Compromising vital infrastructure: water management

guest · Apr 1, 2019

Compromising vital infrastructure: water management
April 1, 2019
https://blog.malwarebytes.com/secur...mising-vital-infrastructure-water-management/

It’s probably unnecessary to explain why water management is considered part of our vital infrastructure, but it’s a wider field than you might expect—and almost every one of its components can be integral to our survival.

Water management is considered so critical that tampering with a water system is a US Federal Offense (42 U.S.C. § 300i-1).
Yet, cybercriminals have found ways to compromise these vital systems as well. Let’s take a look at their methods of attack.
Click to expand...

FanJ · Apr 2, 2019

mood said: ↑

Compromising vital infrastructure: water management
April 1, 2019
https://blog.malwarebytes.com/secur...mising-vital-infrastructure-water-management/
Click to expand...

Good article by @Pieter_Arntz
Thanks Pieter!

=====

Recently The Netherlands Court of Audit (Algemene Rekenkamer) has looked at the cyber security of critical water structures in the Netherlands and found it to be not watertight. And that in a country where water management is so important.
In English: Strengthening the digital defences: the cyber security of critical water structures
https://english.rekenkamer.nl/publi...e-cyber-security-of-critical-water-structures
In Dutch: Digitale dijkverzwaring: cybersecurity en vitale waterwerken
https://www.rekenkamer.nl/publicati...erzwaring-cybersecurity-en-vitale-waterwerken

zapjb · Apr 1, 2019

***** Flint Michigan still doesn't have clean water. I am ashamed of my country.

guest · Apr 27, 2020

Israel Thwarts Major Coordinated Cyber-Attack on Its Water Infrastructure Command and Control Systems
April 26, 2020
https://www.algemeiner.com/2020/04/...r-infrastructure-command-and-control-systems/

Israel thwarted a major cyber-attack on its water infrastructure over the weekend.

In a statement, Israel’s National Cyber Directorate announced, “Reports have been received by the National Cyber Directorate about attempted attacks on command and control systems of wastewater treatment plants, pumping stations, and sewage.”
The Directorate called on the relevant companies and institutions to change their internet passwords immediately, reduce their internet connections, and ensure they were updated to the latest versions of their control software.

Israeli daily Yediot Ahronot reported that the Directorate and Israel’s Water Authority issued a follow-up statement saying that the attempted attacks were “handled” and “it should be emphasized that there was no damage to the water supply.”
Click to expand...

guest · May 10, 2020

mood said: ↑

Israel Thwarts Major Coordinated Cyber-Attack on Its Water Infrastructure Command and Control Systems April 26, 2020
Click to expand...

Scoop: Israeli security cabinet held secret meeting on unusual Iranian cyberattack
May 9, 2020
https://www.axios.com/israeli-security-iranian-cyberattack-c9218bc3-9819-4de4-8097-9d19a9437d8a.html

The Israeli security cabinet held a top secret meeting on Thursday to discuss a highly unusual Iranian cyberattack against Israeli civilian water infrastructure that took place two weeks ago, Israeli officials tell me.

Fox News first reported on Thursday that Iran was behind the cyberattack. According to the report, the Iranians used computer servers located in the U.S. to attack the Israeli water facilities.
The Israeli government will now have to decide if and how to retaliate. A cyberattack against Iranian targets could be one such act of retribution.
Click to expand...

guest · May 28, 2020

Israeli Cyber Chief: Major Attack on Water Systems Thwarted
May 28, 2020
https://www.securityweek.com/israeli-cyber-chief-major-attack-water-systems-thwarted

Israel’s national cyber chief Thursday officially acknowledged the country had thwarted a major cyber attack last month against its water systems, an assault widely attributed to arch-enemy Iran, calling it a “synchronized and organized attack” aimed at disrupting key national infrastructure.

“If the bad guys had succeeded in their plot we would now be facing, in the middle of the Corona crisis, very big damage to the civilian population and a lack of water and even worse than that,” he added.
But Unna said the attempted hacking into Israel’s water systems marked the first time in modern history that “we can see something like this aiming to cause damage to real life and not to IT or data.”
Click to expand...

guest · Jul 17, 2020

Israeli Water Infrastructure Hit Again by Cyberattacks
July 17, 2020
https://hamodia.com/2020/07/17/israeli-water-infrastructure-hit-cyberattacks/

The cyberattacks on Israeli infrastructure continue, with the Israeli Water Authority confirming on Thursday that another cyberattack targeted two Israeli water infrastructure facilities this week.

