SoylentNews is people
SoylentNews
Breached water plant employees used the same TeamViewer password and no firewall:
The Florida water treatment facility whose computer system experienced a potentially hazardous computer breach last week used an unsupported version of Windows with no firewall and shared the same TeamViewer password among its employees, government officials have reported.
After gaining remote access [...] the unknown intruder increased the amount of sodium hydroxide—a caustic chemical better known as lye—by a factor of 100. The tampering could have caused severe sickness or death had it not been for safeguards the city has in place.
According to an advisory from the state of Massachusetts, employees with the Oldsmar facility used a computer running Windows 7 to remotely access plant controls known as a SCADA—short for “supervisory control and data acquisition”—system. What’s more, the computer had no firewall installed and used a password that was shared among employees for remotely logging in to city systems with the TeamViewer application.
Massachusetts officials wrote:
The unidentified actors accessed the water treatment plant’s SCADA controls via remote access software, TeamViewer, which was installed on one of several computers the water treatment plant personnel used to conduct system status checks and to respond to alarms or any other issues that arose during the water treatment process. All computers used by water plant personnel were connected to the SCADA system and used the 32-bit version of the Windows 7 operating system. Further, all computers shared the same password for remote access and appeared to be connected directly to the Internet without any type of firewall protection installed.
[....] The revelations illustrate the lack of security rigor found inside many critical infrastructure environments.
It was a 32-bit computer; so they wisely had Windows 7 instead of XP.
See also:
recent SoylentNews article about this, attempt to poison the water supply of residents in Oldsmar, Forida.
(Score: 1, Disagree) by Anonymous Coward on Friday February 12 2021, @09:04AM (12 children)
Plausible. Some grunt thinks that "this is unnaceptable, its my g-d given duty to fuck this up", and does that.
Seen it happen with my own eyes, cleaned it up, watched guards escort them out of the building after i identified them.
There's a french word for it, sabotage.
The setup they will replace this improvised jumphost with, will present a larger attack surface to the network, will cost more and accept remote updates.
A net win for security. Ahahaha.
(Score: 3, Insightful) by PiMuNu on Friday February 12 2021, @09:19AM (8 children)
Why does a water treatment plant need remote ops at all? Can be fixed with money and modest management (e.g. fix-it crew on site, or an on-call rota). May work cheaper than technical solution.
(Score: 0) by Anonymous Coward on Friday February 12 2021, @09:54AM (2 children)
Because MUH CORONA!!! You are not allowed to operate Water Treatment Console without 80 masks on, which makes it physically impossible to touch the controls, and the weight snaps your neck.
(Score: 2) by Tork on Friday February 12 2021, @03:47PM
You get a lot of your news in meme-form, dontcha.
🏳️🌈 Proud Ally 🏳️🌈 - Give us ribbiti or make us croak! 🐸
(Score: 2) by PiMuNu on Friday February 12 2021, @06:00PM
No. Colleagues on operations at my work place are perfectly fine operating complex equipment despite corona virus. This is no excuse.
(Score: 2, Insightful) by Anonymous Coward on Friday February 12 2021, @11:52AM (1 child)
lazyness, lack of awareness that the Net of Thousand Lies is a warzone (i doubt these people ever felt what a warzone really is, anyway) and always has been, desire to access data from anywhere, inability to construct a proper solution due to lack of: time, resources, clues, giving a fuck.
Lack of thinking it through, lack of modelling failure modes, a desire to just get it done.
Representation of nigh-infinitely complex and nonlinear field (INFOSEC) as having easy(!) simple(!!) technical solutions (!!!).
Same as any and every company where the compliance and liability and yearly bonus are the deciding factors, and not "will this garbage work?" or "is it even useful?".
These people usually have no interest in technological superiority.
Risk and Compliance say its ok - fuck you, ticket closed.
(Score: 0) by Anonymous Coward on Friday February 12 2021, @02:40PM
> These people usually have no interest in technological superiority.
It's not in the budget. Make do with what you've got. Your record has been noted.
(Score: 2) by JoeMerchant on Friday February 12 2021, @01:26PM (1 child)
It was caught because an employee on site noticed the cursor moving itself on the screen.
