FL - Suspect remotely increased chemical level at city water system, Oldsmar, 5 Feb 2021

[Dallas Volunteer]

Hacker changed chemical level at Oldsmar water treatment facility | wtsp.com

A hacker gained access to Oldsmar's water treatment plant, bumping the sodium hydroxide in the water to a "dangerous" level, Pinellas County Sheriff Bob Gualtieri said.

In a press conference Monday, Gualtieri said his deputies, along with the FBI and U.S. Secret Service, are investigating the breach as it is unclear if it came from within the U.S. or from a foreign actor.

The incident first occurred on Feb. 5 at the city's water treatment plant when, around 8 a.m., an operator noticed someone had remotely entered the computer system that he was monitoring. It's a system responsible for controlling the chemicals and other operations of the water treatment plant, Gualtieri said.

At first, the operator did not think much of the action due to the common use of the remote access software by supervisors to troubleshoot from different locations. That's until it happened again.

And this time, Gualtieri says, the hacker did more than just remote in. According to the sheriff, the hacker spent up to five minutes in the system and adjusted the amount of sodium hydroxide in the water from 100 parts per million to 11,100.

“This is obviously a significant and potentially dangerous increase. Sodium hydroxide, also known as lye, is the main ingredient in liquid drain cleaners," Gualtieri added.

The operator immediately reduced the levels back to the appropriate amount and “at no time was there a significant adverse effect on the water being treated.”

Even if the operator did not notice the intrusion, the sheriff, Oldsmar Mayor Eric Seidel and City Manager Al Braithwaite all noted several fail-safes and alarm systems are in place to flag issues of this kind.

Gualtieri reinforced that at no time was the public in danger.

“The important thing is to put everyone on notice and I think that’s really the purpose of today is to make sure that everyone realizes that these bad actors are out there," Seidel said.

 

[Dallas Volunteer]

Turns out that Florida water treatment facility left the doors wide open for hackers

.....any employee could adjust the entire town’s water supply on a whim from anywhere in the world. Which is probably what happened: former US cybersecurity czar Christopher Krebs testified earlier today that it was “very likely” an insider, possibly a disgruntled employee. Someone who would already have access, which wouldn’t make this much of a “hack” at all

.....just like Florida’s Department of Health, this Florida water treatment plant apparently didn’t bother to issue individual passwords for software that could give anyone complete access to any of their computers and their water treatment system

It’s not like the water treatment plant was even using that software, by the way: Pinellas County Sheriff Bob Gualtieri said the plant had actually stopped using TeamViewer six months ago, according to The Wall Street Journal, but still left it installed.

It should probably go without saying that you shouldn’t leave critical public infrastructure easily accessible from anywhere in the world, but the FBI is saying it anyhow, according to ZDNet; the agency sent out an alert today warning against TeamViewer, bad passwords and Windows 7, which Microsoft no longer supports with security updates but the water treatment plant still had installed.

Sadly, reports at Vice and Cyberscoop suggest that lax security (including TeamViewer specifically) and aging infrastructure are all too common at small public utilities, which may not have the budget, expertise or even the ability to control their own security systems, instead often farming them out to third parties.

 

[PayrollNerd]

This doesn't surprise me in the least. Public entities that rely on tax revenue to update their systems many times do not get the increases they request. The community doesn't vote it in so there's no funding.

I once worked in a public entities office on a payroll system that was an old DOS system. This was mid 2000s. Needless to say, I didn't stay long. I can't help you if you don't help yourself.

 

[oceanstarryeyes]

the FBI and U.S. Secret Service, are investigating the breach as it is unclear if it came from within the U.S. or from a foreign actor.

HOW this happened needs immediate attention.

 

[oceanstarryeyes]

It takes me hours trying to find where to post a new thread.

 

[Dallas Volunteer]

Federal cybersecurity advisory offers new details on Oldsmar water supply cyberattack | WFLA

Two weeks have passed since the Pinellas County Sheriff said someone tried to poison the city of Oldsmar’s water supply through a computer system hack.

A federal cybersecurity advisory issued on Feb. 11 by the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, the U.S. Environmental Protection Agency and the Multi-State Information Sharing & Analysis Center offers new insight on the cyberattack.

In the summary of the “Compromise of U.S. Water Treatment Facility” from Feb. 5, the federal agencies said the attacker likely exploited cybersecurity weaknesses, including poor password security and an outdated operating system.

“Early information indicates it is possible that a desktop sharing software, such as TeamViewer, may have been used to gain unauthorized access to the system, although this cannot be confirmed at present date,” the report said.

The Pinellas County Sheriff’s Office, the FBI and U.S. Secret Service are still trying to figure out who is responsible for the cyberattack.

“We don’t know right now whether the breach originated from within the United States or outside the country,” Sheriff Bob Gualtieri said during his news conference on Feb. 8.

The attacker attempted to elevate the chemical lye to dangerous levels, the sheriff said, but an alert plant operator noticed suspicious activity on his computer screen and quickly reversed the levels to a safe amount.

“Luckily somebody stopped it beforehand, but what it did was open my eyes that there’s something going on in our state,” Florida Agriculture Commissioner Nikki Fried (D) said.

According to Fried, since 2013 Florida has faced the fourth most cyberattacks on local governments of any state.

Fried sent a letter to Gov. Ron DeSantis requesting a discussion on cybersecurity preparedness at the next cabinet meeting.
.......