7 ms·

Water treatment plant hacked, chemical mix changed for tap supplies

145 points by bifrost 11y ago

sjclemmy 11y ago
Every time I hear a story like this I am amazed. The cause of this is not complex or difficult. It's basic stuff.
hackuser 11y ago
As long as it only affects people who didn't vote for the governor, it's not the government's problem.
AdmiralAsshat 11y ago
Fortunately, based on alert functionality, KWC was able to quickly identify and reverse the chemical and flow changes, largely minimising the impact on customers. The affected only lost most of their hair.
mchahn 11y ago
> It seems the activists lacked either the knowledge of SCADA systems or the intent to do any harm. So it's a kid, not a state.
- ChuckMcM 11y ago
  Not necessarily, if you were probing you would do so in a way that didn't indicate your true intentions.
  - ams6110 11y ago
    Sounds like it started with a pretty simple SQL injection attack, any script kiddie could have done that. Then poking around they found something like control_system_passwords.txt somewhere on the web server and went from there. Not exactly state-actor skilz required.
- wepple 11y ago
  If it was compromised via SQLi, it's likely a lower-tech group. But even fairly advanced attackers don't necessarily know their way around SCADA systems. nor have the resources to take control of often very tech-specific PLC's
medymed 11y ago
The article deems as 'hacktivist' a group that 'changed the levels of chemicals being used to treat tap water.' This doesn't sound much like activism, defined by google as 'the policy or action of using vigorous campaigning to bring about political or social change' or 'hacktivism' as described on wikipedia which focuses on distribution of information, defacing websites, etc. There is no mention of what chemical changes were made, but if malicious it sounds more like warfare or terrorism potentially targeting civilians. The subtitle is "Well, that's just a little scary", also quite an understatement.
- pdkl95 11y ago
  > This doesn't sound much like activism Yes it does; it's a perfect example of how "activist" (and by extension "hactivist") is being used in modern propaganda. Jacob Appelbaum very recently gave a rather... intense talk[1] that is about[2] this type of propaganda. As he explains: Let us address this concept of "activism", and it works like this. "Activism" is used as a pejorative term in order to suggest that participation in a democratic society is somehow outside of normal behavior. > There is no mention Stenographers publishing propaganda are not in the business of revealing facts. [1] https://www.youtube.com/watch?v=KJValv4YQcY#t=78 https://www.youtube.com/watch?v=KJValv4YQcY#t=78 (note: Jacob doesn't pull his punches, so this contains some strong language) [2] It also has some disturbing new information about how The Guardian treated him, Poitras, Greenwald, and others.
  - kbenson 11y ago
    Wow, now that's what I call Scorched Earth. Personally, I'm one for trying to keep the personal attacks out of a rational discussion, but I recognize that sometimes going with emotion can work as well or better, depending on the audience. I'm also sure he views quite a bit of what he's talking about as personal attacks on himself as well. I'm sad now that I didn't see it when you posted it a few days ago, and couldn't do my small bit to nudge it to the front page.
  - atmosx 11y ago
    That speech was amazing. I had the Guardian in high regard, I'm kinda disappointed.
willvarfar 11y ago
So possibly a state actor doing reconnaissance? They get in, they verify they have control by making a change they think won't be noticed, and they add it to their list of nasty things to do when the war starts... Remember the recent Ukrainian power outage hack? http://arstechnica.com/security/2016/02/hackers-did-indeed-cause-ukrainian-power-outage-us-report-concludes/ http://arstechnica.com/security/2016/02/hackers-did-indeed-c...
USANEEDSHELP 11y ago
Take all utility like infrastructure control systems off the internet (Gas, Water, etc...)
- swiley 11y ago
  The developer machines are still (by necessity) connected to the Internet.
  - nickpsecurity 11y ago
    It's not necessary: it's just convenient or more profitable. There's guards, link encryptors, authenticated networking, and OSS knockoffs of above to either reduce risk of or probably prevent malice from hitting on-site computers. They're just not applied by most because people paying don't give a shit. Any high-security engineer doing SCADA or site-to-site for big companies will probably tell you so.
matt_wulfeck 11y ago
It really boggles my mind that we don't air-gap every single one of these types of critical systems. Can someone help me understand why this isn't more popular? Is it because they requirement controls from outside resources? Or maybe there's central places that rely on telemetry? Another option: outgoing UDP packets only. Outgoing telemetry but nothing comes back in.
