Cyber attacks on critical infrastructure reach U.S.
by remote commands, over a 1-day period. The utility operating the pump noticed that the pump was behaving strangely in the weeks leading to its destruction.
Joseph Weiss of Applied Control Solutions, and author of Protecting Industrial Control Systems from Electronic Threats, told the Register that a report, issued on 10 November by Illinois authorities, said that the hackers who took control of the pump and then destroyed it used an IP address in Russia. The hackers managed to penetrate the water district’s SCADA systems (Weiss provided more details in ControlGlobal.com).
“This is really a big deal, and what’s just as big a deal is what isn’t being said or isn’t being done,” Weiss said. “What the hell is going on with DHS? Why aren’t people being notified?”
Weiss also said that the hackers who attacked the Illinois water utility could have obtained passwords for many other customers of the SCADA manufacturer, possibly leading to other industrial facilities now being susceptible to attack. Some of these facilities may already have been breached.
In this light it is unsettling to note these two stories: a report in InfosecIsland that a water supply network in South Houston, Texas, has been successfully hacked recently, and this report in NorthJersey.com about how water and sewagew facilities in West Milford have been repeatedly compromised.
Which brings us back to Stuxnet. “Despite [DHS’s] reassurances, online security specialists are already drawing parallels between the Illinois attack and the Stuxnet virus that impacted Iranian nuclear facilities in 2010,” Slashgear reports.
These security experts are right. Most of the U.S. critical infrastructure – both the 85 percent of that infrastructure which is in private hands, and the 15 percent which is run by government agencies – is run by computers which are connected to the Internet. This makes them susceptible to cyber attacks. Stuxnet and Duqu prove that cleverly designed malware can take over control systems of infrastructure assets and then sabotage these control systems and the assets they monitor and run.
A few days ago the control system of a water pump in Illinois was taken over by a hacker’s remote command, and then deliberately destroyed. What critical infrastructure facilities will hackers – nerdy teenagers, terrorists, or intelligence operatives of other nations – target next?
Ben Frankel is the editor of the Homeland Security NewsWire
