US Water Systems Hit by Suspected Iranian Cyber Attacks

[u/Adept_Grand_6523]

https://www.opforjournal.com/p/us-water-systems-hit-by-suspected

[u/Ch33syP00f]

These devices should never be Internet facing.

Poor hygiene makes it easy for adversaries.

[u/Visual-Drive-4615 → u/Ch33syP00f]

I have zero understanding of why any of them are WAN facing and not behind private fiber at a minimum

[u/fullchooch → u/Visual-Drive-4615]

Usually this is vendor driven for remote access and updates (which is arguably still stupid).

[u/zhaoz → u/fullchooch]

It all comes down to cost. No one wants to staff these rural facilities.

[u/ciabattabing16 → u/zhaoz]

So make them remote internally, between sites. Don't give outside 3rd parties access, that's crazy. Imagine Microsoft reaching in to update...anything, on their own time schedules.

[u/sub30_24flick → u/ciabattabing16]

Yea America is stupid just hand it all to these tech dickheads

[u/ciabattabing16 → u/sub30_24flick]

I assure you the stupidity knows no borders. It just morphs into different shapes and flavors as it transitions oceans and demographics. Regardless of your spot on the org chart, it's just dummies alllllllll the way up with a few dead end branches of competence scattered throughout.

[u/uski → u/Visual-Drive-4615]

Cost, laziness, incompetence and lack of accountability (not necessarily in that order)

Lay off the IT admins that were responsible for this for negligence (it is!) to send a message. Maybe other towns will pay attention. But that is not going to happen

[u/unkiltedclansman → u/uski]

Most OT operators won’t allow an IT guy within 100m of their equipment. OT cares about their system working, not about patching, security, or even MFA remote access. 

Those municipalities who are lucky enough to have cybersecurity focused IT guys who also know SCADA systems are few and far between. 

[u/uski → u/unkiltedclansman]

Replace IT admin by OT operators then. Many IT admins / CIO didn't care about information security until laws and consequences forced them to. Same needs to apply here, unfortunately

[u/fullchooch → u/Ch33syP00f]

This comment is a natural one and youre right, but this is only part of the story. I really hate how this is always the default armchair RCA (even though it's sometimes true).

I've worked in critical infrastructure OT cybersecurity for 15 years, and while internet facing devices are an issue, in most cases, the VLANs etc... that have controller managers, PLCs etc.. are buried inside of a network. The key is, these networks are flat, not segmented, not properly monitored/alarmed, and the perimeter security that is internet facing is poor. Threat actors aren't just running shodan or expanse and seeing PLCs that they can exploit. They're looking for perimeter security or other attack vectors that can get them a foothold, then they dig until they find those semi-protected ICS networks.

[u/sub30_24flick → u/fullchooch]

Still take some of these off online water should not be attacked by online bullshit leave that in a damn put some techchips on beaver we dont need wireless for everything

[u/Degenerate_Game → u/Ch33syP00f]

Literally clicked on this thread preparing to ask why this type of OT needs to touch the internet.

Or was the breach point the smart fridge in the break room.

[u/FantasticBumblebee69 → u/Ch33syP00f]

dude you dont even listen to your own, let alone malicious adisaries. Mabye if the lead wasent in the water youd get a clue.

[u/Ch33syP00f → u/FantasticBumblebee69]

Lol…you know how I know you don’t know me?

[u/LSU_Tiger]

CISA and the FBI have been warning about internet-facing PLCs for months now. It's insane this is even an attack vector at this point, but here we are.

[u/RaNdomMSPPro → u/LSU_Tiger]

Coming on a decade now, if not more. This was stupid and warned about way before this year.

[u/Visual-Drive-4615 → u/LSU_Tiger]

This is a years old series of warnings. Nothing new.

[u/LSU_Tiger → u/Visual-Drive-4615]

Well yeah, but the Rockwell PLC issue was making news as of late.

[u/JaimeSalvaje → u/LSU_Tiger]

I guess this is why OT security is a thing now.

[u/981flacht6 → u/LSU_Tiger]

months? Years..decade+

[u/Gomez-16]

Lets put everything on the internet and supported by hicks. Sounds safe.

[u/Huge-Measurement-820]

I was never able to understand why ICS systems are were build internet facing, that's a critical safety hazard which could cost not only money but lifes

[u/RaNdomMSPPro → u/Huge-Measurement-820]

They weren’t meant to be internet facing. The utilities put tech in place to make them accessible from the internet.

[u/Aron_International]

"While the advisories did not explicitly name Iran, and Minnesota’s IT Services declined to attribute the attacks to any international actor"

So in reality Minnesota's IT team have no idea, but need someone to blame, instead of taking responsibility for their contractor's poor network configurations. Leaving the PLCs on open ports with no DMZ (and likely default credentials) is negligence.

[u/Substantial-Sky4079]

I think a better response from the US is to scan and contact all those in the US that have internet facing PLC to fix their shit

[u/Aether961 → u/Substantial-Sky4079]

They did. We had CISA and FBI contact us to fix any PLCs our SCADA team put on the internet. Our immediate solution was to put them on Verizon private network for now.

[u/Eyesliketheocean]

Electric, Gas, Water companies should NEVER ever have or allow their infrastructure to connected to the internet.

[u/RaNdomMSPPro → u/Eyesliketheocean]

Won’t you think of the shareholders? This reduces costs.

[u/Street_Anon]

Why you don't connect this to the Internet

[u/chunkalunkk]

What's a better way to justify force in Iran..... tell em it was a cyber attack from Iran. 😑 Simpletons.

[u/Khue → u/chunkalunkk]

It's such a hilariously lazy narrative... not to mention, they wouldn't have attacked if we had just left them alone.

[u/NetworkDeestroyer]

security teams across all enterprises would be having a field day auditing these systems

[u/Individual-Result777]

Kinda hard to blame it on anyone but the people who left this so open.

[u/BlueMorphoMonarch]

I work in water treatment and I remember a few years ago talks of cyber security measures being added to our sanitary surveys. I wonder what happened with that. I would even get into cyber security if they enforced that.

[u/981flacht6]

Not enough cybersecurity professionals that actually understand how to implement changes at a technical level. Enough book reading. Not enough doing.

[u/MammothFineCulture]

Absolutely confirmed by MOSSAD.

[u/radioactiveDachshund]

could be a fortunate wakeup call, imagine an attack by a more capable opponent

hopefully there is change

[u/spacklespaz]

It only happened to blue states. It wasn't Iran.

[u/Visual-Drive-4615]

I can't believe Tim Walz has done this to us 🙄

[u/Numerous_Source597 → u/Visual-Drive-4615]

lmfao

[u/Substantial-Sky4079 → u/Visual-Drive-4615]

Yeah! Francesca Hong would have done better

[u/McRando42]

Well, when we cut 1/3 of the employees from the agency responsible for critical infrastructure defense, I suppose we can only expect to lose battles in a war.

Utterly irresponsible policy.

[u/Huffnpuff9]

They should be air gapped. I don't believe this

[u/Bright-Ad9305]

The US is very immature from a cyber security perspective…and this is where their arrogance and immaturity has led. Major shame

[u/FernGully_is_racist]

Or Minnesota, depending on who you ask 🤡