According to officials, the attacks were aimed at agricultural water pumps in the Upper Galilee and infrastructure in the center of the country.

The hacks did not cause any damage, the authorities said. “These were small specific drainage facilities in the agricultural sector, that were immediately and independently repaired by the local authorities. It did not cause any damage to the service, and had no real effect,” the Water Authority said in a press release.
That attack also reportedly resulted in no damage but was said to have left the Israeli defense establishment outraged as it targeted civilian infrastructure.
Click to expand...

guest · Oct 26, 2020

Over 100 irrigation systems left exposed online without a password
October 26, 2020
https://www.zdnet.com/article/over-100-irrigation-systems-left-exposed-online-without-a-password/

More than 100 smart irrigation systems were left exposed online without a password last month, allowing anyone to access and tamper with water irrigation programs for crops, tree plantations, cities, and building complexes.

The exposed irrigation systems were discovered by Security Joes, a small boutique security firm based in Israel.
All were running ICC PRO, a top-shelf smart irrigation system designed by Motorola for use with agricultural, turf, and landscape management.
NOT RELATED TO THE APRIL CYBERATTACKS
Naor's findings come after earlier this year the Israeli government said that Iranian hackers breached water management systems across Israel and tried to alter water levels. Luckily, the breached systems managed only agricultural pumps, most likely linked to irrigation systems.
Click to expand...

Naor said the irrigation systems he discovered last month were not linked to this April's incidents.
"These systems were found by our monitoring rules that search for open administrative panels in Israel," Naor told ZDNet.
Click to expand...

guest · Dec 4, 2020

Iranian Hackers Access Unprotected ICS at Israeli Water Facility
December 4, 2020
https://www.securityweek.com/iranian-hackers-access-unprotected-ics-israeli-water-facility

According to industrial cybersecurity firm OTORIO, the hackers accessed a human-machine interface (HMI) system that was directly connected to the internet without any authentication or other type of protection. The target was apparently a reclaimed water reservoir.

“This gave the attackers easy access to the system and the ability to modify any value in the system, allowing them, for example, to tamper with the water pressure, change the temperature and more. All the adversaries needed was a connection to the world-wide-web, and a web browser,” OTORIO said in a blog post.
Cybersecurity professionals have long warned that malicious actors could cause serious damage to organizations in the energy and water sectors by targeting exposed HMIs.
Click to expand...

OTORIO’s Even told SecurityWeek that Israel’s water and water treatment facilities are generally secure, but noted that private facilities such as the one targeted earlier this month are “very loosely regulated and can be an easy target for attackers.”
Click to expand...

guest · Jun 21, 2021

Water Sector Security Report Released Just as Another Water Plant Hack Comes to Light
June 21, 2021
https://www.securityweek.com/water-...sed-just-another-water-plant-hack-comes-light

The Water Sector Coordinating Council describes itself as “a policy, strategy and coordination mechanism for the Water and Wastewater Sector in interactions with the government and other sectors on critical infrastructure security and resilience issues.”

The organization in April surveyed 606 individuals working at water and wastewater utilities in the U.S. to get a better understanding of the sector in terms of cybersecurity.
Click to expand...

According to the report made public on June 17, 356 of respondents said they did not experience any IT security incident in the past year. Three respondents said they experienced 5 or more incidents and 83 reported 1-4 incidents in the last 12 months.

When it comes to cyber incidents involving operational technology (OT) systems, 410 respondents reported no incidents, 25 said they experienced 1-4 incidents, and one organization admitted suffering 5 or more incidents.
The same day the report was published, NBC News revealed that a hacker attempted to poison an unnamed water treatment plant that serves parts of the San Francisco Bay Area on January 15.
Click to expand...

The 22-page report released last week by the Water Sector Coordinating Council contains some interesting information on the cybersecurity needs and challenges of this sector in the United States.
Click to expand...

Cybersecurity - 2021 State of the Sector - Water and Wastewater Systems
(PDF): https://www.waterisac.org/system/files/articles/FINAL_2021_WaterSectorCoordinatingCouncil_Cybersecurity_State_of_the_Industry-17-JUN-2021.pdf

guest · Jun 23, 2021

How Cyber Safe is Your Drinking Water Supply?
June 21, 2021
https://krebsonsecurity.com/2021/06/how-cyber-safe-is-your-drinking-water-supply/

Amid multiple recent reports of hackers breaking into and tampering with drinking water treatment systems comes a new industry survey with some sobering findings: A majority of the 52,000 separate drinking water systems in the United States still haven’t inventoried some or any of their information technology systems — a basic first step in protecting networks from cyberattacks.

