US Water Pump System Utility Sabotage By Scada Hackers

Russian hackers may have sabotaged a water pump in what’s being described as the first foreign cyber attack on US utility infrastructure, damaging both hardware and confidence in critical systems.
The FBI and DHS are investigating damage to a public water system in Springfield, Illinois, which may have been the target of a foreign cyber attack. The teams involved insist there is no cause for ongoing concern,”there is no credible corroborated data that indicates a risk to critical infrastructure entities or a threat to public safety.” An FBI spokesman in Illinois did not return phone calls seeking comment.

Completely separate from that you have the fact that the SCADA was accessible from the internet and had weak security. Over a period of two to three months, minor glitches had been observed in remote access to the water district’s SCADA system” security expert Joe Weiss told The Register, having acquired a copy of the Illinois report detailing the water pump hack. Coincidentally, a water treatment facility was publicly hacked at the Black Hat conference back in August, precisely to highlight this type of vulnerability.

Then you look at the controls guy, if the motor can burn out from being turned on and off too much, the PLC program should not have allowed you to turn it on and off like that. Then you look at the SCADA guy (might be the same guy that did the PLC code, might not be), the ability to remotely turn a machine on and off is completely unacceptable for safety reasons. It is reportedly usual for usernames and passwords to be hard-coded to SCADA hardware, which could make a broad security refresh more difficult than with traditional enterprise systems.

It isn't unreasonable for it to be connected to the internet, nor for it to be on a private network with a simple password, but a simple password and on the internet isn't so good. But, it shouldn't be a big deal because you should only be able to view data remotely, never control a machine.