Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
Get HideMyAss! VPN, PC Mag's Top 10 VPNs of 2016 for 55% off for a Limited Time ×
Security IT Technology

Hackers Modify Water Treatment Parameters By Accident (softpedia.com) 139

An anonymous reader writes: Verizon's RISK security team has revealed details on a data breach they investigated where some hackers (previously tied to hacktivism campaigns) breached a payments application from an unnamed water treatment and supply company [PDF, page 38], and also escalated their access to reach SCADA equipment responsible for the water treatment process. The hackers modified water treatment chemical levels four different times. The cause of this intrusion seems to be bad network design, since all equipment was interconnected with each other in a star network design, and the payments app contained an INI file with the administrative password for the central router, from where the hackers reached the water treatment SCADA equipment. Of course, the hackers had no clue what they were modifying. Nobody got poisoned or sick in the end.
This discussion has been archived. No new comments can be posted.

Hackers Modify Water Treatment Parameters By Accident

Comments Filter:
  • Who designed that network? Marty McFly in the 80s?
  • by wardrich86 ( 4092007 ) on Tuesday March 22, 2016 @01:37PM (#51754339)
    If somebody had have died or gotten sick, the hacking party would be the ones to get in shit, not the asshat that put the admin password in a text file...
    • Re: (Score:2, Insightful)

      by Anonymous Coward

      I just don't get this. I feel bad putting the admin password in a file on our demo VM that runs on a local workstation.

      I can't imagine sleeping at night putting it on an actual system somewhere.

    • Re: (Score:2, Troll)

      by Coisiche ( 2000870 )

      I was nodding in agreement to that and then a thought suddenly struck me... what if something like this was left deliberately weak so that a part of the population could be disposed of, should it become necessary, and then hackers are the convenient scapegoat for blame in the eyes of everyone else. Especially if the hackers were associated with parties that the monied interests find inconvenient.

      I know they say never attribute to malice that which can be explained by incompetence but maybe sometimes it is m

      • by rbrander ( 73222 )

        You're being silly. Water treatment plants are incapable of producing water that would kill, well, anybody, probably.

        Yes, there's enough chlorine (or other disinfectants) in the plant to kill people; but you could open the valves to their greatest extent without jumping the chlorine content up from the usual part-per-million to more than a couple of parts per million...that is, still way less chlorine than your average municipal pool needs to combat all those filthy kids.

        I suppose there's somebody so aller

        • by Ungrounded Lightning ( 62228 ) on Tuesday March 22, 2016 @02:55PM (#51755119) Journal

          ... you could open the valves to their greatest extent without jumping the chlorine content up from the usual part-per-million to more than a couple of parts per million...that is, still way less chlorine than your average municipal pool needs to combat all those filthy kids.

          But what if the bad guys CLOSE the valves? Then live pathogens go straight from the water source into the no-longer-purified water supply. Several million customers are exposed. Many are sickened. Some take permanent damage. Some die. Even after the issue is fixed the whole water system needs decontamination. And the whole set of cities fed by the plant are disrupted (which is what they're really after).

          It gets even nastier if the bad guys up the ante by dumping a bit of some particularly virulent bugs upstream of the intakes, during the period where they won't be killed off by the shut-down disinfectant injection.

          They use chlorine because its a heck of a lot less damaging to people than the things it is used to kill off.

          • It's a shame these hackers didn't attack the Flint water treatment plant two years ago, they could have turned the water treatment back on and saved everyone from lead poisoning.

          • Um. Can I give you "-1: I Don't Want Anybody to See This" ?
        • Water treatment plants are incapable of producing water that would kill, well, anybody, probably.

          You may want to consider what the first two words of that sentence is and what the purpose of these plants are.
          Also you may want to look into what exactly is in your water supply upstream of water treatment.

          Water treatment and sewage treatment may not be the same thing, but only due to the level of contamination, not due to a difference in the insane variety of bugs and diseases contained within either liquid. Remember, drink beer because cows are shitting in your water right now.

      • ... what if something like this was left deliberately weak so that a part of the population could be disposed of, should it become necessary, and then hackers are the convenient scapegoat for blame in the eyes of everyone else.

        They don't need to use a water plant for that. They've got Obamacare.

        (bud-a-boom TISH!)

      • by Zak3056 ( 69287 )

        We must never forget St. Mary's and Three Waters! All good citizens should remember the Articles of Allegiance, and that Chancellor Sutler only wants to keep us safe from degenerates.