The Water Sector Coordinating Council surveyed roughly 600 employees of water and wastewater treatment facilities nationwide, and found 37.9 percent of utilities have identified all IT-networked assets, with an additional 21.7 percent working toward that goal.
Click to expand...

According to the water sector report, a great many of the nation’s water utilities are subject to economic disadvantages typical of rural and urban communities.

“Others do not have access to a cybersecurity workforce,” the report explains. “Operating in the background is that these utilities are struggling to maintain and replace infrastructure, maintain revenues while addressing issues of affordability, and comply with safe and clean water regulations.”

As the recent hacking incidents above can attest, enabling some form of multi-factor authentication for remote access can blunt many of these attacks.
However, the sharing of remote access credentials among water sector employees may be a contributing factor in these recent incidents, since organizations that let multiple employees use the same account also are less likely to have any form of multi-factor enabled.
Click to expand...

guest · Jul 22, 2021

Witnesses Ring the Alarm on Water Infrastructure Cybersecurity
July 21, 2021
https://www.meritalk.com/articles/witnesses-ring-the-alarm-on-water-infrastructure-cybersecurity/

Recent hacks on localities’ water supply have shown the importance of cybersecurity in the water infrastructure. Witnesses sounded the alarm about water infrastructure cybersecurity and called for training and funding investments at a July 21 Senate Environment and Public Works Committee hearing.

“The 16 critical infrastructure sectors are not equally equipped when it comes to cybersecurity there are leaders like the financial services sector, and there are quite frankly laggers,” Cyberspace Solarium Commissioner Rep. Mike Gallagher, R-Wis., told the committee. “Despite the importance of our water systems, the water and wastewater infrastructure sector lags behind many of its peers, posing a risk to our public health and safety.”
This is not the first time the commission has raised the issue of water infrastructure cyber insecurity. In addition to a March 2020 report it sent to Congress raising the issue, other members of the commission raised the issue again at an event this May.
Click to expand...

“We need help in the form of technical assistance on how to best implement the newest and most advanced cyber protection actions for our specific water infrastructure as opposed to a regulatory construct. Additional federal regulation of cybersecurity in water supplies is not the appropriate policy because local governments are eager to adopt the best cyber policies,” Oberton said in written testimony. “We need help, not enforcement.”
Click to expand...

guest · Aug 15, 2021

In a first for Maine, ransomware hackers hit two public wastewater plants
August 15, 2021
https://www.themainemonitor.org/in-...are-hackers-hit-two-public-wastewater-plants/

The Department of Environmental Protection has warned municipalities and water-sector professionals to be on alert after two recent ransomware intrusions, believed to be the first on wastewater systems in Maine.

The attacks occurred in the Aroostook County town of Limestone and the town of Mount Desert on Mount Desert Island, said Judy Bruenjes, a wastewater technical assistance engineer for the DEP.

“They were both fairly minor, there was no threat to the public, there was no violation, no excursion, no health and safety threat. It wasn’t like the Colonial pipeline, but it was a concern for us that these small facilities were being targeted,” said Bruenjes.
Click to expand...

State officials warn that the attacks should be taken seriously.

“Cyberattacks on wastewater infrastructure can cause significant harm,” warned Brian Kavanah, director of the DEP’s Bureau of Water Quality, in a July 8 memo.
He said attacks can do serious damage by overriding alarms, disabling pumps and equipment, interrupting treatment, or exposing personal and financial information.
Click to expand...

guest · Oct 14, 2021

Ongoing Cyber Threats to U.S. Water and Wastewater Systems Sector Facilities
October 14, 2021
https://us-cert.cisa.gov/ncas/curre...hreats-us-water-and-wastewater-systems-sector

CISA, the Federal Bureau of Investigation (FBI), the Environmental Protection Agency (EPA), and the National Security Agency (NSA) have released a joint Cybersecurity Advisory (CSA) that details ongoing cyber threats to U.S. Water and Wastewater Systems (WWS) Sector. This activity—which includes cyber intrusions leading to ransomware attacks—threatens the ability of WWS facilities to provide clean, potable water to, and effectively manage the wastewater of, their communities. The joint CSA provides extensive mitigations and resources to assist WWS Sector facilities in strengthening operational resilience and cybersecurity practices.
Click to expand...

