[Pontiac]

The attack came four days after federal agencies updated a landmark advisory warning that the same Iranian-affiliated actors had expanded their campaign beyond Rockwell Automation controllers to include equipment from Siemens and Schneider Electric. It was enabled, researchers say, by a critical authentication bypass in Rockwell Automation's widely deployed Logix PLCs — a flaw rated CVSS 9.8 out of 10, first disclosed in 2021, and for which Rockwell itself has confirmed no patch exists or is coming, as detailed in CISA Advisory AA26-097A and on Tenable's CVE-2021-22681 vulnerability page.

Iranian hackers exploited unpatchable PLC flaw to breach 30 Minnesota water systems

This makes it sound as if the only solution is to take the controllers completely off the internet.

[Wally_Kalbacken]

Don’t know the water treatment industry - but in electric power transmission the problem is all the embedded systems. So many vulnerabilities.

[rktman]

If it’s linked, it’s hackable. If NV Energy can shut my power off remotely, their power plant probably can be shut down as well as well. Just launch a rogue AI bot.......

[logi_cal869]

They never should have been connected to the internet.

It’s not just Hollyweird that’s been beating that drum FOREVER (the central premise behind ‘Live Free or Die Hard’, i.e., vulnerability of connected government computers)...

Utilities should have remained local, not WWW.