    • by Pascoea ( 968200 ) on Tuesday March 22, 2016 @02:06PM (#51754635)
      Come on. Give them a little credit, it was an INI file, not a TXT file. They probably even named it this_isnt_the_network_password.ini
    • by tnk1 ( 899206 ) on Tuesday March 22, 2016 @02:16PM (#51754753)

      If somebody had have died or gotten sick, the hacking party would be the ones to get in shit, not the asshat that put the admin password in a text file...

      They both should get in deep shit for it. Yes, the asshole who left the admin password in a text file should get fired.

      However, you should be able to leave an admin password posted on a banner on a 24 hr news station and a good person wouldn't use the password to get in and fuck with a water treatment plant. That's like saying that anyone who leaves their door unlocked deserves to have their house broken into and accidentally burned down while people are trying to steal shit.

      So, yeah, the both hackers and the admin should be dealt with severely. This isn't an either/or situation.

      • by TheCarp ( 96830 )

        > However, you should be able to leave an admin password posted on a banner on a 24 hr news
        > station and a good person wouldn't use the password to get in and fuck with a water treatment plant.

        You are not wrong but, there is a question of how much of a risk you are taking. Yes nobody SHOULD do it, but, since you know there are some number of people who WILL do things they should not, maybe the person in charge bears some responsibility for not taking more precautions than the honor system?

        Its one thin

        • by Monoman ( 8745 )

          Or if the IT guy/department protested but was told to "do it anyway". Get that stuff in writing folks!

          • by TheCarp ( 96830 )

            "Yes, we understand your concerns but sales already told them we could make this work."

      • by phantomfive ( 622387 ) on Tuesday March 22, 2016 @03:18PM (#51755359) Journal
        They had their water treatment plant connected to the internet. That's like putting a banner with the root password, plus leaving the door open with a sign that says, "PLEASE COME IN."

        The incompetence here went very deep. If only the NSA were doing something useful like trying to defend this stuff against foreign hostile hackers, instead of trying to spy on citizens.
      • "Yes, the asshole who left the admin password in a text file should get fired"

        Assuming, of course, that there were other options and that the application didn't work in such a way as that a password in a text file wasn't required. In the latter case, the blame would be on shitty programmers - often a third party - and not the sysadmin who did the best with what he had.

        As somebody who has often had plenty of similar WTF moments with crappy software design, I would not be surprised. In the end though, if one

    • If somebody had have died or gotten sick, the hacking party would be the ones to get in shit, not the asshat that put the admin password in a text file...

      The rules are no different than if you and your gang of adolescent thrill seekers climbed over the fence or found an unlocked gate and began flipping exposed switches or opening valves just for the hell of it.

  • I disagree (Score:5, Funny)

    by liqu1d ( 4349325 ) on Tuesday March 22, 2016 @01:37PM (#51754347)
    I got rather sick when I read that the admin password was in the ini file.
    • by MobyDisk ( 75490 ) on Tuesday March 22, 2016 @01:42PM (#51754389) Homepage

      Yeah, they should have put the admin password in an XML file!

      • Everybody knows that an XML file is not safe enough, it has to be in a TXT file.

      • by Anonymous Coward

        XML is so 2000's. We put our admin passwords and SQL connection strings in JSON configuration files now.

        • by tnk1 ( 899206 )

          XML is so 2000's. We put our admin passwords and SQL connection strings in JSON configuration files now.

          This. You pretty much need to ensure that your hosts are not able to be accessed because there's still the stupid plain text or MD5 hashed password in an unencrypted text file somewhere in order to connect your app to your database.

          Not that encryption would matter. If someone breaks into a host that has a public key for a database server, then someone can use that same public key for access to the database server as long as they were doing it from the host that they just broke into. Actually securing con

      • by Trogre ( 513942 )

        At least no one would have been able to read it then.

      • Put it in a readme file. Nobody would ever find it there.
    • union rules, it had to be in the ,ini file.
    • .ini: PASSWORD = ""

      Hacker: I guess they don't have a password, what will we do? We'll never guess it now!

      :P

    • by Ksevio ( 865461 )
      See the problem was it was written on a post-it on the monitor before, but the facility went "paperless" so it had to be put on the machine instead.
  • When these groups try to do their attacks, they don't realize what other fallout which may be happening. Is that Bank using the same data center of a hospital you don't know. Is the budget system going to affect other systems?

    Normally the places with the worst security are not that way due to lack of IT Talent, but because the integration of legacy systems is so connected that it becomes a major undertaking to correct.

    1980's Mainframes were expensive computers, most organizations could normally afford one

    • by cfalcon ( 779563 )

      > So those hackers who think they don't hurt anyone. You are wrong.

