The water treatment plant in Oldsmar, Florida. target of a hacker in a horrible cyber attack they say that last week it exhibited very weak IT security practices. Recent updates from government officials say the installation lacked some basic network protections – including a firewall.
In case you missed it, a hacker reportedly hijacked the plant’s operational controls on Friday, temporarily raising the sodium hydroxide content in the water to toxic levels. The facility is the main source of drinking water for the city’s 15,000 residents. Although a plant operator was ultimately able to return water to normal levels, the incident launched a national conversation about the state of security in America’s critical infrastructure.
Like many installations of its kind, Oldsmar uses a SCADA (short for “supervisory control system and data acquisition”) Which allows employees to monitor and control conditions within the facility. At the same time, the team has also used TeamViewer, a very common remote access program, which can be used to monitor and control systems within SCADA.
According to a new cybersecurity council of In the state of Massachusetts, plant protections for these systems have fallen short. The installation was not just using Windows 7 – outdated software that Microsoft no longer supports—But all of your employees apparently shared the same password to access TeamViewer. In addition, the statement states that the installation “appeared to be connected directly to the Internet without any type of firewall protection installed”.
Yes, not exactly a five star rating. The FBI reiterated this poor assessment on Wednesday, which issued a warning to private sector leaders about the Oldsmar incident. The Bureau declared that hackers undoubtedly exploited the facility’s “cyber security weaknesses” and alerted companies to similar practices:
“Cybercriminals have probably accessed the system by exploiting cyber security weaknesses, including poor password security and an outdated Windows 7 operating system to compromise the software used to remotely manage water treatment. The actor probably also used TeamViewer desktop sharing software to gain unauthorized access to the system. “
G / O Media can receive a commission
Both the FBI and the Massachusetts communiqué appear to confirm that the hackers were able to enter via TeamViewer, either entering via a bad security password or the outdated Windows 7 program the installation was using.
All industrial organizations operate with a symbiotic mix of informational and operational technology – and cyber researchers have long been hypothesizing the types of horrors that await them in a world where bad actors can use the former to command the latter. Oldsmar certainly gave a boost to that conversation – spurring a broader conversation about how to protect America’s critical infrastructure.
Ultimately, the city’s security weaknesses are also not so surprising. State and local governments have long been behind federal agencies and the private sector when it comes to security – a central reason why lawmakers have pushed to direct federal funding to state and local cybersecurity agencies. The Oldsmar incident – combined with the shock waves of the ongoing SolarWinds scandal—It only further stimulated calls for more general investment in public sector cybersecurity, than the new Biden government promised to do good in.