- nickpsecurity 11y ago
  Management wants it done, done cheaply, with cheap support, and sometimes plugging into their dashboards. Clive Robinson, who did SCADA, said those things combine to make security nonexistent to afterthought in most installations. I'll add a lesson from software world that it also pays to contract steady fixes over time instead of near-perfect the first time. That might partly be because people in such industries only make sacrifices after shit hits the fan publicly. See Target for example. ;)
  - akira2501 11y ago
    Of course.. you /expect/ that to happen, which is why you establish an internal auditing process.
- cpeterso 11y ago
  In related news this week: http://www.nytimes.com/2016/03/26/nyregion/rye-brook-dam-caught-in-computer-hacking-case.html http://www.nytimes.com/2016/03/26/nyregion/rye-brook-dam-cau... "The Bowman Avenue Dam in this low-key suburban village in Westchester County is … about the width of a modest living room, and the 20-foot-tall dam itself essentially keeps a babbling creek, the Blind Brook, from flooding basements and ground floors in houses downstream. Yet, according to the authorities, it was the computer-guided controls of this dam that seven Iranian computer hackers chose to penetrate on behalf of that country’s Revolutionary Guards Corps, as part of a plot that also breached or paralyzed 46 of the nation’s largest financial institutions and blocked hundreds of thousands of customers from accessing their bank accounts online.
  - 11y ago
Pitarou 11y ago
For what it's worth, the pseudonym Kemuri is Japanese for smoke. There was a recent incident in the UK where too much chlorine was added to the water supply, leaving it unsafe even for washing. I wonder if it's connected? http://www.bbc.co.uk/news/uk-england-derbyshire-35786378 http://www.bbc.co.uk/news/uk-england-derbyshire-35786378
- luxpir 11y ago
  That's why I followed this link tonight, as that incident hasn't yet been explained. It caused widespread panic in a matter of hours. Perhaps simple to flush the system once, but that would be unsustainable in the long run. It's like a public services denial of service.
- mike_hearn 11y ago
  I don't think so. That does look like a rather good fit, especially as the BBC article states quite clearly that the chlorine overdose was spotted due to monitoring alarms, just like the Verizon article states. But Verizon claims the valves were manipulated to "no particular effect" which doesn't seem credible if it required a full system flush and a do-not-use to be posted. Also Severn Trent has 4.6 million customers, not 2.5 million.
  - Pitarou 11y ago
    Not the same incident, no, but could it be connected?
Pitarou 11y ago
For what it's worth, the pseudonym Kemuri is Japanese for smoke. There was a recent incident in the UK where too much chlorine was added to the water supply, leaving it unsafe even for washing. I wonder if it's connected? http://www.bbc.co.uk/news/uk-england-derbyshire-35786378 http://www.bbc.co.uk/news/uk-england-derbyshire-35786378
tpallarino 11y ago
Hope they stopped the flow of fluoride. Forced medication isn't ethical and it's been shown to have no effect on dental health.
- erkkie 11y ago
  And naturally you've based your understanding of such things on studies and have references to share?
mariodiana 11y ago
Any idea where this happened, even what country it happened in? I can't make sense of that from the article. I'm guessing we're talking the U.S.
awinter-py 11y ago
the best part is that this is somehow verizon's fault.
rubyfan 11y ago
I call BS. There are no facts revealed here other than some boogie man story telling about, none other than a Syrian hacking group (during the Cold War, this would have been the USSR instead of implying ISIL). The whole thing reads like an advertisement for Verizon Security and Splunk.
homero 11y ago
Guys this is why we need backdoors, so it happens more often, oh wait
bencollier49 11y ago
I genuinely believe that where software has the direct ability to cause physical harm, there ought to be revocable professional accreditation for at least one programmer on the development team. Likewise for systems security on-site. Actually, I'd be interested to know if things like ISO27001 are mandatory for these sorts of facilities. And who gets in trouble if the system fails.
- jakubp 11y ago
  I'm afraid ISO27001 guarantees very little. Specifically, in my (limited) experience these kinds of programs/accreditations only look at a few data points in the company where reality covers hundreds of data points, and only in a brief period. Nothing stops people inside the organization from not complying with the rules, and nobody actually verifies that the right people in the organization actually know the rules.
- wepple 11y ago
  I'd go higher than that. whoever defined the specifications of the project, should've included security as a key component. Of course, there also has to be budget and time allowances to actually make it happen.

