Water treatment plant hacked, chemical mix changed for tap supplies | Hacker News Reader

Water treatment plant hacked, chemical mix changed for tap supplies

theregister.co.uk

145 pointsbifrost54 comments

The article deems as 'hacktivist' a group that 'changed the levels of chemicals being used to treat tap water.' This doesn't sound much like activism, defined by google as 'the policy or action of using vigorous campaigning to bring about political or social change' or 'hacktivism' as described on wikipedia which focuses on distribution of information, defacing websites, etc.

There is no mention of what chemical changes were made, but if malicious it sounds more like warfare or terrorism potentially targeting civilians. The subtitle is "Well, that's just a little scary", also quite an understatement.

> This doesn't sound much like activism

Yes it does; it's a perfect example of how "activist" (and by extension "hactivist") is being used in modern propaganda. Jacob Appelbaum very recently gave a rather... intense talk[1] that is about[2] this type of propaganda. As he explains:

    Let us address this concept of "activism", and it works like this.
    "Activism" is used as a pejorative term in order to suggest that
    participation in a democratic society is somehow outside of
    normal behavior.

> There is no mention

Stenographers publishing propaganda are not in the business of revealing facts.

[1] https://www.youtube.com/watch?v=KJValv4YQcY#t=78 (note: Jacob doesn't pull his punches, so this contains some strong language)

[2] It also has some disturbing new information about how The Guardian treated him, Poitras, Greenwald, and others.

Wow, now that's what I call Scorched Earth.

Personally, I'm one for trying to keep the personal attacks out of a rational discussion, but I recognize that sometimes going with emotion can work as well or better, depending on the audience. I'm also sure he views quite a bit of what he's talking about as personal attacks on himself as well.

I'm sad now that I didn't see it when you posted it a few days ago, and couldn't do my small bit to nudge it to the front page.

That speech was amazing. I had the Guardian in high regard, I'm kinda disappointed.

Awesome speech, very moving.

Arguably since little harm was done the net outcome should be positive, as it draws further attention to the security weaknesses in modern infrastructure. Personally, whether or not I would call it "hacktivism" would be dependent on whether or not that positive outcome was intentional. The article doesn't really seem to have any evidence either way.

Article mentions some Syrian connection to attackers. I don't understand why the writer used the 'hacktivist' word here.

It really boggles my mind that we don't air-gap every single one of these types of critical systems.

Can someone help me understand why this isn't more popular? Is it because they requirement controls from outside resources? Or maybe there's central places that rely on telemetry?

Another option: outgoing UDP packets only. Outgoing telemetry but nothing comes back in.

Management wants it done, done cheaply, with cheap support, and sometimes plugging into their dashboards. Clive Robinson, who did SCADA, said those things combine to make security nonexistent to afterthought in most installations.

I'll add a lesson from software world that it also pays to contract steady fixes over time instead of near-perfect the first time. That might partly be because people in such industries only make sacrifices after shit hits the fan publicly. See Target for example. ;)

Of course.. you /expect/ that to happen, which is why you establish an internal auditing process.

"The Bowman Avenue Dam in this low-key suburban village in Westchester County is … about the width of a modest living room, and the 20-foot-tall dam itself essentially keeps a babbling creek, the Blind Brook, from flooding basements and ground floors in houses downstream.

Yet, according to the authorities, it was the computer-guided controls of this dam that seven Iranian computer hackers chose to penetrate on behalf of that country’s Revolutionary Guards Corps, as part of a plot that also breached or paralyzed 46 of the nation’s largest financial institutions and blocked hundreds of thousands of customers from accessing their bank accounts online.

It's weird how the news that agents of a foreign government were attempting to sabotage American infrastructure, which is -- I realize this is an antiquated notion nowadays -- an act of war, is received with shrugs and yawns and no real action. Imagine the screaming worldwide if hackers working for the CIA were breaking into Iranian dams and financial institutions.

Imagine the screaming worldwide if hackers working for the CIA were breaking into Iranian dams and financial institutions.

They broke into the Iranian nuclear program without much condemnation, so...

I recall a lot of wailing about how irresponsible they were deploying their sinister infrastructure-damaging war viruses, and such. But thinking about it more, I'll grant it depends on your perspective of the whole issue, so my point doesn't really stand.

I still find it dismaying that we so casually accept this state of affairs. There is no meaningful difference between attacks like this and a foreign agent setting fire to the bank building or physically sabotaging the dam.