CISA has also released a Cyber Risks & Resources for the Water and Wastewater Systems Sector infographic that details both information technology and operational technology risks the WWS Sector faces and provides select resources.
Click to expand...

guest · Oct 25, 2021

Kansas Man Admits Hacking Public Water Facility
October 25, 2021
https://www.securityweek.com/kansas-man-admits-hacking-public-water-facility

The man, Wyatt Travnichek, 23, of Lorraine, was an employee of the Ellsworth County drinking water treatment facility between January 2018 and January 2019.

As part of his role with the facility, he would use a remote login system to monitor the plant after hours, according to documents presented in court.
In March 2019, two months after resigning his position at the Post Rock Rural Water District, Travnichek used the same remote login system to shut down the facility and turn one of its filters off.

“Protecting America's drinking water is a top EPA priority. EPA will continue our focused efforts with DOJ and the states as we investigate and pursue any threats that might be directed toward vital community drinking water resources,” said Lance Ehrig of the Environmental Protection Agency’s Criminal Investigation Division in Kansas.
Click to expand...

Travnichek pleaded guilty to damaging a computer during unauthorized access and to tampering with a public water system. The EPA and the FBI recommend a sentence of 12 months and one day in prison.
Click to expand...

guest · Nov 11, 2021

Hackers undetected on Queensland water supplier server for 9 months
November 11, 2021
https://www.bleepingcomputer.com/ne...ueensland-water-supplier-server-for-9-months/

Hackers stayed hidden for nine months on a server holding customer information for a Queensland water supplier, illustrating the need of better cyberdefenses for critical infrastructure.

SunWater is Australian government-owned water supplier responsible for operating 19 major dams, 80 pumping stations, and 1,600 miles long pipelines.
Click to expand...

While the report doesn't name the entity directly, ABC Australia questioned the authority and confirmed it was SunWater.

The breach occurred between August 2020 and May 2021, and the actors managed to access a webserver used to store cutomer information by the water supplier.
It appears that the hackers weren't interested in the exfiltration of sensitive data, as they instead just planted a custom malware to increase visitor traffic to an online video platform.
Click to expand...

The report underlines that the actors compromised the older and more vulnerable version of the system, leaving the modern and far more secure web servers untouched.
Finally, the report raises the issue of the lack of proper account security practices, such as giving users minimum access required to perform their jobs.
A widespread problem
The auditors examined the internal controls of six water authorities in Australia and found deficiencies in three without naming them specifically.

From the absence of anti-fraud safeguards that would secure financial transactions from BEC actors to the presence of numerous vulnerabilities in IT systems, the report highlighted several key issues.
Click to expand...

guest · Aug 5, 2022

Giving water sanitation inspectors cybersecurity oversight is a mistake, say industry groups, experts
August 5, 2022

A White House announcement that the Environmental Protection Agency will delegate cybersecurity regulation for state water utilities through local sanitation inspections is receiving a growing amount of pushback from industry groups and cybersecurity experts.

The decision follows months of public dispute between the water sector and the EPA over how to adequately monitor the water supply for cyberthreats, an increasing concern following cyberattacks on water facilities in California and Florida.
Click to expand...

Enforcing cybersecurity regulations across the vast water sector is no small undertaking. Industry officials say there are 51,000 drinking water systems nationwide and an estimated 85 percent of water companies are municipal and sometimes very small.

By not tailoring the approach to better assess and confront different utilities’ cybersecurity needs, and by relying on workers untrained in cybersecurity to carry out audits, industry groups say the EPA could be setting up a system that misses cyberattacks.

“There is not the skill sets to go audit these [utilities] and there’s not a large set of cybersecurity skill sets in general, let alone in every single state [sanitation department]. I think it’d be impossible to pull this off.”
An EPA spokesperson said in a statement that it is “evaluating all of its options” to strengthen the sector’s cybersecurity posture.
Click to expand...

Lee from Dragos said it’s a thorny dilemma, particularly with so many utilities facing vastly disparate challenges based on their size and funding.
Utilities “don’t have the resources to do cybersecurity today so just telling them that now they must, and they must do it through regulation, still doesn’t change the economic situation,” Lee said.
Click to expand...

guest · Aug 16, 2022

Hackers attack UK water supplier with 1.6 million customers
August 16, 2022

South Staffordshire Water, a company supplying 330 million liters of drinking water to 1.6 consumers daily, has issued a statement confirming IT disruption from a cyberattack.