      Well, that's demonstrably not true- plenty of hackers haven't hurt anyone. More importantly, it perpetuates the downsides of the 80s style hacker mythology- that there's this group of elites who have this power to break in, or not. The problem with this mythology isn't how true it is- it seems to be pretty accurate, and it pretty fun and interesting. The problem is with how people naturally react to it. "Ok, find the bad guys and put

      • that there's this group of elites who have this power to break in, or not. The problem with this mythology isn't how true it is- it seems to be pretty accurate, and it pretty fun and interesting

        You know, reading TFA, I refuse to believe "elites" had a damned thing to do with it.

        This absolutely screams of being a place which could have been taken down by a couple of bored script kiddies on their first day out.

        These guys could have been skilled, but the security reads like it was so bad that it defies explana

  • by jeffb (2.718) ( 1189693 ) on Tuesday March 22, 2016 @01:43PM (#51754409)

    Problem is, this is a lot more "just the beginning" than "in the end".

    How many such systems do you suppose have been penetrated by folks who do know what they're doing, and are just sitting on their access until the next political party convention, or major sporting event, or...?

    • Re: (Score:1, Interesting)

      by Anonymous Coward

      I distill my tap water before drinking it, using one of these. [amazon.com]

      That doesn't solve this problem, of course, but it does give me an extra layer of protection against failings of the water treatment process.

      Contrary to strangely-popular belief, distilled water is only barely acidic (thousands of times less acidic than soda pop, slightly less acidic than a banana), and does not leech minerals from your body. It's water. It is perfectly healthy, and it tastes good.

      • I distill my tap water before drinking it, using one of these. [amazon.com]

        That doesn't solve this problem, of course, but it does give me an extra layer of protection against failings of the water treatment process.

        Contrary to strangely-popular belief, distilled water is only barely acidic (thousands of times less acidic than soda pop, slightly less acidic than a banana), and does not leech minerals from your body. It's water. It is perfectly healthy, and it tastes good.

        God dammit, not this again. No people, distilled water is not safe to drink. It will try to balance out that PH, it will sap minerals and electrolyres from your water, and it will shorten your lifespan.

        Here's a link [livestrong.com]

        And here's another. [mercola.com]

        Distilled water was a health trend in the 70's, right along with the "don't vaccinate because of autism" trend in the 2000's. It's a clever troll if you want to give someone serious health problems or so, if you really find that funny, but as soon as you crack open a h

        • by Jiro ( 131519 )

          If distilled water actually sapped minerals, consider that once it's going into your mouth it would be combining with saliva, which has a certain percentage of dissolved minerals. Going from drinking regular to distilled water would just mean going from lots of minerals+regular to lots of minerals_distilled. Either way the result from adding the saliva is pretty much the same.

    • by tnk1 ( 899206 )

      Except I have a lot of trouble believing that such events haven't already happened, yet there have been no attacks.

      Someone is always pissed about something. I'd think that if Trump's business was riddled with holes *this would be about the right time to use those holes before he gets more and more out of control.* Yet we see only one anemic reveal from some Anonymous source which clearly was not some elite hacker who had owned The Donald. And this is a guy who has basically admitted to paying off politic

  • by dot_bull ( 950360 ) on Tuesday March 22, 2016 @01:44PM (#51754421)
    I've rarely seen a classic "control system" (HVAC, security, wet and dry lab systems, anything with modems and 9600kbps transmission, ANSI screens, etc) be configured in anything BUT 1980's architecture. These industrial control systems are so old and embedded no one has the money or incentive to remove them and install modern tech. And most of them are archaic, and so incredibly vulnerable it can make a person lose sleep. Think yet another "tip of the iceberg"moment. Think water control, sewage control, electrical control, alarms control, traffic light control. NOT ALL, but the majority are hopelessly insecure and controlled by people who use FAX machines. Anything installed before 2000 or so (the majority) are childlike in design and harbor absolutely no notion of security.
    • >no one has the money or incentive

      Sounds like the incentives are approaching very quickly.

    • by tnk1 ( 899206 )

      While an insecure control system is very undesirable, you should be able to be able to overlay more modern security on top of it in the places where network interconnection is absolutely needed. You should be okay if the only remote access to your 1980's HVAC is through the 2010's firewall and intrusion detection system.

      Where interconnection is not required, this is all fixed instantly by air gaps between the control systems and everything else.