There was some wailing from the computer security community, but nothing in the world of international diplomacy. And I'm sure that's why the USA isn't kicking up a fuss over this latest incident -- they want to avoid setting a precedent which would come back to haunt them the next time they're caught doing the same thing.

The US's cyber attacks on foreign countries are certainly the most funded and advanced campaigns of their kind. For reference here are the wikipedia pages of two of the most public pieces of malware your tax dollars have produced:

https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Flame_(malware)

Both of these were directed primarily at Iran. And that second one, flame, has been described as "the most complex malware ever found."

> the news that agents of a foreign government were attempting to sabotage American infrastructure, which is -- I realize this is an antiquated notion nowadays -- an act of war, is received with shrugs and yawns

War is a big deal. You can't just rely on something meeting an old formal definition of "act of war"; to cause a war, there's got to be a risk of more damage (by some accounting) than we would do to ourselves by going to war.

https://en.m.wikipedia.org/wiki/Stuxnet

Don't you remember Stuxnet? That is exactly what the us was doing! Surely it's been deniable, but who do you think did it?

This is a long-standing issue that a lot of people are aware of but fixing it is difficult. I've written and presented on the topic a few times, see: https://blog.shodan.io/state-of-control-systems-in-the-usa-2...

"It really boggles my mind that we don't air-gap every single one of these types of critical systems."

I would go even further.

To air-gap something implies that you are breaking the physical link that it could interact on the network with.

I would suggest that these systems should not have networking capabilities at all. The controllers for a dam, or power plant, or (insert critical infrastructure here) should not have networking hardware or even a networking stack.

This implies that if you want to open or shut part of your dam, some guy with muscles has to go out and physically move the relevant parts. It won't work at all for heavy things, or things in inaccessible locations (dams are both of these, actually).

If you want someone to be able to adjust the dam, without putting out the physical effort required to make the adjustment, you need to network the dam. That way, the person can send a signal (easy) and a machine that's able to do the work can receive the signal and do the work (hard).

The most you can do is ensure that signals from the internet (or anywhere offsite) can't reach the dam. You need onsite signals.

There is still a question of how complex the network is. One could argue that an IP based network stack is unnecessarily complex, and we should use a simpler system to improve reliability and security. In concept, the "network" could be nothing more than dumb wires connected to DIO and PWM ports.

Oh, agreed.

"This implies that if you want to open or shut part of your dam, some guy with muscles has to go out and physically move the relevant parts. It won't work at all for heavy things, or things in inaccessible locations (dams are both of these, actually)."

Yes, that is exactly what it implies.

This brings with it two very important and extremely valuable effects:

First, it means there is a human observing, on a regular basis, the behavior of the system - someone "has a feel" for how things work and can (with the intellect and perception of a human brain) "sense" when something is not right.

Second, it means, in the Taleb sense, that someone has "skin in the game". In the same way that I would be very disturbed if a commercial airliner had remote pilots, I would be similarly disturbed if a dam or a power plant had remote operators.

Finally, this human, locally present operator or operators probably shouldn't have Internet access - even on personal devices. There's no reason for it and it only adds risk and attack vectors. If you run the nuclear plant you can check twitter when you get home.

I think you missed the part of my point where this can't be done. You can't hire someone to go open the dam himself and be crushed by the water that comes out. Nor can you hire people to move things that are too heavy for a person, or 100 people, to move.

Yes, certainly I am not suggesting that we sacrifice humans to go open the sluice gates manually.

I am talking about doing it without computers. These things were done prior to computers with relays and switches and even status lights and a monitoring board, etc.

I'm advocating that we take out all of the general purpose capabilities as well as the ability to interoperate. A human being flicks a switch.

We'd have to add a secondary remote interlock capability to prevent an out of control operator from doing something aberrant. Infrastructure without automation is hopefully dead, we just need to be smarter about how we accomplish it.

"Infrastructure without automation is hopefully dead"

No, no ... the "without automation" part is the entire point.

If a system is automated, then nobody has skin in the game - the way the pilot and copilot of your airplane do. The outcomes we want are the outcomes we get when the operator is the first one to go if something goes wrong.

It is in that interaction that we can rely on the (amazing, irreproducible, beautiful) ability of the human brain to recognize patterns and make brilliant deductive leaps.

That's just the very thing we want.