As the announcement explains, the safety and water distribution systems are still operational, so the disruption of the IT systems doesn’t impact the supply of safe water to its customers or those of its subsidiaries, Cambridge Water and South Staffs Water.

“This is thanks to the robust systems and controls over water supply and quality we have in place at all times, as well as the quick work of our teams to respond to this incident and implement the additional measures we have put in place on a precautionary basis,” explains the statement published on the company’s site.
Click to expand...

Clop misidentifies victim?
Meanwhile, the Clop ransomware gang claimed Thames Water as their victim via an announcement on their onion site today, alleging to have accessed SCADA systems they could manipulate to cause harm to 15 million customers.

Thames Water has officially disputed these claims via a statement today, saying that reports of Clop having breached its network are faux and that its operations stay at full capacity.
Click to expand...

One key detail in the case is that among the published evidence, Clop presents a spreadsheet with usernames and passwords, which features South Staff Water and South Staffordshire email addresses.
Additionally, BleepingComputer observed, one of the leaked documents sent to the targeted firm is explicitly addressed to South Staffordshire PLC.
Click to expand...

guest · Nov 8, 2022

Water sector in the US and Israel still unprepared to defeat cyber attacks
By Pierluigi Paganini - November 7, 2022

Ariel Stern, a former Israeli Air Force captain, warns that the US and Israel are still unprepared to defeat a cyber attack against the water sector that could be orchestrated by enemy states like Iran.
Click to expand...

Stern highlighted the dangers for providers of critical infrastructure and issued his warning following the ransomware attack that in august disrupted the IT operations of South Staffordshire Water, a UK company supplying drinking water to 1.6M consumers daily.

“He flagged that the main adversary in this sphere for Israel is Iran, but cautioned that even after past cyber attacks on Israel’s and America’s water sector in recent years, “we don’t have top minds in the water industry.”” reported The Jerusalem Post. ““Most water sector workers are civil engineers. How can they ignore it [cyber dangers]? They are very sophisticated within their domain relating to pipes, water flows, ground stabilization and chemistry,” but not with regard to blocking hackers.”
A cyber attack against a water facility or an organization in the water sector could have a widespread impact because many infrastructures serve wide areas including many cities and states, and protecting them it is not easy.
Click to expand...

Another factor that exposes the water sector to cyber attacks is the increasing technological penetration, more automation implies more systems potentially affected by vulnerabilities.

He added that the US government is delaying in putting out an order that everyone must comply with a given cybersecurity standard.
Many organizations in the industrial water sector continue to use low-quality systems.
Click to expand...

guest · Nov 10, 2022

NIST proposes project to improve cybersecurity at water utilities
By Dave Nyczepir @DaveNyczepir | Fedscoop - November 9, 2022

The National Institute of Standards and Technology wants feedback on a proposed project that would pilot solutions to common cybersecurity risks faced by water and wastewater plants.
Click to expand...

Run out of the National Cybersecurity Center of Excellence, the project would profile commercially available asset management, data integrity, remote access and network segmentation solutions to develop a reference architecture for the sector.

The pilot would respond to concerns heightened last year after a hacker remotely accessed a computer at a water treatment plant in Oldsmar, Florida and attempted to increase the lye in the water supply to dangerous levels.

“There is apparent general consensus from WWS stakeholders that additional cybersecurity implementation references are needed to assist in the protection of its critical infrastructure,” reads the project description, which is open for public comment until Dec. 19. “The advancement of network-based approaches, together with an ongoing increase in cyber threats, merit the need for sector-wide improvements in cybersecurity protections.”
Click to expand...

The NCCoE will create a pilot-lab environment for a case study with the goal of producing a NIST Cybersecurity Practice Guide with detailed steps for implementing the reference architecture developed. Ideally the guide will serve as a “starting point” for utilities in securing their production environments, according to the white paper.

“In our efforts to ensure our guidance can benefit the broadest audience, the NCCOE is especially interested in hearing from water utilities of all sizes: small, medium and large,” reads the announcement.
Click to expand...

Log in or Sign up

Compromising vital infrastructure: water management

guest Guest

FanJ Updates Team

zapjb Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Compromising vital infrastructure: water management

guest Guest

FanJ Updates Team

zapjb Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches