Someone attempted to poison water supply in Florida city during hack | Hacker News Reader

Someone attempted to poison water supply in Florida city during hack

tampabay.com

85 pointsilamont15 comments

Dup of this submission: https://news.ycombinator.com/item?id=26070262

> "But at about 1:30 p.m. the same day, Gualtieri said, someone accessed the system again. This time, he said, the operator watched as someone took control of the mouse, directed it to the software that controls water treatment, worked inside it for three to five minutes and increased the amount of sodium hydroxide from 100 parts per million to 11,100 parts per million."

who wants to bet this might have been as simple as improper usage/implementation of Teamviewer gone wrong?

when dealing with persons/organizations who are not focused on infosec/netsec issues, given the opportunity and ability to do so, never underestimate the workarounds and kludges that people will install to "make their job easier", such as putting teamviewer on control system PCs running water systems.

According to this Reuters article posted in the other thread about this, the vector was Teamviewer: https://www.reuters.com/article/us-usa-cyber-florida-idUSKBN...

RDP exposed on municipal water control systems? are you fucking kidding me?

Jives with my experiences working in consulting and on the vendor side of things, honestly. Systems that don't have any practical need for air gaps always seem to be air-gapped, and systems that probably should be air-gapped often aren't.

Not the first time I've seen something like this.

Why this city you ask?

Well the superbowl was being played that weekend a few miles away on Sunday and so there was a large amount of media and visitors in town for the game(also heavy national coverage). Glad they reverted it as who knows what would have happened if left unchecked.

Also, more likely, they were not running more complex and secure SCADA systems.

Well modbus and dnp3 don't exactly have any TLS involved by default is all I'm going to say about this comment.

I assume water treatment plants are considered critical infrastructure and have regulations to prevent unauthorized access.

Either someone messed up, or there is a resourceful attacker.

The regulations are not as locked down as you would expect. Think less:

* Remote access to systems that could kill people must be limited to people with the following thought out permissions and secured credentials

And more:

* The list of people who can access this system must be documented

* The accounts must have their password be changed every 6 months

* A committee must review the set of outstanding patches and upgrades for known issues every 4 months and prioritize what to fix

* I hope that someone is actually installing those patches and upgrades.

All the patches and upgrades in the world won't help if some dingbat installs TeamViewer and leaves it running.

I can imagine that especially during covid, there might have been some substantial convenience to having teamviewer on that computer system. Not justifying it's presence, but I do think this is a failure of IT not finding a way to make access to the system both secure and convenient.

Yeah, the IT person who is there Tuesdays and Thursdays, and helps plug unplugged mice in.

Surely they'll be capable of configuring a corporate VPN without a fat budget to have Cisco do it for them...right?

The implications of such a thing could have been terrifying and tragic. Goes to show that you should never be overconfident about or underestimate the security of your computer systems. Especially if you are a critical government agency. I hope they've learned their lesson about having a cybersecurity plan and system backups in place, instead of hubris. They avoided the consequences this time, but next time it could be too late.

Reply on news.ycombinator.com