Remote management is just "the modern way" which means that the on site employees can let someone who knows what they are actually doing do the changes themselves instead of playing the telephone game: Set pump 2 to 130 and valve 3 to 210, which ends up being executed as valve 2 to 210 and pump 3 to 310 because of a garbled cell connection and total lack of understanding on the part of the late shift new hire intern who's mostly studying to get his GED while "attending" the systems overnight.
Water management runs on a quasi-political budget, expecting efficient management is... optimistic, especially in a small town in a high growth area like Oldsmar.
A hopeful tin-foil hat wearer might think that "the powers that be" targeted Oldsmar to make an example of, do no actual harm but create a national level story that can serve as a prod to get the better WMDs of the country to clean up their own acts, and for the ones that don't sweep through with security inspections with mandatory standards to implement.
🌻🌻🌻🌻✌️ [google.com]
(Score: 0) by Anonymous Coward on Saturday February 13 2021, @04:08AM
Why would you punch down on someone working on a GED?
If I had brains, I would have taken the GED in my teams, instead of wasting 4 years at a Public Highschool.
(Score: 2) by DannyB on Friday February 12 2021, @04:50PM
How do you expect remote contractor workers in third world countries to do their jobs? Actually physically be at the plant?
The Jupiter 2 is headed into a region of highly energized saran wrap.
(Score: 2) by lentilla on Friday February 12 2021, @11:43AM (2 children)
Not quite. Sabotage would blowing the treatment facility up. This fits more into the category of "effectively communicating serious issues in a controlled fashion before people get hurt". Sabotage is selfish - warning people that their water treatment facility will get pwned is civic minded.
We suspend the drivers' licences of boy racers who do 150mph in residential streets for the same reason. "But everything was fine, officer, nobody got hurt", they wail. "This time, yes", replies the officer, "this time we were lucky - but it's only a matter of time before someone gets hurt."
It's a water treatment plant. If it needs to be remote controlled, the bosses can phone their instructions in to a trusted lieutenant. As others have said, it should not be connected to the Internet; and; in the interests of accountability, the boss and their lieutenant should be consistent - not "next off the rank" in an offshore call centre. At the end of the day, it is a public utility (no matter who the owner happens to be) and one of the things a first-world population expects is safe drinking water. Having someone "on the job" is not a huge ask, nor an unwarranted expense.
In that, I suspect you are quite correct. In an ideal scenario this incident would give everyone the opportunity to re-access the plant's safety design, specifically with the political will to spend money where it needs to be spent.
Let's hope cool heads prevail, and the majority of the effort is spent of improving their plant systems rather than locating a scapegoat.
I leave by saying if you connect it to the Internet the only question is "how long until we are hacked?" Critical infrastructure needs to be staffed by an experienced and consistent team, and a boss that is empowered to listen to their staff and tell anyone that tries to cut corners "no".
(Score: 0) by Anonymous Coward on Friday February 12 2021, @12:10PM
Thank you for your reply.
As i see it:
Motivation is mostly irrelevant (from my POV as admin of the network).
Daily production _must happen_, all unauthorised changes that even remotely endanger production are sabotage.
While i agree that minor/symbolic acts of sabotage can be good and provide awareness to people who do not want to be aware of the problems,... it still rubs me the wrong way.
This is a waterworks, so i suppose whoever changed the values knew what they were doing and so danger to people was minimal.
Had it been on my network, id appreciate an informal heads-up from the dude doing it so that its not a surprise, i guess.
I wouldn't rat him out, and would deny that i ever spoke to him should management ask, and would provide workarounds around my monitoring.
I'm all for non-traditional solutions to non-traditional problems, but the hierarchy of power must be respected, i mean... like,...
Them owners/management entrust me their hardware to babysit and configure, the least i can do is to do what they ask.
"Let's hope cool heads prevail, and the majority of the effort is spent of improving their plant systems rather than locating a scapegoat." - absolutely agree, its very important to look at these things constructively.
In the end, that is what people pay us the wages for.
(Score: 3, Insightful) by legont on Friday February 12 2021, @12:38PM
The plant system will be improved, but the safeguard one the city has - the one that worked - will be removed because, well, they have state of the art system now. No need for old geezers pointing their greasy fingers at us.
"Wealth is the relentless enemy of understanding" - John Kenneth Galbraith.