US officials find weak security practices at water plants breached by pro-Russia hackers

CNN via KRDO ^ | 5-1-24 | CNN Newssource

[dynachrome]

Pro-Russia hackers have exploited shoddy security practices at multiple US water plants in recent cyberattacks that have hit a wider swathe of victims than was previously documented, according to an advisory by US federal agencies obtained by CNN.

Though the attacks have not impacted drinking water, the advisory lays bare the cybersecurity challenges facing the thousands of water systems across the US, many of which are often short of cash and personnel to deal with threats. The document helps explain the plea that US national security adviser Jake Sullivan made in March to water authorities to shore up their defenses.

US officials investigating the cyberattacks have found that the hacked facilities often had outdated equipment connected to the internet protected by weak passwords, making it relatively easy for hackers to breach the sensitive networks that handle water treatment and other industrial operations, the document says. The Cybersecurity and Infrastructure Security Agency, FBI and other agencies are set to release the advisory publicly later on Wednesday.

The advisory covers a string of recent cyberattacks claimed by Russian-speaking hackers — some of which have been reported publicly — that have alarmed US officials because of the hackers’ brazen willingness to infiltrate computers at US industrial plants using rudimentary attack techniques.

[dynachrome]

"A group of Russian-speaking hackers have claimed responsibility for the hacks, which began in January but have continued in recent weeks. The hackers claimed credit for a cyberattack on an Indiana wastewater treatment plant on a Friday night last month that prompted plant managers to send maintenance personnel to investigate."

[aMorePerfectUnion]

[GOPJ]

Thank God Russian hackers exposed the weaknesses since the people in our government who SHOULD HAVE been checking the safefy of water treatment plants are obviously incompetent. Is the ‘person in charge’ a DEI hire?

What if the first ‘test’ had been a real ‘war’ cyber attack by China?

[EBH]

Oh I dunno ...maybe that 61 billion should have been spent here?

[dragnet2]

We have a government who aided and abetted the destruction of our our borders and sovereignty. They created these collapses. They allowed our borders to be hacked, compromised and overrun and it’s all sponsored by those in government.

Now they’re complaining about their/our electronic defense and infrastructure going the same way? And we’re 34 trillion zillion in debt?

Those effing rats in D.C. who’ve orchestrated this insanity need to be held accountable. But don’t hold your breath as they control everything now. If they’re successful at stopping Trump with their corrupt justice system, or by election fraud, it’s all over. They’ll be far too entrenched and in control of everything by then.

[PIF]

Weak security is all part of the 0bama/Biden plan.

[mass55th]

They can’t even protect this country from being attacked, but let’s waste billions of tax payer dollars on Ukraine, Israel and Taiwan.

[who_would_fardels_bear]

My understanding is that before the internet and cell phones, the utility companies had to locate or send employees out to their facilities to manage and maintain them.

With the advent of the internet and cell phones they thought they could save money by monitoring their facilities remotely. They even were proud at one point to show off complete diagrams and blue prints of their facilities on the internet. They took them off quickly, but most likely not before the Russian and Chinese security agencies had made copies.

I guess they save a few bucks in salaries in exchange for making everything much more hackable.

[The Great RJ]

Consider the perilous state of our electric grid as Bidens green policies are making us more dependent on fickle wind and solar. Targeted hacking could leave large parts of the country blacked out

[rlmorel]

My first thought exactly. What a joke. "Russian Hackers".

"...according to an advisory by US federal agencies obtained by CNN..."

I no longer trust any "US federal agencies" any more.

And I certainly don't trust any who served as unnamed sources for the likes of CNN.

I don't trust the Cybersecurity and Infrastructure Security Agency

I do NOT trust the FBI

And I DAMN well do not trust "other agencies". Not one. Not a single one.

They have all shown themselves, when they aren't openly tyrannical or antithetical to any kind of conservative principle or anything GOOD for American, to be at the very least, incompetent, statist government money suck holes more interested in getting a government paycheck than actually doing their jobs that may or may not even benefit taxpayers.

[Sacajaweau]

When we were concerned with our water supply in the 1980s, a friend worrked at the Water Authority...and he was upper echelon.....climbed the ladder and dunked the fish into the uncovered tank...they lived...he was happy. I believe all the tanks in our area are covered now.

[mabarker1]

before the internet and cell phones, the utility companies had to locate or send employees out to their facilities to manage and maintain them.

It's true, in the early years of being a Surface Water Treatment Plant Operator I was at one WTP and We had to decide what numbers We wanted/needed to have for our Log Sheets, so We would write it in and then 1of the Operators would get the right size circular rock, a hammer and chisel so the Numbers could be put in the Rock Gauge.

No security breaches at Our WTP.🤪

Seriously now it's fairly simple and relatively low cost to secure the SCADA System. First thing is NO Connection to the Internet wirelessly or wired -PERIOD !!! Second is to have all Remote Sights (storage tanks, pump stations, control valves, chemical storage, chemical control and feeding control equipment) via Radios ONLY and Radio at the SCADA System. I'll repeat ABSOLUTELY NOTHING CONNECTED TO THE INTERNET !!!

[taxcontrol]

I work in cybersecurity. While the financial markets have improved, the VAST majority of businesses are just now starting to implement the IT controls / policies necessary to even detect hackers. And anything that is city or county government level is HORRIABLY behind.

I cant complain too much, it keeps me employed.

[mabarker1]

Actually Fish (usually Tilapia) are not uncommon for basic testing for water toxicity. They are usually found at the WTP not in any Storage Tanks.

These days all storage tanks are required to have a top that includes an Inspection hatch with a Lock on it. Also a Vent including a Screen.

[Manuel OKelley]

they could go back to that and the price of electricity doubles at minimum as the connectivity isn’t just about saving salaries adding a lot of efficiency to distribution

Its goign to cost a fortune to properly secure it as well

[Manuel OKelley]

radio connectivity is hard to secure and absolutely can be hacked with much less chance of detection or warning.

[Manuel OKelley]

Everything has been breached, many just don’t know they have yet

[Chode]

*

[metmom]

Good thing to consider for prepping because in many places, if the water goes, they’re in BIG trouble.