      I am thinking that this is due to incompetence, not the age or

      • I agree with your points. However, the challenge of incorporating the corporate networking security protocols is daunting. The Facilities fiefdom disallows anyone but Facilities touching, well, facilities. The service contracts do not allow for anyone but the service personnel to touch the control systems, in most instances. I like the idea of a front end, but unless the service personnel can reach their systems from their 50 year old control systems, they will void the contracts. And as soon as you ment
  • Holy crap ... (Score:5, Insightful)

    by gstoddart ( 321705 ) on Tuesday March 22, 2016 @01:49PM (#51754475) Homepage

    and the payments app contained an INI file with the administrative password for the central router

    You know, every time I have encountered anything this moronic I've raised bloody hell over it.

    Why the hell would a fscking payment app need the administrative password for the damned router, and what idiot allowed this on their network. On at least three occasions I've said "no way in hell I'm going to put a plaintext password into an INI file, and if you want me to do it you're going to have to send me an email and CC a lot of other people demanding it". (Reading TFA, it wasn't the actual payment app, but they got it off a web server they compromised which had it in an INI file, so bad job in the summary).

    I swear, security is often either non-existent or written by idiots.

    And that's before you even get to the epic stupidity of having your SCADA stuff to your normal network. I've been in places that had SCADA stuff, and NOTHING was on that network which wasn't fully vetted.

    This whole article reads like "what happens when unqualified people run critical systems" -- right down to the fact that they also had access to "2.5 million customer and financial records".

    I'd like to say I'm astonished, but that would imply that I keep being surprised at just how bad companies suck at fairly basic security.

  • by Anonymous Coward

    The persons who approved and connected critical infrastructure devices to Internet accessible networks should be hung. Air gap this stuff, people. It doesn't belong on the Internet.

  • Airgap (Score:5, Insightful)

    by Moof123 ( 1292134 ) on Tuesday March 22, 2016 @02:04PM (#51754617)

    Equipment of this sort should be air gapped from the wild wild west of the internet. Frankly anything that is safety related (hospital equipment, elevators, and even HVAC systems) should be unreachable without badging into a building. While there are still ways to propagate things in via USB stick, it would keep clowns from pulling this kind of stuff.

    • by tnk1 ( 899206 )

      Yes. Air gap and security guards doing searches should stop most of this stuff.

      Some equipment does need network interconnection with the Internet, but the great majority of it does not.

    • by rbrander ( 73222 )

      Bingo. Air gap AND the machines that are on that network should have the USB ports filled with epoxy. When updates are needed, the vendor plugs in a special laptop for the purpose.
      It's extremely useful for SCADA to use Wi-Fi, of course; nothing beats being able to haul a tablet right down under the floor where you've just unstuck a valve and then cycle the valve without running up to the console.
      But the Wi-Fi of course needs to be locked down to a specific set of MAC addresses, not just with passwords. SC

      • by Artemis3 ( 85734 )

        The mac address thing is largely obsolete now, with most OSes providing mac spoofing by default, and sniffing the connected devices to copy their mac address is the first step before attempting any passwords anyway.

        The thing with scada is most terminals run windows, and its those terminals who are largely targeted.

        Also you don't need to have exposed USB ports anyway, something behind (physical) lock could do for occasional updates.

      • by lgw ( 121541 )

        the SCADA system has to be an appliance, like a Blu-Ray player, only able to run the system programs and no others

        Did you know BluRay players will execute arbitrary Java code off of BluRay discs, as part of normal operation? I'm hoping you didn't. BluRay is specifically designed to allow a disc to damage the function of the device (by invalidating keys needed to play other discs).

    • by Ksevio ( 865461 )
      While I'd give you top marks from a security standpoint, it's not the 1990's anymore and everything is connected. The technology to secure networks at multiple points is well developed and we shouldn't let the fear of incompetence prevent us from having the benefits of connected systems.
  • Now we pin each death in flint MI on them.

    Better plead down to life.

  • Geek logic sometimes escapes me.

