variant of Windows Server, with a few Unix flavors out there still.

  • Error is much more likely than malice, even if the computer is infected.

    In a place where the infrastructure is as wide-open and completely unprotected as it is in the US, there are much better targets that require much less investment of effort and expertise.

  • http://pastebin.com/Wx90LLum [pastebin.com]

    Not by me.

"Ignorance is the soil in which belief in miracles grows." -- Robert G. Ingersoll

Working...