145 points by bifrost 11y ago

sjclemmy 11y ago

Every time I hear a story like this I am amazed. The cause of this is not complex or difficult. It's basic stuff.

hackuser 11y ago

As long as it only affects people who didn't vote for the governor, it's not the government's problem.

AdmiralAsshat 11y ago

Fortunately, based on alert functionality, KWC was able to quickly identify and reverse the chemical and flow changes, largely minimising the impact on customers. The affected only lost most of their hair.

mchahn 11y ago

> It seems the activists lacked either the knowledge of SCADA systems or the intent to do any harm. So it's a kid, not a state.

ChuckMcM 11y ago
Not necessarily, if you were probing you would do so in a way that didn't indicate your true intentions.
- ams6110 11y ago
  Sounds like it started with a pretty simple SQL injection attack, any script kiddie could have done that. Then poking around they found something like control_system_passwords.txt somewhere on the web server and went from there. Not exactly state-actor skilz required.
wepple 11y ago
If it was compromised via SQLi, it's likely a lower-tech group. But even fairly advanced attackers don't necessarily know their way around SCADA systems. nor have the resources to take control of often very tech-specific PLC's

medymed 11y ago

The article deems as 'hacktivist' a group that 'changed the levels of chemicals being used to treat tap water.' This doesn't sound much like activism, defined by google as 'the policy or action of using vigorous campaigning to bring about political or social change' or 'hacktivism' as described on wikipedia which focuses on distribution of information, defacing websites, etc. There is no mention of what chemical changes were made, but if malicious it sounds more like warfare or terrorism potentially targeting civilians. The subtitle is "Well, that's just a little scary", also quite an understatement.

pdkl95 11y ago
> This doesn't sound much like activism Yes it does; it's a perfect example of how "activist" (and by extension "hactivist") is being used in modern propaganda. Jacob Appelbaum very recently gave a rather... intense talk[1] that is about[2] this type of propaganda. As he explains: Let us address this concept of "activism", and it works like this. "Activism" is used as a pejorative term in order to suggest that participation in a democratic society is somehow outside of normal behavior. > There is no mention Stenographers publishing propaganda are not in the business of revealing facts. [1] https://www.youtube.com/watch?v=KJValv4YQcY#t=78 https://www.youtube.com/watch?v=KJValv4YQcY#t=78 (note: Jacob doesn't pull his punches, so this contains some strong language) [2] It also has some disturbing new information about how The Guardian treated him, Poitras, Greenwald, and others.
- kbenson 11y ago
  Wow, now that's what I call Scorched Earth. Personally, I'm one for trying to keep the personal attacks out of a rational discussion, but I recognize that sometimes going with emotion can work as well or better, depending on the audience. I'm also sure he views quite a bit of what he's talking about as personal attacks on himself as well. I'm sad now that I didn't see it when you posted it a few days ago, and couldn't do my small bit to nudge it to the front page.
- atmosx 11y ago
  That speech was amazing. I had the Guardian in high regard, I'm kinda disappointed.

willvarfar 11y ago

So possibly a state actor doing reconnaissance? They get in, they verify they have control by making a change they think won't be noticed, and they add it to their list of nasty things to do when the war starts... Remember the recent Ukrainian power outage hack? http://arstechnica.com/security/2016/02/hackers-did-indeed-cause-ukrainian-power-outage-us-report-concludes/ http://arstechnica.com/security/2016/02/hackers-did-indeed-c...