    So tell ell me why screwing with the process controls in a chemical plant counts only as an "accident."

    and also escalated their access to reach SCADA equipment responsible for the water treatment process. The hackers modified water treatment chemical levels four different times

  • by rbrander ( 73222 ) on Tuesday March 22, 2016 @02:47PM (#51755049) Homepage

    There's only one security that counts with a SCADA system: air gap. Plant-controlling systems must not talk to any other network.
    I recently retired from a much-larger utility and we did struggle with the human factor. The plant guys heard all the lectures from their design consultants that put in the system and the IT people who checked the design over. They understand that they must not interconnect. ...and then a year or two later you find them trying to quietly slip two network cards into the same machine so they don't have to change chairs to go from corporate-network-with-Internet-access to SCADA.
    Emotionally, it's hard to believe anybody would *want* to break in; it's not like there's money to be made. Hollywood-movie scenarios where "hackers take over" are ludicrous; every device in the plant has an "On/Off/Auto" switch where only "Auto" leaves SCADA in control at all; the most junior operator could run around the plant hitting those switches in five minutes, restoring manual control. (Then we'd have to bring in a dozen folks with cell phones to run the plant manually; no sweat).
    And as I posted above, it's not like you can kill anybody with a water treatment plant: the worst water you could put out would either be untreated (please boil water) or absolute max chlorine the system could insert (still less than a swimming pool).
    It's going to be the same as "safety"; you can pound safety lectures into people's heads all day, but it seems to take a generation or two for the message to really sink in; hard hats and visibility vests were strenuously avoided as well. We're just going to have to make it a standard, like safety standards: firing for disobedience, regardless of whether anything went wrong.

    • There's only one security that counts with a SCADA system: air gap. Plant-controlling systems must not talk to any other network.

      And you instantly fail all sorts of control, maintenance, reliability analysis, regulatory requirements for data, optimisation, etc tasks as a result.
      Admittedly a water treatment plant is simple and probably should get away with air-gaps, but the words air-gap are the first words that everyone utters when they talk about control systems. This causes two problems.

      1. Air-gaps need to be breached to enable a whole world of optimisation and value improving abilities in control systems these days. An air-gapped

  • Nobody got poisoned or sick in the end.

    How do we know, what the mid- and long-term effects will be? There is no one obviously poisoned by tap water in Flint, Michigan [mlive.com] either.

    Should we apply the same spin to people responsible for that, as the submitter applied to hackers because he sympathizes with them?

  • and team.. (embarrassed to admit I watch this show..)
  • There is ZERO..... Z E R O reason for the payment system to have any connection to the SCADA system.

    Whoever is the manager of that plant and the engineer of that SCADA system and it's network need to be put in jail for their incompetence.

    • by Ksevio ( 865461 )
      You mean ZERO is the amount of thought you put into it? I can think of reasons easily - they're a small company with a couple machines. Both are on their internal network (like the vast majority of companies) because there are people that need to access both of them from their desk and it's easier this way.

      If we start jailing people for incompetence, we're going to need a lot more jails.
      • by Lumpy ( 12016 )

        Considering I worked in the field for 10 years and have extensive experience with it? A lot of thought went into it... What is your background with water filtration and SCADA systems?

        I thought so.

        Small company with a couple of machines? as a water treatment plant? if the place cant afford another $499 pc to set on someone's desk to keep the systems safe they need to shut down due to even more gross negligence.

        • by Ksevio ( 865461 )
          Really you've worked in the field for 10 years and couldn't come up with a single reason that you'd want to connect to a system remotely? Why spend $499 for a redundant machine for each employee when you can install proper network security instead?
          • by Lumpy ( 12016 )

            Not one that is SANE. only those that are utterly insane and want to make it insecure would want to connect remotely.
            I see you dont understand a thing about security and know nothing at all about SCADA.

            • by Ksevio ( 865461 )
              I work with systems that are sensitive AND connected to the Internet (through proper firewalls). It's possible to do, even a SCADA system can do it, but I see you don't understand a thing about securing a connected system so it'd probably be insane for you to attempt it.
  • This is what happens when systems are left on automatic pilot. I think the technical term is "oops". Fortunately there was yet another system (also left on automatic pilot), that gave people a clue. We all know old systems did things that were just plain stupid (clear text passwords?!?). We've all see and/or done it, but the real problem was there was no review of the system looking for such things. We keep forgetting that security (and reliability) is a process, NOT a technology. And with water treatment,
  • Hacking is really no less puerile than going around and smashing windows.

  • "Of course, the hackers had no clue what they were modifying."

    The report discussed the intruders having little apparent knowledge of what they were doing. The anonymous reader assumes this to mean that the intruders didn't know they were screwing with a water treatment SCADA system.

    I think it just as likely that they had figured out they had tapped into a process control system, and were figuring out how to manipulate the system... driving by Braille.

    The RISK report report authors could have summarized t

  • Glad to hear it. One December I got sick in the end. At one point, the length of my digestive tract, measured in time, became 20 minutes from the time I ate or drank anything to the time I sat on the toilet.

No hardware designer should be allowed to produce any piece of hardware until three software guys have signed off for it. -- Andy Tanenbaum

Working...