Poor Password Security Lead to Recent Water Treatment Facility Hack

New details have emerged about the remote computer intrusion at a Florida water
treatment^[1] facility last Friday,
highlighting a lack of adequate security measures needed to
bulletproof critical infrastructure environments.

The breach, which occurred last Friday, involved an unsuccessful attempt^[2]
on the part of an adversary to increase sodium hydroxide dosage in
the water supply to dangerous levels by remotely accessing the
SCADA system at the water treatment plant. The system’s plant
operator, who spotted the intrusion, quickly took steps to reverse
the command, leading to minimal impact.

Now, according to an advisory^[3]
published on Wednesday by the state of Massachusetts, unidentified
cyber actors accessed the supervisory control and data acquisition
(SCADA) system via TeamViewer software installed on one of
the plant’s several computers that were connected to the control
system.

Not only were these computers running 32-bit versions of the
Windows 7 operating system, but the machines also shared the same
password for remote access and are said to have been exposed
directly to the Internet without any firewall protection
installed.

It’s worth noting that Microsoft Windows 7 reached end-of-life
as of last year, on January 14, 2020.

Adding to the woes, more often than not, many small public
utilities are saddled with aging infrastructure, and the IT
departments tend to be under-resourced, lacking in budget and
expertise to upgrade their security posture and address
vulnerabilities in a timely fashion.

“Restrict all remote connections to SCADA systems, specifically
those that allow physical control and manipulation of devices
within the SCADA network,” Massachusetts state officials said.
“One-way unidirectional monitoring devices are recommended to
monitor SCADA systems remotely.”

“Keep computers, devices, and applications, including
SCADA/industrial control systems (ICS) software, patched and
up-to-date,” the alert cautioned, adding “use two-factor
authentication with strong passwords.”