A pump at a US public water utility was recently destroyed after cyber-attackers gained access to a Supervisory Control And Data Acquisition (SCADA) system controlling the device, according to a security expert who said he obtained an official report about the incident.
A spokesman from the US Department of Homeland Security (DHS) confirmed the pump incident, but said it is too soon to say whether it was the result of a cyber-attack.
"DHS and the FBI are gathering facts surrounding the report of a water pump failure in Springfield Illinois," said Peter Boogaard, deputy press secretary at the DHS. "At this time there is no credible corroborated data that indicates a risk to critical infrastructure entities or a threat to public safety."
Meanwhile, in a separate case, a hacker named "pr0f" posted several images on Pastebin purporting to show access to a "really insecure" Supervisory Control and Data Acquisition (SCADA) system in the city of South Houston.
The posting was prompted by what the hacker claimed was the DHS’s attempts to downplay the Springfield incident. "This was stupid," pr0f wrote in a note on Pastebin. "I dislike, immensely, how the DHS tend to downplay how absolutely f**** the state of national infrastructure is," the hacker wrote.
The hacker claimed that no damage was done to any of the machinery. "I don’t really like mindless vandalism. It’s stupid and silly," pr0f wrote. "On the other hand, so is connecting interfaces to your SCADA machinery to the Internet." The hacker said the Houston hack required no skill "and could be reproduced by a two year old."
It was not possible to immediately verify any of prof’s claims.
Joseph Weiss, managing partner at Applied Control Systems LLC and author of the book Protecting Industrial Control Systems from Electronic Threat said that the pump failure in Springfield occurred on November 8.
The pump burned out after the SCADA system controlling it began to power off and on intermittently, said Weiss, citing the incident report he obtained titled "Public Water District Cyber Intrusion".
Employees had reported "minor" glitches with the remote access component of the compromised SCADA system for between two and three months prior to the pump failure, Weiss said. An investigation into the cause of the failure showed that the SCADA system had been improperly accessed by someone using a computer with an IP address based in Russia, he said.
The attackers are thought to have obtained the usernames and passwords to the system by first breaking into a computer belonging to the utility’s SCADA software vendor. SCADA vendors often maintain a list of usernames and passwords for accessing systems at customer locations for support purposes. Anyone with those credentials can gain access to the customer system, which is what appears to have happened here.
"It is believed the SCADA software vendor was hacked and customer usernames and passwords stolen," Weiss said in a blog post. It is possible that the attackers gained access to the login credentials of other SCADA users as well, but it is unclear whether any other utility has been attacked, he said.
Weiss, whose book documents similar attacks around the world, said the DHS needs to do more to warn other utilities of the attack.
"The disclosure was made by a state organisation, but has not been disclosed by the Water ISAC, the DHS Daily unclassified report, the ICS-CERT, etc." he blogged. "Consequently, none of the water utilities I have spoken to were aware of [the Springfield incident]."
A source close to DHS noted that the agency has not traditionally shied away from sharing information about cyber-incidents with all stakeholders. In this case, law enforcement is still investigating the cause of the pump failure so the agency has not yet been able to confirm that it was caused by a cyber-attack, he said.
IDG News Service
Ltd