I've worked in utilities before, and sometimes it's not possible to airgap those systems. After all, someone needs to login and update and performance maintenance on those SCADA systems. And it's pretty expensive to fly those people in, and sometimes not possible.

But there are optical routers that guarantee one way only access to networks. My favorite method is a switch, with the power supply connected to a physical timer. Once the time's up, the power supply is cut, and that device no longer is accessible. Quite ingenious really.

Wouldn't a signed update disk be cheaper to fly?

For what it's worth, the pseudonym Kemuri is Japanese for smoke.

There was a recent incident in the UK where too much chlorine was added to the water supply, leaving it unsafe even for washing. I wonder if it's connected?

http://www.bbc.co.uk/news/uk-england-derbyshire-35786378

That's why I followed this link tonight, as that incident hasn't yet been explained. It caused widespread panic in a matter of hours. Perhaps simple to flush the system once, but that would be unsustainable in the long run. It's like a public services denial of service.

I don't think so. That does look like a rather good fit, especially as the BBC article states quite clearly that the chlorine overdose was spotted due to monitoring alarms, just like the Verizon article states.

But Verizon claims the valves were manipulated to "no particular effect" which doesn't seem credible if it required a full system flush and a do-not-use to be posted.

Also Severn Trent has 4.6 million customers, not 2.5 million.

Not the same incident, no, but could it be connected?

Fortunately, based on alert functionality, KWC was able to quickly identify and reverse the chemical and flow changes, largely minimising the impact on customers.

The affected only lost most of their hair.

I call BS. There are no facts revealed here other than some boogie man story telling about, none other than a Syrian hacking group (during the Cold War, this would have been the USSR instead of implying ISIL).

The whole thing reads like an advertisement for Verizon Security and Splunk.

So possibly a state actor doing reconnaissance? They get in, they verify they have control by making a change they think won't be noticed, and they add it to their list of nasty things to do when the war starts...

Remember the recent Ukrainian power outage hack? http://arstechnica.com/security/2016/02/hackers-did-indeed-c...

> It seems the activists lacked either the knowledge of SCADA systems or the intent to do any harm.

So it's a kid, not a state.

Not necessarily, if you were probing you would do so in a way that didn't indicate your true intentions.

Sounds like it started with a pretty simple SQL injection attack, any script kiddie could have done that. Then poking around they found something like control_system_passwords.txt somewhere on the web server and went from there. Not exactly state-actor skilz required.

If it was compromised via SQLi, it's likely a lower-tech group.

But even fairly advanced attackers don't necessarily know their way around SCADA systems. nor have the resources to take control of often very tech-specific PLC's

Guys this is why we need backdoors, so it happens more often, oh wait

I genuinely believe that where software has the direct ability to cause physical harm, there ought to be revocable professional accreditation for at least one programmer on the development team. Likewise for systems security on-site.

Actually, I'd be interested to know if things like ISO27001 are mandatory for these sorts of facilities. And who gets in trouble if the system fails.

I'm afraid ISO27001 guarantees very little. Specifically, in my (limited) experience these kinds of programs/accreditations only look at a few data points in the company where reality covers hundreds of data points, and only in a brief period. Nothing stops people inside the organization from not complying with the rules, and nobody actually verifies that the right people in the organization actually know the rules.

I'd go higher than that. whoever defined the specifications of the project, should've included security as a key component.

Of course, there also has to be budget and time allowances to actually make it happen.

Every time I hear a story like this I am amazed. The cause of this is not complex or difficult. It's basic stuff.

Any idea where this happened, even what country it happened in? I can't make sense of that from the article. I'm guessing we're talking the U.S.

As long as it only affects people who didn't vote for the governor, it's not the government's problem.

Take all utility like infrastructure control systems off the internet (Gas, Water, etc...)

The developer machines are still (by necessity) connected to the Internet.

It's not necessary: it's just convenient or more profitable. There's guards, link encryptors, authenticated networking, and OSS knockoffs of above to either reduce risk of or probably prevent malice from hitting on-site computers.

They're just not applied by most because people paying don't give a shit. Any high-security engineer doing SCADA or site-to-site for big companies will probably tell you so.

the best part is that this is somehow verizon's fault.

Hope they stopped the flow of fluoride. Forced medication isn't ethical and it's been shown to have no effect on dental health.

And naturally you've based your understanding of such things on studies and have references to share?

Reply on news.ycombinator.com