Iran has been accused of conducting a cyber campaign targeting Israeli water and sewage facilities in recent months. Reports started circulating after the Israeli Water Authority ordered all personnel to immediately change the passwords to the facility’s systems adding that if “the passwords could not be changed, the system should be disconnected from the internet entirely.” After further investigations, it now appears that a piece of Iranian-written code, seeking to mask its origins, made its way through servers in the US and Europe before arriving at its final target: software controllers that pump water into Israeli homes. Intelligence sources report its goal was to mess with chlorine levels used to treat water for flowing to the Israeli population.
While the cyberattack does not seem to have caused any damage, sources with knowledge of the incident suggested that the water facilities operational systems and chlorine controls may not be adequately protected.
When it comes to water safety here in the U.S., most citizens, regulators, and lawmakers are focused on water scarcity and quality issues stemming from pollution, climate change, and other man-made challenges. The cyber risks to our H2O infrastructure have yet to enter the public debate in the way that vulnerabilities in the electric grid have, despite proven attacks on this critical infrastructure. In 2016, a group of relatively unsophisticated hackers, likely with little knowledge of industrial control systems, infiltrated an unnamed water treatment facility. The attackers compromised the Internet-facing server running the utility’s online payment application, which also contained the credentials for the Supervisory Control and Data Acquisition, or SCADA, system. In this case, the utility’s industrial control systems were running on a 1980s-era IBM machine. From there the hackers were able to manipulate the water treatment process, altering water flow settings and the amount of chemicals used in the treatment process in four separate breaches over the course of two months.
Read Full Article »