USANEEDSHELP 11y ago

Take all utility like infrastructure control systems off the internet (Gas, Water, etc...)

swiley 11y ago
The developer machines are still (by necessity) connected to the Internet.
- nickpsecurity 11y ago
  It's not necessary: it's just convenient or more profitable. There's guards, link encryptors, authenticated networking, and OSS knockoffs of above to either reduce risk of or probably prevent malice from hitting on-site computers. They're just not applied by most because people paying don't give a shit. Any high-security engineer doing SCADA or site-to-site for big companies will probably tell you so.

matt_wulfeck 11y ago

It really boggles my mind that we don't air-gap every single one of these types of critical systems. Can someone help me understand why this isn't more popular? Is it because they requirement controls from outside resources? Or maybe there's central places that rely on telemetry? Another option: outgoing UDP packets only. Outgoing telemetry but nothing comes back in.

nickpsecurity 11y ago
Management wants it done, done cheaply, with cheap support, and sometimes plugging into their dashboards. Clive Robinson, who did SCADA, said those things combine to make security nonexistent to afterthought in most installations. I'll add a lesson from software world that it also pays to contract steady fixes over time instead of near-perfect the first time. That might partly be because people in such industries only make sacrifices after shit hits the fan publicly. See Target for example. ;)
- akira2501 11y ago
  Of course.. you /expect/ that to happen, which is why you establish an internal auditing process.
cpeterso 11y ago
In related news this week: http://www.nytimes.com/2016/03/26/nyregion/rye-brook-dam-caught-in-computer-hacking-case.html http://www.nytimes.com/2016/03/26/nyregion/rye-brook-dam-cau... "The Bowman Avenue Dam in this low-key suburban village in Westchester County is … about the width of a modest living room, and the 20-foot-tall dam itself essentially keeps a babbling creek, the Blind Brook, from flooding basements and ground floors in houses downstream. Yet, according to the authorities, it was the computer-guided controls of this dam that seven Iranian computer hackers chose to penetrate on behalf of that country’s Revolutionary Guards Corps, as part of a plot that also breached or paralyzed 46 of the nation’s largest financial institutions and blocked hundreds of thousands of customers from accessing their bank accounts online.
- 11y ago

Pitarou 11y ago

For what it's worth, the pseudonym Kemuri is Japanese for smoke. There was a recent incident in the UK where too much chlorine was added to the water supply, leaving it unsafe even for washing. I wonder if it's connected? http://www.bbc.co.uk/news/uk-england-derbyshire-35786378 http://www.bbc.co.uk/news/uk-england-derbyshire-35786378

luxpir 11y ago
That's why I followed this link tonight, as that incident hasn't yet been explained. It caused widespread panic in a matter of hours. Perhaps simple to flush the system once, but that would be unsustainable in the long run. It's like a public services denial of service.
mike_hearn 11y ago
I don't think so. That does look like a rather good fit, especially as the BBC article states quite clearly that the chlorine overdose was spotted due to monitoring alarms, just like the Verizon article states. But Verizon claims the valves were manipulated to "no particular effect" which doesn't seem credible if it required a full system flush and a do-not-use to be posted. Also Severn Trent has 4.6 million customers, not 2.5 million.
- Pitarou 11y ago
  Not the same incident, no, but could it be connected?

Pitarou 11y ago

tpallarino 11y ago

Hope they stopped the flow of fluoride. Forced medication isn't ethical and it's been shown to have no effect on dental health.

erkkie 11y ago
And naturally you've based your understanding of such things on studies and have references to share?

mariodiana 11y ago

Any idea where this happened, even what country it happened in? I can't make sense of that from the article. I'm guessing we're talking the U.S.

awinter-py 11y ago

the best part is that this is somehow verizon's fault.

rubyfan 11y ago

I call BS. There are no facts revealed here other than some boogie man story telling about, none other than a Syrian hacking group (during the Cold War, this would have been the USSR instead of implying ISIL). The whole thing reads like an advertisement for Verizon Security and Splunk.

homero 11y ago

Guys this is why we need backdoors, so it happens more often, oh wait

bencollier49 11y ago

I genuinely believe that where software has the direct ability to cause physical harm, there ought to be revocable professional accreditation for at least one programmer on the development team. Likewise for systems security on-site. Actually, I'd be interested to know if things like ISO27001 are mandatory for these sorts of facilities. And who gets in trouble if the system fails.

jakubp 11y ago
I'm afraid ISO27001 guarantees very little. Specifically, in my (limited) experience these kinds of programs/accreditations only look at a few data points in the company where reality covers hundreds of data points, and only in a brief period. Nothing stops people inside the organization from not complying with the rules, and nobody actually verifies that the right people in the organization actually know the rules.
wepple 11y ago
I'd go higher than that. whoever defined the specifications of the project, should've included security as a key component. Of course, there also has to be budget and time allowances to actually make it happen.