4 ms·

Wow, OK. So it was just an old pump in bad condition that failed due to lack of maintenance or some such. And the "hacking" was a legitimate employee accessing

Wow, OK. So it was just an old pump in bad condition that failed due to lack of maintenance or some such. And the "hacking" was a legitimate employee accessing the system from Russia where he was traveling and had no connection whatsoever with the pump failure. But they didn't bother to verify this. They just checked logs, found a Russian ip address, and without doing an investigation started shouting "Russian Terror Attack!" and went to full on red alert. Well at least they managed to create a lot of publicity in the international press about how their systems are on the internet and use three letter passwords which may or may not be the default three letter password set at the factory. That information should be helpful to someone I guess.

yuhong 15y ago
Of course, this does not make a three-char password any less stupid.
munin 15y ago
any time someone says something about "the attack came from X", you should think back to this event
- wladimir 15y ago
  This proves again how tremendously paranoid we have become in the west. Everything is an attack, and more generally a reason to distrust each other more. Even if the blame is on ourselves for disregarding maintenance. (not to say that they shouldn't have used a better password, but please, please media stop shouting "cyberwar!!!" at each possible instance)
  - jerf 15y ago
    I'm going to give this the hand-in-the-air rocking-back-and-forth "ehhhhh, welllll" treatment. The media has freaked out about "hackers" more or less continously for the past 30 years. It's not new. Remember, The Hacker Crackdown [1] is from 1992, and the news then was still not that the media freaked out about this sort of thing, but the huge arrest wave it represented. [1]: http://www.mit.edu/hacker/hacker.html http://www.mit.edu/hacker/hacker.html
    - wladimir 15y ago
      But it did change. "hackers" used to be kids, tricksters and sometimes even criminals. Now, it's "cyberwar", and foreign countries are supposed to be involved even in the most trivial hack. Ooh they used a Chinese proxy so it must be the Chinese!
GHFigs 15y ago
But they didn't bother to verify this. They just checked logs, found a Russian ip address, and without doing an investigation started shouting "Russian Terror Attack!" and went to full on red alert. As plausible as that is, it doesn't sound like that's quite what happened here (emphasis mine): "Federal officials confirmed that the FBI and the Department of Homeland Security were investigating damage to the water plant but cautioned against concluding that it was necessarily a cyber-attack before all the facts could be learned. “At this time there is no credible corroborated data that indicates a risk to critical infrastructure entities or a threat to public safety,” said DHS spokesman Peter Boogaard." "News of the incident became public after Joe Weiss, an industry security expert, obtained a report dated Nov. 10 and collected by an Illinois state intelligence center that monitors security threats. The original source of the information was unknown and impossible to immediately verify."[1] The article (and seemingly all of the others) go on to cite Weiss as the sole source for the claim that it was a hack and "a big deal". From his blog post[2] and more recent posts it sounds like the report he had obtained claimed it was a hack and he publicized it "to highlight a concern that information is not being disseminated in a timely manner", which I suppose is the opposite of full on red alert. I think Weiss was probably trying to make a good point (if you believe the DHS, then not only wasn't information getting disseminated, it was also wrong information) but the press ran with the sexier "We're getting hacked by Russia!" aspect even without verification. [1] http://www.washingtonpost.com/blogs/checkpoint-washington/post/foreign-hackers-broke-into-illinois-water-plant-control-system-industry-expert-says/2011/11/18/gIQAgmTZYN_blog.html http://www.washingtonpost.com/blogs/checkpoint-washington/po... [2] http://community.controlglobal.com/content/water-system-hack-system-broken http://community.controlglobal.com/content/water-system-hack...

yuhong 15y ago

Of course, this does not make a three-char password any less stupid.

munin 15y ago

any time someone says something about "the attack came from X", you should think back to this event

wladimir 15y ago
This proves again how tremendously paranoid we have become in the west. Everything is an attack, and more generally a reason to distrust each other more. Even if the blame is on ourselves for disregarding maintenance. (not to say that they shouldn't have used a better password, but please, please media stop shouting "cyberwar!!!" at each possible instance)
- jerf 15y ago
  I'm going to give this the hand-in-the-air rocking-back-and-forth "ehhhhh, welllll" treatment. The media has freaked out about "hackers" more or less continously for the past 30 years. It's not new. Remember, The Hacker Crackdown [1] is from 1992, and the news then was still not that the media freaked out about this sort of thing, but the huge arrest wave it represented. [1]: http://www.mit.edu/hacker/hacker.html http://www.mit.edu/hacker/hacker.html
  - wladimir 15y ago
    But it did change. "hackers" used to be kids, tricksters and sometimes even criminals. Now, it's "cyberwar", and foreign countries are supposed to be involved even in the most trivial hack. Ooh they used a Chinese proxy so it must be the Chinese!

GHFigs 15y ago

But they didn't bother to verify this. They just checked logs, found a Russian ip address, and without doing an investigation started shouting "Russian Terror Attack!" and went to full on red alert. As plausible as that is, it doesn't sound like that's quite what happened here (emphasis mine): "Federal officials confirmed that the FBI and the Department of Homeland Security were investigating damage to the water plant but cautioned against concluding that it was necessarily a cyber-attack before all the facts could be learned. “At this time there is no credible corroborated data that indicates a risk to critical infrastructure entities or a threat to public safety,” said DHS spokesman Peter Boogaard." "News of the incident became public after Joe Weiss, an industry security expert, obtained a report dated Nov. 10 and collected by an Illinois state intelligence center that monitors security threats. The original source of the information was unknown and impossible to immediately verify."[1] The article (and seemingly all of the others) go on to cite Weiss as the sole source for the claim that it was a hack and "a big deal". From his blog post[2] and more recent posts it sounds like the report he had obtained claimed it was a hack and he publicized it "to highlight a concern that information is not being disseminated in a timely manner", which I suppose is the opposite of full on red alert. I think Weiss was probably trying to make a good point (if you believe the DHS, then not only wasn't information getting disseminated, it was also wrong information) but the press ran with the sexier "We're getting hacked by Russia!" aspect even without verification. [1] http://www.washingtonpost.com/blogs/checkpoint-washington/post/foreign-hackers-broke-into-illinois-water-plant-control-system-industry-expert-says/2011/11/18/gIQAgmTZYN_blog.html http://www.washingtonpost.com/blogs/checkpoint-washington/po... [2] http://community.controlglobal.com/content/water-system-hack-system-broken http://community.controlglobal.com/content/water-system-hack...