That’s a scary title, isn’t it? It could have been the headline in newspapers this week had it not been for the watchful eye of a water treatment plant operator in Oldsmar, Florida.
Last week, a hacker (or group of hackers) attempted to poison a Florida city’s water supply by accessing a dormant remote access software platform. If it hadn’t been caught in time, at least 15,000 people could have been affected.
Law enforcement, including the FBI, the Secret Service, and the Pinellas County Sheriff’s Office are currently investigating how the threat actor got in and who would want to do this. What we know so far is that a plant operator at the Oldsmar water treatment facility noticed someone remotely accessing the computer system he was monitoring — once at about 8:00am and again at 1:30pm — to open the function that controls the amount of sodium hydroxide (lye) in the water.
Lye is used to treat acidity in water by raising its pH levels and removing heavy metals. Too much lye in the water could cause skin burns and rashes — and the hacker changed the lye ration from about 100 parts per million to 11,100 parts per million. This is obviously a significant and potentially dangerous increase. After the attacker left the system, the operator quickly reduced the lye concentration level back to normal, so there was no adverse effect on the water. Importantly, the water treatment plant had redundancies in place, so if the operator had missed the hacker’s intrusion, the system would have caught the change in time.
So, what was this? A test by nation-state actors? An attempt to severely harm the townspeople of Oldsmar? As of this writing, there are no indications that this was targeted attack. The Pinellas County Sheriff’s office doesn’t have a suspect but is following leads — none of which point to terrorism. It may simply have been an act of vandalism. Vulnerable Internet-connected Industrial Control Systems (ICS) are not difficult to find.
In the case of the Oldsmar water treatment facility, the attack was neither successful nor sophisticated. A remote access software tool was either exposed to the open Internet or accessed via brute force/password. (Although law enforcement say they don’t know how hackers got onto the system, a CNN source counters that a password was required to operate the software remotely.) Unfortunately, a sophisticated attack isn’t required to render a dangerous result, and what happened at Oldsmar simply highlights how many critical infrastructure systems are vulnerable.
IT and security professionals charged with securing vital infrastructure needn’t panic — the first priority here isn’t shielding against complex zero-days or advanced persistent threats. Instead, it’s the kind of grunt work facing all in cybersecurity today, such as patching, air-gapping, and enforcing two-factor authentication. My advice for anyone in infrastructure or others using remote access software:
- Be careful with how much remote access software you deploy on your network. You should never leave this software unused for long periods, especially if it’s left open to the Internet.
- Ensure that the remote access software you do have is configured properly. Open it only to staff that require remote access, and require they access it using a strong password and 2FA.
- Remote Desktop Protocol (RDP) should be kept closed or used with protection, such as our Brute Force Protection module in Malwarebytes Nebula.
To learn more about the hack of the Florida city water facility, read our blog on Malwarebytes Labs: